Maximum number of addresses exceeded

[AhamadullahM]

Hi All,

We are facing the below issue while committing and pushing the configuration to the device from Panorama. We have already "unchecked Share Unused Address and Service Objects with Devices" but still we are facing the issue Kindly help to resolve the issue.

• Details:
• . Validation Error:
• . address constraints failed : Maximum number of addresses exceeded
• . address is invalid
• . Warning: No Valid DNS Security License
• . Error: Number of addresses, dynamic groups, external-ip-lists, external-predefined-ip-lists and predefined ip-block-lists (3520) exceeds platform capacity (3500)
• . (Module: device)
• . client device phase 1 failure
• . Commit failed

Thanks you all for your prompt responses

[TomYoung]

Hi @AhamadullahM ,

The problem may not be your number of addresses or dynamic groups, but rather the number of entries in your external-ip-lists, external-predefined-ip-lists and predefined ip-block-lists.

On the NGFW (not Panorama), click on each custom EDL under Objects > External Dynamic List (or External Block List) and then click on List Entries and Exceptions and add up the total number of entries for all of them.

What PAN-OS version and platform do you have?

Thanks,

Tom

[AhamadullahM]

Hi ,

The current PAN-OS version is 10.1.5

I have added more info, We have 3 administrator profiles and two administrator profiles have the facing issue. 

[ozheng]

Hello AhamadullahM,

You need to "cleanup" your config : remove the address objects you are not needing anymore, aggregate some entries (2 IP address in the same subnet can be directly defined in a subnet for instance).

For now, you simply need to remove 20 address objects.

Or you consider to upgrade to a platform with higher platform limit.

Also, if you are in multi-vsys, upgrading to 10.2 can save you some objects (thank to how shared objects are managed from 10.2).

Olivier

[jschwier]

Dear all,
we do have the same problem on customer site since upgrade to 10.1.x.

All the systems are PA-220, PA-820 and PA-850.

The commit works on some systems, but not on others. The message that the number of address objects is exhausted is displayed again and again.
Strangely enough, the commit works some time later on some systems that previously had the problem.

In addition, the number of addresses in the error message is exactly four higher than currently available in the panorama.
No matter how many we delete or add.

Due to the fact that the commit work after some time we do not open a case.
But I think this seems to be more a bug on Panorama, which try to push all addresses to the device. Redardless of the switch "Share Unused Address and Service Objects with Devices".

Joachim