【Paloalto】ポリシーやオブジェクトなどの上限数を確認する方法【CLI】

【CLI】コマンドでの確認方法

<オペレーションモード>
show system state filter cfg.general.max*

test-user@PA-200-first(active)> show system state filter cfg.general.max* 
cfg.general.max-address: 2500 
cfg.general.max-address-group: 0xfa 
cfg.general.max-address-per-group: 0x9c4 
cfg.general.max-appinfo2ip-entry: 500 
cfg.general.max-arp: 0x1f4 
cfg.general.max-auth-policy-rule: 0x64 
cfg.general.max-blacklist: 0x61a8 
cfg.general.max-cert-cache-entries: 0x80 
cfg.general.max-ctd-session: 0x10000 
cfg.general.max-debug-pool: 393216 
cfg.general.max-di-nat-policy-rule: 160 
cfg.general.max-di-nat-pool: 500 
cfg.general.max-dip-nat-addrs: 160 
cfg.general.max-dip-nat-policy-rule: 160 
cfg.general.max-dns-cache: 0x7530 
cfg.general.max-dos-policy-rule: 100 
cfg.general.max-fibinstance: 0xff 
cfg.general.max-fibtrie-buf: 0x200000 
cfg.general.max-ha-aa-vaddresses: 32 
cfg.general.max-hip: 63 
cfg.general.max-ifnet: 0x64 
cfg.general.max-ike-peers: 1000 
cfg.general.max-ip6addrtbl: 4096 
cfg.general.max-ipfrags: 0x2000 
cfg.general.max-mac: 0x1f4 
cfg.general.max-mroute: 0x1f4 
cfg.general.max-nat-policy-rule: 0xa0 
cfg.general.max-neigh: 500 
cfg.general.max-oride-policy-rule: 0x64 
cfg.general.max-pbf-policy-rule: 100 
cfg.general.max-policy-rule: 0xfa 
cfg.general.max-profile: 0x4b 
cfg.general.max-proxy-mem: 0xc05920 
cfg.general.max-proxy-session: 0x400 
cfg.general.max-qos-policy-rule: 100 
cfg.general.max-qosbw: 1000 
cfg.general.max-qosif: 4 
cfg.general.max-qosnet: 32 
cfg.general.max-regions: 1024 
cfg.general.max-return-address: 0x8 
cfg.general.max-rexmt-segs: 4000 
cfg.general.max-route: 0x3e8 
cfg.general.max-route4: 0x3e8 
cfg.general.max-route6: 0x3e8 
cfg.general.max-routing-peer: 500 
cfg.general.max-schedule: 0x100 
cfg.general.max-service: 0x3e8 
cfg.general.max-service-group: 0xfa 
cfg.general.max-service-per-group: 0x1f4 
cfg.general.max-session: 0x10000 
cfg.general.max-shared-gateway: 0 
cfg.general.max-si-nat-policy-rule: 160 
cfg.general.max-signature: 0x1770 
cfg.general.max-ssh-proxy-session: 0x80 
cfg.general.max-ssl-policy-rule: 0x64 
cfg.general.max-ssl-portal: 6 
cfg.general.max-ssl-sess-cache-size: 1000 
cfg.general.max-ssl-tunnel: 25 
cfg.general.max-sslvpn-ck-cache-size: 5 
cfg.general.max-sslvpn-ck-cache-size-mp: 10 
cfg.general.max-threat-signature: 1000 
cfg.general.max-tunnel: 0x19 
cfg.general.max-url-pattern: 25000 
cfg.general.max-vlan: 0x1000 
cfg.general.max-vrouter: 0x3 
cfg.general.max-vsys: 0x2 
cfg.general.max-vwire: 0x2 
cfg.general.max-whitelist: 0x61a8 
cfg.general.max-zone: 0xa 
test-user@PA-200-first(active)>

参考

PA-200の場合、ポリシーの作成可能な最大上限数は250

【Paloalto公式】What is the Maximum Number of Rule Objects Supported?

PA-200の場合、アドレスオブジェクトの上限は2500
ポリシーの中で適用できるアドレスオブジェクトの上限は無限

There is no maximum number of IP addresses or address objects in security policies.
There are addresses and address group limits that are dependent on the Palo Alto Networks platforms.

引用元:【Paloalto公式】What is the IP Addresses/Address Objects Limit in Security Policies?

まとめ