topic Re: How Many Rules Supported? How Many Objects Supported? in Firewall and Security Management

How Many Rules Supported? How Many Objects Supported?

PhoneBoy — Mon, 27 Nov 2023 14:33:08 GMT

We now have sk178325 that details the various limits related to the maximum number of:

Rules supported (per policy)
Objects supported (includes Multi-Domain specifics)
Objects per group
Changes per Publish operation
Interfaces per gateway (above and beyond the limits specified in sk31631)

Actual limits you experience will depend on a number of factors, as noted in the SK.

Re: How Many Rules Supported? How Many Objects Supported?

the_rock — Wed, 06 Sep 2023 23:35:25 GMT

I recall even 15 years ago, number 10000 was always floating around : - )

Andy

Re: How Many Rules Supported? How Many Objects Supported?

PhoneBoy — Wed, 06 Sep 2023 23:54:33 GMT

That number may have been valid in R7x and earlier for the number of rules.
In practice, if you've got a policy of several thousand rules, it's going to be hard to manage regardless of potential performance issues that result from using a large number of objects/rules.

Re: How Many Rules Supported? How Many Objects Supported?

the_rock — Wed, 06 Sep 2023 23:57:15 GMT

Honestly, I cant think of any company on this planet that would even need 1000 rules, though I recall once seeing someone with 5000 + rules, probably 3000 of them disabled LOL

When I asked the guy the reason, he just told me they were scared to clean it up, JUST IN CASE...some people : - )

Andy

Re: How Many Rules Supported? How Many Objects Supported?

S_E_ — Thu, 14 Sep 2023 05:27:27 GMT

hi,

there are companies who do have this request:

https://community.checkpoint.com/t5/Management/Maximum-number-of-rules-in-R80-40-and-above/m-p/138269

But it is great that CheckPoint creates an official document with numbers/limitations.

Regards

Re: How Many Rules Supported? How Many Objects Supported?

S_E_ — Mon, 26 Feb 2024 13:38:11 GMT

hi,

b.t.w. is there also a SK for gateways ?

Limitations for BGP, routing table / max connections...

Appliance Sizing Tool (AST) /CPSizeMe is not really helpful in our cases.

Thanks/bye

Re: How Many Rules Supported? How Many Objects Supported?

the_rock — Mon, 26 Feb 2024 13:41:07 GMT

I had personally never seen one.

Best,

Andy

Re: How Many Rules Supported? How Many Objects Supported?

Chris_Atkinson — Mon, 26 Feb 2024 14:18:29 GMT

Max concurrent connections is reported on the appliance datasheets

Note it's otherwise a function of memory population and enabled blades.

Re: How Many Rules Supported? How Many Objects Supported?

the_rock — Mon, 26 Feb 2024 14:22:08 GMT

Make sure below is enabled, as it lets firewall calculate the connections based on the resourses available.

Andy

Re: How Many Rules Supported? How Many Objects Supported?

S_E_ — Mon, 26 Feb 2024 14:38:18 GMT

hi yes, thanks. Just cross-checked and auto optimization seems to be default.

Data sheet mentioned 8M (for the lab but not real data) which is far beyond 400K connections.

Thanks