topic Re: Object limitation in R80.10 in Firewall and Security Management

Object limitation in R80.10

babasahebb — Wed, 03 Mar 2021 04:46:15 GMT

I am facing a slowness issue while adding more than 1500 objects in a single Object group/policy in R80.10.

Please help.

Thanks,

Sunil

Re: Object limitation in R80.10

PhoneBoy — Wed, 03 Mar 2021 06:10:19 GMT

Are you trying to add them all at once?
I would try to add them and publish changes in smaller chunks as trying to do 1500 at once is likely to take a while, even if you were doing this via the API.
Especially on R80.10, which is almost End of Support.
It's probably a good idea to look at upgrading to a more recent release.

Re: Object limitation in R80.10

babasahebb — Tue, 09 Mar 2021 11:23:37 GMT

Thanks, PhoneBoy,

I am trying to add a very small amount but after goes count more than 1500, its works very slowly.

Will this issue resolve after upgrading to R80.20 / R80.30?

Thanks,

Re: Object limitation in R80.10

G_W_Albrecht — Tue, 09 Mar 2021 11:31:32 GMT

I would assume yes - but it is of no real importance as R80/R80.10 are out of support starting May 1st 8) Why not upgrade to R80.40 ?

Re: Object limitation in R80.10

babasahebb — Tue, 09 Mar 2021 11:49:22 GMT

will go for an upgrade and share feedback on this.

Is there any other solution with-out upgrading?

Re: Object limitation in R80.10

G_W_Albrecht — Tue, 09 Mar 2021 13:37:03 GMT

You should look at performance, the load on SMS when the issue occurs compared to load before this object limit cuts in.

Re: Object limitation in R80.10

PhoneBoy — Tue, 09 Mar 2021 22:30:43 GMT

First off: why are you adding more than 1500 objects to a rule?
Or more specific: what precise steps are you taking?
Are you adding these objects directly to a rule, a group, or?
Based on that, perhaps we can suggest a way of working that would make more sense if you really don't want to upgrade.

Note that I can't say for sure that upgrading will solve the issue.
However, given that R80.10 is almost end of support, it's highly recommended.
There is zero reason to upgrade to R80.20/R80.30 at this point, go to R80.40 (the current widely recommended release).
There are significant improvements and fixes between R80.10 and R80.40.
If the issue still persists in R80.40, the odds of receiving a bugfix for it are much higher given where R80.10 is in its lifecycle.

Re: Object limitation in R80.10

babasahebb — Wed, 10 Mar 2021 05:05:14 GMT

Thanks,

We are monitoring the load of SMS, will update you on this.

Re: Object limitation in R80.10

babasahebb — Wed, 10 Mar 2021 05:05:38 GMT

Thanks, Guys for your reply.

We are planning to upgrade to R80.40, will come back with feedback post-upgrade.

Re: Object limitation in R80.10

pankajjain1 — Fri, 09 Dec 2022 05:18:14 GMT

Hi,

This is Pankaj, I am facing the same issue in r80.40 while adding the 30k objects in multiple group. Smartconsol is getting hanged. Please let know is there any limitation for the object.

As there is a requirement from the financial institution to block the malicious IPs in their firewall. Same Administrator are adding in the deny rule.

Re: Object limitation in R80.10

G_W_Albrecht — Fri, 09 Dec 2022 08:34:12 GMT

I think to add 30k objects is a very wrong way to configure a firewall ! If there is a requirement from the financial institution to block the malicious IPs we now have sk103154 - How to block traffic coming from known malicious IP addresses.

Re: Object limitation in R80.10

PhoneBoy — Fri, 09 Dec 2022 15:09:25 GMT

There isn’t a limit to the number of objects you can have in a rule per-se.
However, trying to add 30k objects to a group at one go will have issues, regardless of the method you use to do it.
If you were scripting this through the API, I’d say to add them about 100 at a time and publish the session after each batch.
It’ll probably work the same for SmartConsole.

Meanwhile, if you want a large number of IPs in a single object, it’s far better to use either Generic Data Center objects (R81 and above) or Network Objects (R81.20 and above).
Gateways will read the contents of these objects from a file on a remote server.
None of these methods require a policy install to update the objects on the gateways as a bonus.