topic Re: Limitation on number of host a group can have in Firewall and Security Management

Limitation on number of host a group can have

Ekta_Siwani1 — Mon, 29 Jan 2018 05:59:55 GMT

Hi,

I just want to know is there any limitation on the number of hosts a group can have.

Can I add n number of hosts in a group?

I am working with R80.10.

Re: Limitation on number of host a group can have

Tomer_Sole — Mon, 29 Jan 2018 06:11:48 GMT

Hi, there is no technical limitation.

Re: Limitation on number of host a group can have

Benjamin_Hofst1 — Mon, 29 Jan 2018 06:39:39 GMT

Hello, we had the concern that SmartConsole may not be able to handle large groups. This is why we tested it with 1500 Objects in a group. It was not a problem and it was still working as expected.

Re: Limitation on number of host a group can have

EdesLC — Mon, 29 Jan 2018 11:21:44 GMT

I have faced some issues when the group starts to be bigger than 1000 objects.

Re: Limitation on number of host a group can have

Tomer_Sole — Mon, 29 Jan 2018 11:25:20 GMT

can you elaborate?

Re: Limitation on number of host a group can have

EdesLC — Mon, 29 Jan 2018 11:48:07 GMT

Yes, of course.

I faced this kind of issue after I had used a "migration tool" Cisco to CheckPoint, this tool created 3 groups with more than 10000 objects inside, after import this database to CheckPoint management server I faced a big delay and slowness to navigate in this objects and problem to install policy "Failed Load Module". The slowness to open this kind of object was too weird, so I decided to delete this object, after that the management server back to normality. In the end I splitted this objects in two differents, problem solved .

Re: Limitation on number of host a group can have

EdesLC — Mon, 29 Jan 2018 11:52:38 GMT

@Tomer Sole, In the first reply I wrote 1000, I'm sorry, my mistake. The correct is 10000 (10.000).

Re: Limitation on number of host a group can have

Tomer_Sole — Mon, 29 Jan 2018 12:09:32 GMT

So actually we fixed the slowness when opening this object and published it in one of the R80.10 Jumbo Hotfixes in November. We have customers with groups that have 10k's of objects inside.

Re: Limitation on number of host a group can have

EdesLC — Mon, 29 Jan 2018 12:13:56 GMT

Nice to know. In my case the customer were facing this issue in R77.30 version. We are planning to upgrade that as soon as possible.

But Thank you so much, I didn't know about this fix for R80.10....

Re: Limitation on number of host a group can have

Tomer_Sole — Mon, 29 Jan 2018 12:21:26 GMT

Oh I'm sorry, all this time I referred to R80.10.. One of the major changes in R80 security management architecture is paged results, which lets you manage huge groups. For R77.30 while there is no technical limitation, working with the GUI with large group could have limitations.

Re: Limitation on number of host a group can have

EdesLC — Mon, 29 Jan 2018 12:24:55 GMT

I could be more specific about the version, sorry about that. : )

Re: Limitation on number of host a group can have

Gaurav_Pandya — Mon, 29 Jan 2018 14:11:27 GMT

Yeah. Technically there should not be limitation as I saw a group which has 5k objects. But yes at the end, management should be easy and simple

Re: Limitation on number of host a group can have

Ekta_Siwani1 — Tue, 30 Jan 2018 04:51:55 GMT

Thanks Tomer Sole.

I am assuming I can add even 50k's objects in a group without impacting performance in R80.10.

Re: Limitation on number of host a group can have

EdesLC — Tue, 30 Jan 2018 12:21:10 GMT

I don't recommend that. Maybe you can try to create object port range, network object or even network object range to try use less objects inside a single group, technically it couldn't be a problem but it will not be easy to manage.

Re: Limitation on number of host a group can have

Ekta_Siwani1 — Tue, 30 Jan 2018 13:04:08 GMT

Will this make console slow while uploading or you are saying from network admin point of view?