Commit Failure with "Error: Number of security rules exceeds platform capacity"
4148
Created On 06/23/22 06:04 AM - Last Modified 10/22/24 13:00 PM
Symptom
The commit job fails after adding new security rules:
Commit job 12 is in progress. Use Ctrl+C to return to command prompt
..........55%.
vsys1
Error: Number of security rules (40023) exceeds platform capacity (40000)
Error: Failed to parse security policy
(Module: device)
Commit failed
Environment
- PA-Series Next-Generation Firewall
- PAN-OS 8.1 or later
Cause
There is a limit to the number of security rules for each platform.
This limit can be checked from the CLI with the "show system state filter cfg.general.max-policy-rule" command.
> show system state filter cfg.general.max-policy-rule cfg.general.max-policy-rule: 40000
If the limit of the number of security rules is exceeded, the following error message will be output and the commit job will fail.
Error: Number of security rules (40023) exceeds platform capacity (40000)
Resolution
Delete the security rules as necessary so that the number of security rules is less than the capacity of the platform.