Description

This article describes the issue of the commit configuration error, when the number of object values is exceeded.

Symptoms

The following error message are generated when security policy are committed:

  • Exceeded the max number of entries (128)

  • Error reading applications name

  • Configuration check-out failed

Solution

The maximum number of objects supported in individual SRX policy entries is 128. SRX supports up to 1024 source prefixes, 1024 destination prefixes, and 128 service objects per policy entry (up to the maximum number of supported policy entries per platform).

If such a setup is required, you can split the policy with reference to objects.

Example of an application as the object:

  • source-address = ABC
  • destination-address = DEF
  • applications = XYZ ( which more than 128 objects )


Security policy throwing error :
root# show security policies
from-zone trust to-zone untrust {
     policy 1 {
         match {
             source-address any;
             destination-address any;
             application [XYZ];
        }
then {
     permit;

Split the above policy into two as 1a and 1b.
root# show security policies
from-zone trust to-zone untrust {
    policy 1a {
        match {
            source-address any;
            destination-address any;
            application [XYZ/2];
        }
then {
     permit;

root# show security policies
from-zone trust to-zone untrust {
     policy 1b {
         match {
             source-address any;
             destination-address any;
             application [XYZ/2];
         }
then {
    permit;

Note : application XYZ/2 indicates splitting the objects in as such a way, that it contains less than 128 values. The same thing needs to be done with the source-address and destination-address; if it exceeds the value of 128.

Related Information