This article describes the error message Error exceeding maximum limit of policies with count (1024) , which appears after the commit command is issued.
commit
To avoid this issue, do not exceed the maximum firewall policy limit when configuring with the COUNT keyword.
On the SRX firewall, the error message Error exceeding maximum limit of policies with count (1024) is generated after the commit command is issued:
root@SRX-Node0 # commit [edit security policies from-zone trust to-zone untrust policy out_deny then] 'count' Error exceeding maximum limit of policies with count (1024). error: configuration check-out failed
This issue occurs when the maximum firewall policy limit is exceeded with the COUNT keyword.
For Junos, the maximum security policy limit is 1024, if the security policy is configured with the COUNT keyword.
The current number and maximum allowed can be seen with the following command. The "with statistics enabled" refers to the number of policies with "then count".
root@srx320> show security policies information Policy utilization counters: Number of policies : 37 / 1024 Number of global policies : 2 Number of policies with scheduler : 0 Number of policies with statistics enabled : 9 / 256 Number of unified policies : 3 Number of policy contexts : 23 / 256 Number of Policies per context : 7 / 1024 Number of Source addresses per policy : 4 / 2048 Number of Destination addresses per policy : 1 / 2048 Number of Applications per policy : 4 / 128 Number of Dynamic applications per policy : 1 / 4096 Number of URL Category per policy : 0 / 1024 Number of Source/destination identities per policy : 0 / 128 Number of Match source/destination identity feeds per policy : 0 / 1024
Dynamic policy counters: Messages received : 0 Messages rejected : 0 Add messages received : 0 Delete messages received : 0 Clear messages received : 0 Invalid messages received : 0 Add messages sent to PFE : 0 Delete messages sent to PFE : 0 Clear messages sent to PFE : 0 Policy added successfully : 0 Policy deleted successfully : 0 Policy cleared successfully : 0 Policy add failures : 0 Policy delete failures : 0 Policy clear failures : 0 SSAM send attempted : 0 SSAM send succeeded : 0 SSAM send failed : 0 Policy failures - bad configuration : 0 Policy failures - bad scope policy : 0 Unified policy status: Dependent-dynamic-application-lookup: disable Unified-policy-implicit-match: enable
root@srx320>
You can also check the maximum policy limit for the device by referring to KB24598 - [SRX] How the 'show log nsd_chk_only' command is helpful in troubleshooting [juniper.net]
Policies with "Count" option set is still max @1024 in SRX5800. As per Table 1: Policy Limitations for SRX found in Series Devices Configuring Security Policies.
2020-07-27: Added link to technical documentation for Configuring Security Policies 2025-04-30: Added command "show security policies information" which is no longer hidden. with counting enabled