This article describes how to know the maximum policy capacity of an SRX branch.
When adding a new policy you may see a commit errors:
Error exceeding maximum limit of policies with count (1024)
Or
Error exceeding maximum limit 1024
The current number and maximum allowed can be seen with the following command. The "with statistics enabled" refers to the number of policies with "then count".
root@srx320> show security policies information Policy utilization counters: Number of policies : 37 / 1024 Number of global policies : 2 Number of policies with scheduler : 0 Number of policies with statistics enabled : 9 / 256 Number of unified policies : 3 Number of policy contexts : 23 / 256 Number of Policies per context : 7 / 1024 Number of Source addresses per policy : 4 / 2048 Number of Destination addresses per policy : 1 / 2048 Number of Applications per policy : 4 / 128 Number of Dynamic applications per policy : 1 / 4096 Number of URL Category per policy : 0 / 1024 Number of Source/destination identities per policy : 0 / 128 Number of Match source/destination identity feeds per policy : 0 / 1024
Dynamic policy counters: Messages received : 0 Messages rejected : 0 Add messages received : 0 Delete messages received : 0 Clear messages received : 0 Invalid messages received : 0 Add messages sent to PFE : 0 Delete messages sent to PFE : 0 Clear messages sent to PFE : 0 Policy added successfully : 0 Policy deleted successfully : 0 Policy cleared successfully : 0 Policy add failures : 0 Policy delete failures : 0 Policy clear failures : 0 SSAM send attempted : 0 SSAM send succeeded : 0 SSAM send failed : 0 Policy failures - bad configuration : 0 Policy failures - bad scope policy : 0 Unified policy status: Dependent-dynamic-application-lookup: disable Unified-policy-implicit-match: enable
root@srx320>
This can also be seen in the /var/log/nsd_chk_only file. This file contains policy capacity configuration.
/var/log/nsd_chk_only
root@Apollo> show log nsd_chk_only | match "max " Max Policy = 1024 Max Policy Context = 256 Max Policy per Context = 1024 Max Statistics Counter = 256 Max Address per Policy = 2048 Max Applications per Policy = 128 Max Dynamic Applications per Policy = 4096 Max URL Category per Policy = 1024 Max Role per Policy = 128 Max User Identity Feed per Policy = 1024 Max Scheduler = 256 Max Security Zones = 32 Max Security Address Books = 32 Max VRF groups = 128 Max ICAP redirect profile number = 64 Max Advanced anti-malware policy number = 32 Max Secintel policy number = 32 Max tunne insepction profile number = 128
2025-04-30: Updated and included the no longer hidden command "show security policies information".