When running a commit via Space, SD, etc, or locally on the SRX, the following error message may be seen:

Severity : error

At : [edit security nat source rule-set <rule-set> rule <rule> match]

Message : Too many referenced IPv4 address in rule(1025)

Details : destination-address-name <address name>

It is not possible to do the commit.

Source NAT rules cannot have more than 1024 source or destination address objects.

This is in reference to the number of address objects, and not individual IP addresses. However, it may not be immediately apparent how many address objects are actually part of the rule. Any address-set can reference another address-set. All the address-sets must be broken out until there is a list of all the included address objects. Any number over 1024 will give the error of 1025 because when the process is adding the address objects, as soon as it reaches 1025 it will give the error and stop trying to add more.

In order to resolve this, there are three options.

1. Make an audit of all the included address objects and delete any that are no longer needed.
2. Consolidate address objects into supernets. Not a new address-set as that would produce the same result, but rater if you have for example 10.0.0.4/32, 10.0.0.5/32, 10.0.0.6/32, 10.0.0.7/32, you can make a new address object 10.0.0.4/30. Then delete the /32 address objects from the NAT policy, or the address set that includes those addresses, and then instead add the /30 supernet.
3. The quickest solution is to split up the nat rule. Put half of the address objects into a new rule that specifies the same NAT pool.

Note: If option 3 is used, any active session that will be moved to the new NAT rule will be interrupted.