Outstanding global rulestacks not associated with NGFW
resources
10
Yes
Outstanding local rulestacks not associated with NGFW
resources
10
Yes
To change any of the adjustable limits listed above,
contact Palo Alto Networks Customer Support.
Native Policy Management (Rulestack)
Attribute
Maximum Limit per Cloud NGFW Resource
Adjustable
Security rules
1,000
No
Addresses objects (FQDN list and IP prefix lists)
1,000
No
Number of IP prefix list
1,000
No
FQDN objects across all FQDN lists
2,000
No
Prefix objects for each IP prefix list
2,500
No
Custom URL categories
500
No
URLs across all URL categories
25,000
No
Intelligent feeds (including the five predefined feeds)
30
No
IP addresses across all feeds
50,000
No
Certificate objects
100
No
Panorama Policy Management
Attribute
Maximum Limit per Cloud NGFW Resource*
Policy
Security rules
6,000
Decryption rules
1,000
Objects
Address objects
10,000
Address groups
1,000
Members per address group
2,500
FQDN address groups
2,000
Service objects
2,000
Service groups
500
Members per service group
500
EDL
Max number of DNS per domain system
500,000
Max number of IPs per system
50,000
Max number of URLs per system
100,000
Max number of custom lists
30
URL Filtering
Total entities for allow list, block list and custom
categories
25,000
Max custom categories
500
* The limits on policy and objects specified are unidimensional maximum. Palo Alto
Networks recommends additional testing within your environment to ensure you meet
your policy authoring objectives.
