Firewall-related capacity values

The following table provides the Firewall-related capacity values for the various NS-series Sensor models.

Notes:

• Config Update of Sensors fail if you exceed the limits in the table above.
• At a Sensor level, there are limits to the number of entities that you can refer to in the Firewall policies. For a given Sensor model, these limits are the same as the limit for Effective Access Rules
• The Sensor derives the limit by totaling rules in all the policies assigned to it. The number of rules in each policy is derived by totaling the rules assigned to each interfaces.
• Even if you refer to the same rule in all your policies, each reference is counted. For example, a policy with the following rule lines are applied to the Sensor interface.
  1. Source 10.1.1.10 | Destination 20.1.1.10 | Application: Gmail
  2. Source 10.1.1.10 | Destination 20.1.1.20 | Application: Gmail
  3. Source 10.1.1.10 | Destination 20.1.1.10 | Application: Gmail

  Though the first and third rule line are same in the above policy, both the references are counted. So, the number of policies here is 1 and the number of rule lines is 3.

• If you use a Group Rule Object such as Network Group, then entire Group is counted as one rule. Consider that a rule refers to a Network Group as the Source. This Network Group contains 3 HostIPv4 Rule Objects. These 3 Rule Objects refer to 10 IPv4 addresses each. In this case, the count for Source remains as one and the rule line is considered as single entity.