Maximum Rules Limitation

There isn't a hard maximum with iptables, but due to the way that packets are processed (iterating through every rule until a match is found), even on the most powerful hardware, with lots of traffic passing, if rules aren't tuned for performance (most commonly matched ordered to the top), the functional limit is around 1000.  This number has been an administrative nightmare for those systems I've seen with anything approaching it.  300 is a good upper end administrative limit to handle.

Moved your post to the correct subject specific forum. Please don't post to General Discussion anymore unless it doesn't fit in any of the subject specific forum topics (same ones as Astaro.org). Thanks. :)

Luk,

Are you sure that they have the equivalent of that many rules in the UTM?  A single Firewall rule in WebAdmin can generate dozens of line-item rules in the back end, and it's those lines that correspond to Cisco's rules.  For example, as I understand it, the following, single rule generates 119 lines of iptables code:

If we had 4 internal subnets instead of one, it would generate almost 500.  It could take some effort, but don't give up without getting Sophos sales involved in the opportunity if you have a shot.

Cheers - Bob

PS I tried to send you a message, but couldn't.  Please change your Settings so that you can receive messages from everyone and then message me.  Thanks!