SRX

I have a strange issue where I have a configured SRX cluster with ~2000 addresses and ~1000 address sets.  Quite a few of the addresses and addresses are unused, but I want to keep them for future use.

When I add the SRX cluster to SDC the device adds successfully with the usual request to assign a licence and a small deployment sync error that is always just about a certificate for SDC or similar, i.e. nothing out of the ordinary.

When I go to the Security policy it (as usual) states that it needs to be deployed, despite just being imported. Upon checking the pending changes there is the usual adjusting of some names to match what other devices in the SDC are already using, things like capitalisation changes etc., but it also wants to delete 1430 addresses and 422 address sets.

Do I need to add all of the addresses and address-sets to a rule so that they don't get deleted, or is there a better way?

Thank you

I found this is by design and the only option to retain them (if you want to) is to add them to address-sets and put those in inactive rules.

There is a limit of 256 address-sets per address-set, but no limit to addresses that I found.

Apparently there is a limit of 10 address-sets or addresses in a rule, though the SRX accepted 300 before I decided to change to address-sets, so that may be an old limit that no longer applies.