We have been working with PNSC 3.0(2e) and VSG 4.2(1)VSG2(1.1) running on top of 1000v switch 4.2(1)SV2(2.1a).
We are using VMWare 5.5.
Note: These are not Cisco Licenses, they are running in a Licensed VMWare Plus platform and we have downloaded these from Cisco Downloads - we are aware that this could be the problem but can't find any documentation specifically stating this.
We configured a rule with more than this and it caused the policy not apply to the VSG. The status in PNSC showed the failure and although everything continued to function it wouldn't work. So we modified our rules and split out the destination conditions into multiple rules and re-applied and it started to work. We found that the limit in the destination (ip address) field was 8 and at the time I think there were 2 in the source (port-groups).
Now however, we are finding that on a rule that only has 2 conditions where the source is a port-group and the destination is an IP, the 9th host that inherits that port-group (the port-group has max-ports set to 30), has all sorts of issues, doesn't get/keep dhcp, loses the will to live etc!
rule ten1-abcd-inbound/abcd-443@root/tenant1/c1 order 1804
rule ten1-abcd-outbound/1025_port@root/tenant1/c1 order 3105
Please note, I have replaced/removed all references to business specific architecture and IP ranges, however the construct remains the same. I have also removed the majority of rules for brevity and the point remains the same, for either inbound or outbound we are faced with the same issues.
I hope someone can give some guidance on these limits - are we actually limited by the attribute/condition barrier when related to port-profiles configured inside source/destination of a rule?
I do hope I'm not mis-understanding your question.....a common issue in forums I know. However, if my interpretation is correct, you are asking how many IP addresses, can a rule match on. For example, inside policy1, you have a rule called rule, you then have a source condition, destination condition, service/protocol....among other things of course. If your question is how many IP addresses is it possible to have in lets say the destination condition? Then I have to say, that's not the way to configure it. To do that you would create an "Object group".....add all those IP addresses to that Object group and then add the object group as a destination condition.
Also, the power of the VSG is built on VM names....if those IP addresses you are adding as a destination, are also VMs then use the VMname attribute, if they aren't use the method I've just described.
I hope that helps and apologies if I have completely mis-understood your question....if I have reply with a diagram (i'm better with pictures!!!!), and i'll see if I can help.