FWSM Resource partition limitations

webfusion-networks · ‎04-09-2010

Hi,

I'm configuring the FWSM at the moment, and I'm aware that each resource partition in the standard 11+the Backup partition gives you a set of 19219 rules, and further splits those rules into different types of ACE entries.

For example, ACL's are 14801, and AAA is 1345.

I've used the command "rule nat" to go through and reduce the AAA rules to 5, and I'd like to re-allocate the 1340 rules left over for ACL, but even after a re-boot, the ACL limit stays at 14801, even though "avaliable to alocate" indicates 1345.

If I make less partitions, I get more ACL statements, but still can't reduce unwanted rules to add to the ACL rules list. Is this just a maximum imposed limit on the device, or am I missing something?

Seems like a waste of rules, as there's a few thousand rules allocated I won't use that I can't place into ACL's.

Jennifer Halim · ‎04-09-2010

Unfortunately the ACL absolute maximum is 14801.

The ones that you can increase from default value is policy NAT, filter, fixup, AAA and console.

Check the first column (default value) to the last column (absolute maximum), those with the same value can't be increase anymore:

http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/configuration/guide/specs_f.html#wp1067906

Hope that answers your question.

webfusion-networks · ‎04-09-2010

Ah, that's what I suspected. If I make less partitions the acl "maximum" of course goes up, but still has an imposed limit.

That's what I suspected, thanks very much for clearing it up.