Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

FWSM Resource partition limitations


I'm configuring the FWSM at the moment, and I'm aware that each resource partition in the standard 11+the Backup partition gives you a set of 19219 rules, and further splits those rules into different types of ACE entries.

For example, ACL's are 14801, and AAA is 1345.

I've used the command "rule nat" to go through and reduce the AAA rules to 5, and I'd like to re-allocate the 1340 rules left over for ACL, but even after a re-boot, the ACL limit stays at 14801, even though "avaliable to alocate" indicates 1345.

If I make less partitions, I get more ACL statements, but still can't reduce unwanted rules to add to the ACL rules list. Is this just a maximum imposed limit on the device, or am I missing something?

Seems like a waste of rules, as there's a few thousand rules allocated I won't use that I can't place into ACL's.

Everyone's tags (1)
Cisco Employee

Re: FWSM Resource partition limitations

Unfortunately the ACL absolute maximum is 14801.

The ones that you can increase from default value is policy NAT, filter, fixup, AAA and console.

Check the first column (default value) to the last column (absolute maximum), those with the same value can't be increase anymore:

Hope that answers your question.

Re: FWSM Resource partition limitations

Ah, that's what I suspected. If I make less partitions the acl "maximum" of course goes up, but still has an imposed limit.

That's what I suspected, thanks very much for clearing it up.

CreatePlease to create content