How Many ACL Entry

[emily]

Hello ~

I would like to know , The Cisco PIX 535 can support how many acl rule ?

[scoclayton]

Hi,

The limit on the number of ACLs on the 535 is more a function of the maximum configuration size, which is 2 MB. What that means is that the ACL limit would be determined by the maximum configuration size minus the size of the rest of the configuration.

If performance of a large ACL is an issue, you may want to consider Turbo ACL's that was added to later PIX code.

Hope this helps.

Scott

[shannong]

As mentioned, the config size is the limiting factor. Turbo ACls will let the Pix process them faster. [access-list compiled] Be careful about making changes during heavy loads as the pix recompiles the ACL everytime there is a change.

To keep the config size as small as possible for max ACE entries, use the object-groups whenever possible. Adding multiple hosts to an object-group has a smaller footprint than the same number of ACEs. However, this is only true if you're going to make several entries in the object-group.