topic FWSM 'acl-partition' x 'np blocks increment' in Network Security

topic FWSM 'acl-partition' x 'np blocks increment' in Network Security https://community.cisco.com/t5/network-security/fwsm-acl-partition-x-np-blocks-increment/m-p/1669014#M536203 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>Reducing the number of partitions will only give you more maximum ACL entries per context, lowering those won't help.</P><P>The only thing you can do is reduce the amount of traffic sent to the blade as these thresholds counter only increase once the blade is oversubscribed.</P><P></P><P>Regards,</P><P>Nicolas</P></BODY></HTML> Thu, 14 Jul 2011 21:09:04 GMT Nicolas Fournier 2011-07-14T21:09:04Z FWSM 'acl-partition' x 'np blocks increment' https://community.cisco.com/t5/network-security/fwsm-acl-partition-x-np-blocks-increment/m-p/1669013#M536202 <P><SPAN style="font-family: comic sans ms,sans-serif;">Hi everyone!</SPAN></P><P></P><P><SPAN style="font-family: comic sans ms,sans-serif;">I've two fwsm working in active/standby mode. I work with 5 contexts and I've 12 acl-partitions like these:</SPAN></P><P></P><P><SPAN style="font-family: courier new,courier;">FWSM/act/8/pri# sh resource acl-partition </SPAN></P><P><SPAN style="font-family: courier new,courier;">Total number of configured partitions = 12</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #0</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : fw01</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 1(RefCount:1)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 27(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #1</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : fw02</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 1(RefCount:1)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 1530(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #2</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : fw03</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 1(RefCount:1)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 51(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #3</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : fw04</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 1(RefCount:1)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 224(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #4</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : fw05</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 1(RefCount:1)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 1547(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #5</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : none</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 0(RefCount:0)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 0(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #6  </SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : none</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 0(RefCount:0)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 0(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #7</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : none</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 0(RefCount:0)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 0(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #8</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : none</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 0(RefCount:0)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 0(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #9</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : none</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 0(RefCount:0)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 0(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #10</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : none</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 0(RefCount:0)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 0(Max:19219)</SPAN></P><P><SPAN style="font-family: courier new,courier;">Partition #11</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Mode            : non-exclusive</SPAN></P><P><SPAN style="font-family: courier new,courier;">    List of Contexts     : none</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of contexts     : 0(RefCount:0)</SPAN></P><P><SPAN style="font-family: courier new,courier;">    Number of rules     : 0(Max:19219)</SPAN></P><P></P><P><SPAN style="font-family: comic sans ms,sans-serif;">I've many increments on thresholds of np blocks daily like showed below:</SPAN></P><P></P><P><SPAN style="font-family: courier new,courier;">FWSM/act/8/pri# sh np blocks </SPAN></P><P><SPAN style="font-family: courier new,courier;">                 MAX   FREE   THRESH_0   THRESH_1   THRESH_2</SPAN></P><P><SPAN style="font-family: courier new,courier;">NP1 (ingress)  32768  32704      91710   11529727  510646295</SPAN></P><P><SPAN style="font-family: courier new,courier;">    (egress)  521206 521203          0          0          0</SPAN></P><P><SPAN style="font-family: courier new,courier;">NP2 (ingress)  32768  32736      68720   10722600  330007417</SPAN></P><P><SPAN style="font-family: courier new,courier;">    (egress)  521206 521206          0          0          0</SPAN></P><P><SPAN style="font-family: courier new,courier;">NP3 (ingress)  32768  32768     114421    5635058   11278584</SPAN></P><P><SPAN style="font-family: courier new,courier;">    (egress)  521206 520761          0          0          0</SPAN></P><P></P><P>I've about 1.5 Gbps of traffic incoming and outgoing in all interfaces of firewall and about 200k connections per second.</P><P></P><P>I want to know if I reduce ACL-Partitions from 12 to 5 or to 1 can I stop these threshold be reached?</P> Mon, 11 Mar 2019 20:58:02 GMT https://community.cisco.com/t5/network-security/fwsm-acl-partition-x-np-blocks-increment/m-p/1669013#M536202 Fernando Patzlaff 2019-03-11T20:58:02Z FWSM 'acl-partition' x 'np blocks increment' https://community.cisco.com/t5/network-security/fwsm-acl-partition-x-np-blocks-increment/m-p/1669014#M536203 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>Reducing the number of partitions will only give you more maximum ACL entries per context, lowering those won't help.</P><P>The only thing you can do is reduce the amount of traffic sent to the blade as these thresholds counter only increase once the blade is oversubscribed.</P><P></P><P>Regards,</P><P>Nicolas</P></BODY></HTML> Thu, 14 Jul 2011 21:09:04 GMT https://community.cisco.com/t5/network-security/fwsm-acl-partition-x-np-blocks-increment/m-p/1669014#M536203 Nicolas Fournier 2011-07-14T21:09:04Z