topic FWSM 4.1(1) and access-list commit. in Network Security

FWSM 4.1(1) and access-list commit.

andrea.meconi — Mon, 11 Mar 2019 19:16:36 GMT

How can I commit access-list more quickly?

When I add an ACE the FWSM takes more times to commit.

Thanks.

Regards.

Andrea

Re: FWSM 4.1(1) and access-list commit.

Kureli Sankar — Tue, 30 Nov 2010 13:12:27 GMT

You do have auto commit right not manual commit? ACL compilation will take a few seconds. How long does it take? What is the ACE count?

sh access-list | i elements

sh resource acl (from the system space)

This command will provide information about the context allocated to the partition and the maximum number of ACE used
in each partition.  

sh np 3 acl count (from the context in question)

You can also read the doc on FWSM acl limit that I published here: https://supportforums.cisco.com/docs/DOC-8786

-KS

Re: FWSM 4.1(1) and access-list commit.

andrea.meconi — Tue, 30 Nov 2010 13:23:56 GMT

Many thanks for your help.

We are using single mode, auto commit and ASDM to change configuration.

ACL compilation takes more than two minutes and is very very tedious.

We need to wait some minutes to make a test of new added ACE!

Result of the command: "sh run | i commit"

The command has been sent to the device

Result of the command: "sh access-list | i elements"

access-list acl_out; 1789 elements

access-list dmz1_access_in; 15 elements

access-list acl_inside; 6517 elements

access-list BrennerCom_access_in; 13522 elements

access-list Laimburg_access_in; 367 elements

access-list Cantieri_access_in; 494 elements

access-list inside_pnat_outbound; 2 elements

access-list Forestali_access_in; 3201 elements

access-list dmz3_access_in; 54 elements

access-list Remedy_access_in; 49 elements

access-list inside_nat_outbound; 21 elements

access-list inside_nat_static_1; 1 elements

access-list inside_nat_static; 1 elements

access-list inside_nat_static_17; 1 elements

access-list inside_nat_static_4; 1 elements

access-list inside_nat_static_6; 1 elements

access-list inside_nat_static_5; 1 elements

access-list inside_nat_static_2; 1 elements

access-list inside_nat_static_3; 1 elements

access-list inside_nat_static_9; 1 elements

access-list inside_nat_static_7; 1 elements

access-list inside_nat_static_8; 1 elements

access-list inside_nat_static_11; 1 elements

access-list inside_nat_static_10; 1 elements

access-list inside_nat_static_12; 1 elements

access-list inside_nat_static_13; 1 elements

access-list inside_nat_static_14; 1 elements

access-list inside_nat_static_15; 1 elements

access-list inside_nat_static_29; 2 elements

access-list inside_nat_static_16; 1 elements

access-list inside_nat_static_19; 1 elements

access-list inside_nat_static_20; 1 elements

access-list inside_nat_static_18; 1 elements

access-list inside_nat_static_21; 1 elements

access-list inside_nat_static_22; 2 elements

access-list inside_nat_static_24; 5 elements

access-list inside_nat_static_25; 1 elements

access-list dmz3-vpn_nat_static; 2 elements

access-list dmz3-vpn_nat_static_1; 4 elements

access-list inside_nat_static_26; 5 elements

access-list inside_nat_static_27; 2 elements

access-list inside_nat_static_28; 1 elements

access-list marco1; 4 elements

access-list Bacini_access_in; 14 elements

access-list inside_nat_static_23; 1 elements

Regards.

Andrea

Re: FWSM 4.1(1) and access-list commit.

Kureli Sankar — Tue, 30 Nov 2010 13:43:15 GMT

Could you pls. try to add a dummy ace to an existing acl via CLI and tell me how long it takes to compile?

example.

conf t

access-list BrennerCom_access_in line 1 per icmp any any

You can remove it later.

-KS

Re: FWSM 4.1(1) and access-list commit.

andrea.meconi — Tue, 30 Nov 2010 14:28:25 GMT

Done.

FWSM takes one minute and 40 seconds to compile it.

Thanks.

Andrea

Re: FWSM 4.1(1) and access-list commit.

Panos Kampanakis — Tue, 30 Nov 2010 17:01:32 GMT

To add to Kureli's suggestions, you have about 10K rules. Unfortunately in order to test a new rule, all of them need to be recompiled. And with 10K rules it will take some time to recompile (1-2mins is normal). Note if you have ACL optimization enabled that will take a more time. You will not be losing traffic during that time, though, you really need to wait for the ACL to be complied to take effect and test them.

I hope it clarifies it a little.

Re: FWSM 4.1(1) and access-list commit.

andrea.meconi — Wed, 01 Dec 2010 08:05:44 GMT

Many thanks for your answer.

Regards.

Andrea

Re: FWSM 4.1(1) and access-list commit.

Panos Kampanakis — Wed, 01 Dec 2010 14:28:10 GMT

Please mark this as answered if it is, so others can benefit in the future.

Take care,

Re: FWSM 4.1(1) and access-list commit.

andrea.meconi — Wed, 01 Dec 2010 14:33:23 GMT

Marked.

Regards.

Andrea

FWSM 4.1(1) and access-list commit.

malqazzaz — Wed, 03 Aug 2011 20:06:57 GMT

Hi all I'm having the same issue I have a FWSM running 3.1(1) when I add any ACL it took the FWSM about 7 minutes to apply it during that time the CPU hits 95%

-------------- CLS Rule Current Counts --------------

CLS Filter Rule Count : 0

CLS Fixup Rule Count : 105

CLS Est Ctl Rule Count : 0

CLS AAA Rule Count : 0

CLS Est Data Rule Count : 0

CLS Console Rule Count : 18

CLS Policy NAT Rule Count : 0

CLS ACL Rule Count : 70566

CLS ACL Uncommitted Add : 0

CLS ACL Uncommitted Del : 0

---------------- CLS Rule MAX Counts ----------------

CLS Filter MAX : 2764

CLS Fixup MAX : 4147

CLS Est Ctl Rule MAX : 460

CLS Est Data Rule MAX : 460

CLS AAA Rule MAX : 6451

CLS Console Rule MAX : 1843

CLS Policy NAT Rule MAX : 1843

CLS ACL Rule MAX : 74188

Help Please

Thanks,