topic Re: ACL optimization in Network Security

ACL optimization

ahmedraees — Mon, 11 Mar 2019 17:22:55 GMT

I have 14000 ACEs under one ACL. Actually I want to block whole of the world except North America and Mexico. Any idea how to optimize this list . Any tool

Re: ACL optimization

Federico Coto Fajardo — Wed, 17 Mar 2010 16:21:15 GMT

Hi,

If you just want to permit some ranges and deny everything else, the recommendation is to specify what you want to permit and by default everything else will be denied.

If this is an ASA, you can use Object-Groups to group networks and in this way reduce dramatically the list.

Federico.

Re: ACL optimization

KARUPPUCHAMY MALAIYANDI — Wed, 17 Mar 2010 16:27:23 GMT

Hi,

If you are using FWSM then you can use ACL optimization future. It will analyse and will give the report of zero hit count ACLs.

You can remove those ACLs.

Else, you have to enable logging and you have to find the zero hit-count and remove those zero hit count ACLs

Regards

Karuppu