topic Re: Maximum ACL rules in Network Security

Maximum ACL rules

innetsecwork — Mon, 11 Mar 2019 13:54:46 GMT

Hello,

Is anybody aware of the maxinum number of access list rules an ASA can take.

Thanks

Re: Maximum ACL rules

Syed Iftekhar Ahmed — Wed, 08 Oct 2008 17:28:37 GMT

There is no maximum number of ACL entries which we can accommodate in ASA. It depends upon the DRAM size.

Syed Iftekhar Ahmed

Re: Maximum ACL rules

Matthew Warrick — Wed, 08 Oct 2008 19:08:30 GMT

As your number of rules increases, the CPU load will increase as well. While there is no hard and fast limit I have had experience with a PIX 535 becoming CPU bound due to the size of the ACLs applied coupled with the complicated NAT rules and hundreds of static routes. In this case, the firewall would occasionally hit max CPU usage during peak traffic periods and start discarding packets.

Deleting ACL entries and cleaning up the config solved the issue in that situation.

Re: Maximum ACL rules

ajagadee — Wed, 08 Oct 2008 19:46:01 GMT

Hi,

It is my understanding that the ASA uses around 20KB for an Access List Entry (ACE). So, the number of ACE really depends on the memory on the chassis and other features that are you planning to enable.

Below is the data sheet for the ASA that has information on various ASA platforms and memory.

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_data_sheet0900aecd802930c5.html

Regards,

Arul

** Please rate all helpful posts **

Re: Maximum ACL rules

Fernando_Meza — Wed, 08 Oct 2008 21:35:31 GMT

adding to what has been said. I have found that many customers don't use object groups which can reduce the size of the ACLs substantially. The best approach is to create object groups, remove ACL with not hits, place the entries that are hited the most on the top of the ACL .. just my 20 cents 😉

Maximum ACL rules

Mokeev.tel — Sun, 02 Jun 2013 06:15:32 GMT

Hi, can you give me link for docs about ACLs processing?

It's interesting about object groups. Is there any processing docs and compare?

Maximum ACL rules

Julio Carvajal — Sun, 02 Jun 2013 07:26:11 GMT

Hello Sergey,

I have read somewhere that each element or ACL entry requires about 40-56 bytes but there is no limit specific as there is in the FWSM where is normal to get warnings if you have a huge amount on ACLs.

I would not consider normal or common on an ASA to have a problem regarding CPU/Memory due to ACL's. I have not seen it before

Hope that I could help

Maximum ACL rules

Mokeev.tel — Sun, 02 Jun 2013 07:40:15 GMT

Hi, Julio!

I'm glad to see you.

Does ASA do some optinization of ACLs?

I mean, will be there any difference if ACL lines with heavy traffic will be at lines from 1 to 10 or they will be at lines from 500 to 509?

Maximum ACL rules

Julio Carvajal — Mon, 03 Jun 2013 16:19:10 GMT

Hello,

The optimization would be use object groups when possible so you can reduce the amount of ACL lines,

Remember to rate all of the helpful posts, that is as important as a thanks

Regards