Cisco ASA 5545 x mem at 93%

[Steve Coady]

All

I have an ASA HA pair where the primaryt shows 93% mem used. The secondary is at 64%.

The reason for the difference was a unique vpn that was created only on the primary. Due to there was only 1 uplink to the ISP switch. This vpn does have a redundant link through a different ASA. This redundant vpn was already in place. 

I have read that memory is used up by acl's, conn table and Xlate table. ACL's expand to show each line when using show access-list.

Will the following command provide any relief? What are Pro's/con's?

object-group-search access-control

[Bogdan Nita]

pro: less memory used by acls

con: acl rule lookup slower

You can reduce the memory required to search access rules by enabling object group search, but this is at the expense rule lookup performance. When enabled, object group search does not expand network objects, but instead searches access rules for matches based on those group definitions. You can set this option using the object-group-search access-control command.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/access-rules.html

HTH

Bogdan

[Steve Coady]

Hello

I am not sure I understand the impact of "at the expense rule lookup performance".

I have checked forum and internet. It almost seems like using the command, object-group-search access-control, is a bad idea.