Maximum rules limit on 5500-X platforms

[ymadheka]

Hi Team,

We are in the process of migration from checkpoint to ASA with firepower services wherein the customer has more than one lakh rules that needs to be migrated to Cisco platform. Is there any documentation for referring the maximum rules count supported on our platform?

Thanks & Regards,

Yogesh Madhekar

[Oliver Kaiser]

The maximum number of rules depends on the platforms memory capacity. A single access-control-entry occupies about 172 bytes of memory. Depending on the platform you will choose you should reach out to Cisco to verify that your amount of ACEs will work out. In case you have a large ruleset (> 250000 ACEs using a platform like 5525-X) you shouldnt have any issues but the number of NAT/IPSec VPNs should also be considered to size correctly.

There is no official document that I am aware of that lists maximum rules for ASA.

[ymadheka]

Hi There,

Thanks for the reply.

We are having major challenges in getting the configuration migrated from checkpoint (1780 odd ACLs with 0.2 million lines of rules), After configuring the access-group command, it has prompted as insufficient memory to install the rule and memory utilization has reached to 99%.

Is there any optimizing tool avaliable for the migration to give lesser performance issue since the ASA 5545-X is now going to put in production segment very soon.

Thanks & Regards,

Yogesh Madhekar

[Oliver Kaiser]

I was able to find more information on ACL recommended maximums in a cisco live session titled "Maximizing Firewall Performance". (2015)

Based on your platform you should be able to handle 200.000 ACEs. To verify your current number of ACE please execute the following command and post the output:

ASA# show access-list | include elements

Depending on your output (count < 200k) please execute the following commands and post the output

ASA# show version
ASA# show memory
ASA# show memory detail
ASA# show memory app-cache
ASA# show resource usage
ASA# show resource usage detail
ASA# show traffic
ASA# show blocks
ASA# show cpu core
ASA# show cpu detail

[ymadheka]

Will arrange the same and post here once data is available.

Thanks & Regards,

Yogesh Madhekar