Rest-API rate limit

[Gupta_Deva]

How to disable the rate-limit alltogether - or at lest configure a higher value than 120 api-calls / minute ?

According to the cocumentation:

The Firepower Management Center REST API implements rate limiting to reduce network load.

The API will accept no more than 120 messages per minute from an individual IP address. It will only allow 10 simultaneous connections per IP address. These are not configurable parameters.

If a client exceeds these limits, the API will give an HTTP 429 error

We don't buy, that this is not configurable - and we really need to be able to configure some higher values !

Maybe we might set a parameter or variable in one of the files

/etc/sf/mojo_server.conf

/var/sf/bin/mojo_server_wrapper.pl

/var/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm

or maybe an API-guru here could provide an illiminative answer ?

[Patrick.Helms]

Have you ever found a solution to this issue? We are finding it takes a very long time to query an ACL with 100 rules (and their objects) with this limit. 

[niryadav]

There is an Enhancement defect filed for the rate limiting.

CSCvf16740  -  ENH: Rest API Request limit should be set to a configurable option.

As a workaround use the expanded query param to query details in a single call. This will reduce the number of API calls required, and the probability of customer hitting the rate limit will go down.

[tomas.chyla02@gmail.com]

Although this is quite old topic, the mentioned enhancement CSCvf16740 has still not been implemented and doesn't provide any possible workaround outside of what was already mentioned by @niryadav. This however doesn't cover all the possible use cases and the rate limit can still be easily hit regardless (for example, see CSCwq66022).

There is a newer bug ID from 2023 CSCwi14132 which does provide a workaround action of Contact TAC to increase API rate limit. While I cannot share more specifics on what's the exact procedure to override the rate limits as there are certain caveats/gotchas you need to be aware of, I can confirm the workaround does work (for both limits - requests per minute as well as concurrency).

[tomas.chyla02@gmail.com]

Also forgot to mention that since FMC versions 7.6.0, the requests per minute limit has been increased from the previous 120 to 300.

https://www.cisco.com/c/en/us/td/docs/security/firepower/760/api/REST/secure_firewall_management_center_rest_api_quick_start_guide_760/Objects_In_The_REST_API.html#reference_xs5_ymy_1cb:~:text=Error/Warning/Info-,Rate%20Limiting,-The%20management%20c...