Hi,
I imagine that you have ACL configuration that utilizes "object-group" in the configuration. This essentially means that you ACL configuration is shorter than the actual full ACL that the ASA uses.
Take for example these 2 configurations
Example 1
access-list TEST-1 permit ip any any
ASA(config)# sh access-list TEST-1
access-list TEST-1; 1 elements; name hash: 0x5f8608f2
access-list TEST-1 line 1 extended permit ip any any (hitcnt=0) 0xa45bef40
As you can see from the above we only have a single configuration line. As it doesnt have any "object-group" used for either services or IP address/networks it means that it only contains this single rule. So there is only a single "element"
Example 2
object-group network TEST
network-object host 1.1.1.1
network-object host 1.1.1.2
network-object host 1.1.1.3
network-object host 1.1.1.4
access-list TEST-2 permit ip any object-group TEST
ASA(config)# sh access-list TEST-2
access-list TEST-2; 4 elements; name hash: 0xc7ff2230
access-list TEST-2 line 1 extended permit ip any object-group TEST 0xabbab304
access-list TEST-2 line 1 extended permit ip any host 1.1.1.1 (hitcnt=0) 0x8af4a0e1
access-list TEST-2 line 1 extended permit ip any host 1.1.1.2 (hitcnt=0) 0xbd31ccb2
access-list TEST-2 line 1 extended permit ip any host 1.1.1.3 (hitcnt=0) 0x32e99e16
access-list TEST-2 line 1 extended permit ip any host 1.1.1.4 (hitcnt=0) 0xcb4432ae
As you can see from the above example we first create an "object-group" that contains 4 IP addresses and then we use this "object-group" as the destination address of the single ACL configuration line. This means the actual rule is that we permit traffic to all 4 of these destination IP addresses in the configuration and therefore it has 4 "elements"
So you ACL configuration might include large amounts of "object-group" used. You would have to see if all of them are needed. For example if you use "object-group service" type of "object-group" in your configuratins with several ports defined then this will easily generate a lot of extra ACL "elements"
Hope this helps
- Jouni
