ACL Limits on Firepower Threat Defense

Ever wondered how many access-list items are supported on Firepower Threat Defense? Just like ASA, Firepower Threat Defense uses the same concept of ACEs (Access-Control Entries) for its stateful inspection firewall engine (LINA). Each access control entry consists of a 5-tuple (Source IP, Destination IP, Source Port, Destination Port and Protocol), with each entry using a minimum of 212 bytes of memory.

Why should I care?

212 bytes of memory sounds like a drop in a pond, but think of it like this. For each source/destination ip address and each source/destination ports within a rule the number of access-control entries are being multiplied. Take the following example:

By multiplying the number of entries in each fields we get the number of ACEs that will be generated:
1 (Source IP) x 1 (Source Port) x 1 (Destination IP) x 1 (Destination Port) x 1 (Protocol) = 1

Let’s take a more realistic rule that can be found on a lot of firewalls – permitting Active Directory access from different network segments to a variety of domain controllers

By doing the same simple math yet again we multiply all our entries and end up with quite a lot of ACEs
7 (Source IP) x 7 (Destination IP) x 7 (Destination Port) x 1 (Protocol) = 343

Now you might understand why the maximum number of recommended access-control entries can be quite important when sizing a Firepower Threat Defense deployment… or atleast it was a lot more important before Firepower 6.6.0 was released.

Object-Group Search to the Rescue

Since the expansion of rules can cause a lot of AC entries to be created, a new feature was introduced to solve (or move?) the problem of high memory usage to the Firewalls CPU. Using the OGS feature object-groups will not be expanded upon configuration deployments, but be resolved using a lookup procedure at runtime. This way the amount of memory required to load AC entries can be decreased while the burden is pushed on the CPU to resolve the objects referenced in your accesspolicy.

OGS is disabled by default and in case FMCs Health Monitoring does not indicate any memory shortages on the Firewall side I would recommend leaving it turned off. However if you are ever get into a situation where your ruleset is too large for the underlying hardware you can just enable OGS in Device settings (just make sure your CPU is not at its limit as well):

Recommended Limits by Hardware

Do you want to know how many ACEs your configuration currently consists of? Just SSH to your FTD device and execute the following handy command:

show access-list | include elements