Access control rule expansion

A single access control rule can expand into many Access Control Entries (ACEs) on a device. Expansion increases when a rule contains nested source networks, destination networks, source ports, destination ports, virtual LAN tags, source security zones, destination security zones, inline values, objects, and object groups.

Object Group Search, Interface Object Optimization, and Object Group Optimization affect the memory calculation.

  • Object Group Search groups network objects efficiently and changes the memory model used for validation. When Object Group Search is enabled, Firewall Management Center skips descriptor-limit validation for the Object Group Search path.

  • Interface Object Optimization controls whether Cloud-Delivered Firewall Management Center keeps zones grouped or expands zones into individual interfaces for access control list combinations. When Interface Object Optimization is disabled, source and destination security-zone interface combinations can multiply the access control list footprint.

  • Object Group Optimization merges overlapping inline networks into fewer network entries when possible. When Object Group Optimization is disabled, Firewall Management Center counts inline literals and ranges directly. This approach can increase the projected footprint.

Rule expansion and memory calculation inputs

This table describes the factors considered for memory calculation and how they affect rule expansion.

Input

How it affects expansion

Where administrators review it
Virtual LAN tags Virtual LAN tag combinations contribute to rule expansion. Access control rule conditions
Networks and ports Large inline lists, objects, object groups, and nested groups can multiply Access Control Entry counts. Access control rule conditions
Security zones Zone-to-interface expansion can increase access control list combinations when Interface Object Optimization is disabled. Access control rule conditions and device settings
Object Group Optimization Optimization can reduce overlapping inline network entries. Administration > Configuration > Access Control Preferences > >
Object Group Search When enabled, Object Group Search affects memory modeling and bypasses descriptor-limit validation. Device settings
Device capacity data Live memory and object counts determine deployment warning or block decisions. Device command outputs collected during deployment validation

Access control rule capacity validation

You can enable access control rule capacity validation to detect policies that expand into high Access Control Entry (ACE) counts before deployment. Firewall Management Center calculates expansion when you open or edit an access control policy. It shows policy-level and rule-level warnings, and provides a High expansion rules filter.

Cloud-Delivered Firewall Management Center warns when available memory approaches the configured limit. It blocks deployment if the projected policy can exceed safe memory or descriptor limits. A new "Heavy Rule" filter allows you to identify and optimize the high memory consumption rules.

Policy-level and rule-level warnings

Cloud-Delivered Firewall Management Center shows a policy-level warning when a managed device reaches its policy expansion threshold or is projected to be at a risk of warning or blocking. From the warning message, you can select the impacted device and view the high expansion rules that contribute to the risk.

Cloud-Delivered Firewall Management Center also displays rule-level warnings during rule creation or editing when a rule exceeds expansion limits for the selected policy or device scope. Rule-level warnings help administrators identify the rule conditions to optimize before deployment. These conditions include networks, ports, virtual LAN tags, security zones, inline values, objects, and nested object groups.

Deployment validation

When you deploy an access control policy, Cloud-Delivered Firewall Management Center first recomputes policy impact using live device data, enabled access control rules, and enabled prefilter rules associated with the access control policy. The validation results in an allow, warning, or block decision based on several conditions.

  • Cloud-Delivered Firewall Management Center checks the memory utilization—available memory is below 5 percent, required memory exceeds available memory, projected post-deployment utilization reaches 95 percent, or descriptor limits are exceeded on the non-Object Group Search path.

  • For devices that do not support the required device commands, are offline, or are unreachable, Cloud-Delivered Firewall Management Center skips deployment validation for that device.

  • Policy-level warnings, rule-level warnings, and high expansion rule filtering continue to use predicted ACE counts and cached device metadata.

Pre-deployment validations run when the access control policy has changed and is not synchronized to the managed device. This table provides methods and results of access control policy validation performed before deployment.

Outcome

Condition
BLOCK Required memory exceeds free memory on the device.
BLOCK Projected utilization of memory ((Used + Required) / Total) crosses the 95 percent ceiling.
BLOCK Object or descriptor limit is exceeded. (Object Group Search disabled only)
WARN Available memory on the device is between 5 percent and 20 percent, and no block condition is present
SKIP

Capacity data is unavailable or the command-line interface is unsupported.

No block and no warning. Deployment proceeds.