Cisco PIX 525 Spécifications télécharger pdf (Page 130)

3-18

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Using TurboACL

Adding Comments to ACLs

PIX Firewall Version 6.3 and higher lets you include comments about entries in any ACL. The remarks

make the ACL easier to understand and scan. A remark can be up to 100 characters and can precede or

follow an access-list command. However, for clarity, comments should be placed consistently within an

access list. There is no run-time performance impact because remarks are stored within an access control

entry (ACE) data structure.

Following is the command syntax to specify a comment:

access-list acl_id remark text

Replace acl_id with the ACL identifier and text with up to 100 characters of text. If more than 100

characters are entered, it is truncated. The starting position of the text is 1 after the remark keyword and

leading spaces are allowed. Trailing spaces are ignored.

To remove a remark, precede the command with no; trailing spaces in the command line do not affect

the matching result.

To allow you to add ACL remarks at the top of an ACL, you can now create an “empty” ACL, containing

remarks without any access control entries. When all remarks are removed from this type of ACL, the

ACL is also removed.

Using TurboACL

This section describes how to use the TurboACL feature introduced with PIX Firewall Version 6.2. It

includes the following topics:

• Overview, page 3-18

• Globally Configuring TurboACL, page 3-19

• Configuring Individual TurboACLs, page 3-19

• Viewing TurboACL Configuration, page 3-20

Overview

An access list typically consists of multiple access list entries, organized internally by PIX Firewall as

a linked list. When a packet is subjected to access list control, the PIX

Firewall searches this linked list

linearly to find a matching element. The matching element is then examined to determine if the packet

is to be transmitted or dropped. With a linear search, the average search time increases proportional to

the size of the list.

TurboACL is a feature introduced with PIX Firewall Version 6.2 that improves the average search time

for access control lists containing a large number of entries. The TurboACL feature causes the

PIX

Firewall to compile tables for ACLs and this improves searching of long ACLs.

You can enable this feature for the entire PIX Firewall and then disable it for specific ACLs, or enable

it only for specific ACLs. For short ACLs, TurboACL does not improve performance. A TurboACL

search, no matter how short the ACL, requires about the same amount of time as a regular ACL search

of from twelve to eighteen entries. For this reason, even when enabled, the TurboACL feature is only

applied to ACLs with nineteen or more entries.

1 2 ... 125 126 127 128 129 130 131 132 133 134 135 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 130

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525