topic Re: Check Point ACL Limits in Firewall and Security Management

Check Point ACL Limits

perkt11 — Tue, 30 Aug 2022 10:48:40 GMT

Good morning,

Cisco ASAs have limits on ACL/ACE entries. I cannot find any literature that suggest such limits on Check Point Firewalls.

I am particularly interested in the 6000 and 7000 family lines.

Does anyone know if Check Point FWs have ACL/ACE entries?

Thanks!

Tom

Re: Check Point ACL Limits

_Val_ — Tue, 30 Aug 2022 12:39:07 GMT

Check Point FWs do not have a notion of ACL. We operate with policy rules and objects.

Although there is an impact of the number of rules and objects in use to the GW performance, there is no hard limit for either.

To moderate the situation, you can use various tech solutions and procedures, look into sk98348 for more details.

Re: Check Point ACL Limits

perkt11 — Tue, 30 Aug 2022 12:47:18 GMT

Thanks Val!

Re: Check Point ACL Limits

_Val_ — Tue, 30 Aug 2022 12:56:37 GMT

No problem. Let me know if you need any further assistance.

Re: Check Point ACL Limits

the_rock — Tue, 30 Aug 2022 13:52:26 GMT

Put it this way...yes, @_Val_ is correct, there is no "official" limit, BUT...I can tell you from my experience, any environment I had seen with more than say 1000 rules, it will take a bit of time to push policy. Yes, with R81, there is accelerate policy push so that helps for sure. I recall in old days of CP, I always use to hear number of 10000 rules as a limit, but again, it was never officially stated anywhere.

Re: Check Point ACL Limits

perkt11 — Tue, 30 Aug 2022 14:09:35 GMT

Thanks Rock for the follow up.

Re: Check Point ACL Limits

the_rock — Tue, 30 Aug 2022 14:28:46 GMT

No problem at all!