|
A policy can potentially become oversized when modifying a variety of objects. It can cause the policy to malfunction when it is oversized.
Hence, the following command can be used to check whether a firewall policy is oversized:
diagnose firewall iprope show 00100004 X
Note:
Replace 'X' with policy ID. The ID can be checked from the GUI. For more information: Technical Tip: How to find policy ID
Here is the sample output from the debug command above:
Tiara-kvm05 # diagnose firewall iprope show 00100004 1
idx:1
pkts:74121908 (40288 125777 43045 79472 83932 155936 206080 1105960)
bytes:66758665762 (28356926 117292649 17679078 35315888 31601911 87534695 156952603 1222883616)
asic_pkts:0 (0 0 0 0 0 0 0 0)
asic_bytes:0 (0 0 0 0 0 0 0 0)
flag:0x0
hit count:1923549 (2272 4897 4933 5480 6769 8998 8738 9523)
first hit:2023-07-25 14:26:06 last hit:2024-12-02 09:35:26
established session count:7
first est:2023-07-25 14:26:06 last est:2024-12-02 09:35:26
From the output above, check 'flag' output:
- 0x0 means it is NOT oversized.
- 0x40 means it is oversized.
|
