How to manage large access-lists on FWSM

Team I have a rather large access-list in one of my firewalls and was wondering if anyone has any rules of thumbs to go by when building a complex access lists. I currently use object groups but what is a good rule for acls with servers, users and diffent needs for access?

We use object-groups as well. We typically create an object for source servers (if more than 1), the ports (if more than 1 or 2) and another group for destination server(s). We have a very restrictive security policy so each rule must be specific. I think it makes it hard to see what the ACL's really do, but it shortens the config.
Hope that helps.

Similar Messages

  • Can CS-MARS perform mitigation access-list on FWSM?

    Hi guys!
    I have couple questions:
    1)Can CS-MARS perform mitigation access-list on FWSM?
    2)How I can estimate how many events and netflows in one second recieve my MARS box.
    Thanks

    Don't do mitigation and don't have FWSM, so I can't answer your first question. Regarding the second...There are a couple ways, neither is perfect but give you a good approximation.
    a) Use the "Events and NetFlow" graph on the summary page. Divide the peak "avg/min" values by 60.
    b) collect the logs using the pnlog command in the CLI. in the janus-logs.tar.gz you will find a janus_log file. This is the same data shown in Admin->System Maintenance->View Log Files...except now you can search through it better. Use a tool like grep to pull out and sort the message rates. the last entry is your peak.
    > grep "PN-2016" janus_log | cut -d" " -f7 | sort -n

  • How to create a Access list on core switch to bloxk all Internet Traffic & allow some specific Internet Traffic

    Hellp Everyone,
    I am trying to create a Access-List on my Core Switch, in which I want to allow few internet website & block the rest of them.
    I want to allow the whole Intranet but few intranet websites also needs access to the internet.
    Can we create such Access-List with the above requirement.
    I tried to create the ACL on the switch but it blocks the whole internet access.
    i want to do it for a subnet not for a specific IP.
    Can someone help me in creating such access list.
    Thanks in Advance

    The exact syntax depends on your subnets and how they connect to the Internet. If you can share a simple diagram that would be much more informative.
    In general just remember that access-lists are parsed from the top down and as soon as a match is found, the processing stops. So you put the most specific rules at the top. also, once you add an access-list, there is an implicit "deny any any" at the end.
    The best approach is to create some network object-groups and then refer to them in your access list. From your description, that would be something like three object-groups - one for the Intranet (Intranet), one for the allowed servers that can use Internet (allowed_servers), and a third for the permitted Internet sites (allowed_sites).
    You would then use them as follows:
    ip access-list extended main_acl
    permit any object-group intranet any
    permit object-group allowed_servers object-group allowed_sites any
    interface vlan
    ip access-group main_acl in
    More details on the syntax and examples can be found here:
    http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/15-2mt/sec-object-group-acl.html#GUID-BE5C124C-CCE0-423A-B147-96C33FA18C66

  • How to manage large database records in enterprise application

    Hi All,
    I am working on a large enterprise application relating to Capital Market. I am working in Java and with its extended technology. I am facing one critical problem which needs solution from your side. I have a database table which contains approximately more than 5 millions of records, I want to display the records with proper pagination. Here I am using Hibernate for database related stuffs. I am using a query which contains a join query to load the records. After the query the filtered records come to approcimately 80,000. I am unable to make proper pagination, everytime for next or previous set of 10 records I hit the database which is a time consuming affair. I do not know what I will do , should I cache the data for pagination. Everytime I load more than 80,000 records, think that in an web based application, the no of users are 5000, then how to manage. I need core java level solution not in the JSP level. Please help me in this regard.

    After the query the filtered records come to approcimately 80,000. I am unable to
    make proper pagination,Just a thought. If you display 50 per page, that's 1600 pages. Say it takes the user
    15 seconds to read the page: total 400min=6 2/3 hours and probably a bad case of RSI.
    The proper pagination would possibly be no pagination.

  • How to manage large partitioned table

    Dear all,
    we have a large partitioned table with 126 columns and 380G not indexed can any one tell me how to manage it because now the queries are taking more that 5 days
    looking forward for your reply
    thank you

    Hi,
    You can store partitioned tables in separate tablespaces. This does the following:
    Reduce the possibility of data corruption in multiple partitions
    Back up and recover each partition independently
    Control the mapping of partitions to disk drives (important for balancing I/O load)
    Improve manageability, availability, and performance
    Remeber as the doc states :
    The maximum number of partitions or subpartitions that a table may have is 1024K-1.
    Lastly you can use SQL*Loader and the import and export utilities to load or unload data stored in partitioned tables. These utilities are all partition and subpartition aware.
    Document Reference:
    http://download-east.oracle.com/docs/cd/B19306_01/server.102/b14231/partiti.htm
    Adith

  • How to manage large pages

    Just wondering... What is a good way to manage large pages?
    Let's say a page with a pannelTabbed with 7 or 8 tabs. Each tab shows a table that is bound to a different VO. Most of the tabs also have a add,delete,edit button and i'm using popups for that.
    So as you can see, their will be lots of bindings and lots of components on such a page.
    If i create all this on a single page i think it will be a few thousands of lines which is not realy nice...
    Should i create page fragments or create taskflows per tab or something like that?
    Currently i have created the page with just the panelTabbed and then for each tab i created a taskflow and dropped that inside the showDetailItem. For each popup, i also created a taskflow so i could reuse it later when i need the same popup in other pages.
    I'm wondering... what is a correct approach for such large pages. Are their any guidlines for this?

    Hi,
    we decided to use dynamic regions (11g) for our application.
    This means we only have 1 jspx for the whole application and exchange the content at runtime.
    For each "block" (e.g. a table, a tab or a popup) we have a single page fragment and task flow.
    One page fragment consists normaly only of one view object.
    With this concept we can reuse e.g. the same (similar) table on different pages too.
    Hope this helps.
    regards
    Peter

  • How to manage big custom list in SharePoint 2010

    Hi All experts,
    I am working on Time Attendance Management System, where I have to generate a weekly schedule at once for each employee every year.
    Custom List columns are
    Employee Number
    Employee Name
    From Date(Mon)
    To Date(Sun)
    Total numbers of employees are: 2800
    Eg: In January 2015(5 weeks): 5 * 2800 = 14000 items
    Likewise total, if I generate one year schedule which contains 53 weeks (53* 2800 = 148400 items/year)
    How to overcome with the below problems
    List threshold limit which is 5000
    Efficiency of list
    How can I manage such a big list? Can someone please suggest me here?
    MercuryMan

    Hi MercuryMan,
    Possible ideas regarding you problems are:-
    1. Increase size list and take timely back up delete list item from source list ( but problem of maintenance every now and then, not completely feasible.)
    2. Better to store all the entries in the database (ex: SQL) and so in this way you won't have to worry about growing list item numbers. But for this, you need database access to save and retrieve.
    Thanks,
    Vivek
    Please vote or mark your question answered, if my reply helps you

  • How to manage my contact list

    I did share my Itunes account with my daugther and had mix all our contacts, I already create a new Itunes account, how can I manage the contacts in order to expoprt only my contacts and let her with only her contacts?

    All devices signed into the same iCloud account will finish up with the same contacts. Of course if prior to joining iCloud two family members each had an entry for Uncle Fred, then you will finish up with two contact cards for Uncle Fred, and so on. If you tidy this up on your computer then the changes will propagate to everyone else.

  • How to manage large Remote Sensing image in oracle

    I want to manage many Remote Sensing images in Oracle database. Which model is more reasonable? Please all my friends give me your suggestions.

    This MyApp application (Application 100) was created by the HR Oracle account.
    I could use
    http://127.0.0.1:8080/htmldb/f?p=100
    to run this application by logging in as hr/hr .
    For the above URL, if I logged in as anotherOracleAccount/password, I got the 'Invalid Login Credentials' message.
    As you said, I could use
    http://127.0.0.1:8080/htmldb/f?p=4550
    to get into HTML DB of the Oracle XE environment by logging in as anotherOracleAccount/password.
    Since MyApp is using the HR-owned 'employees' table, should we grant some privileges on hr.employees to anotherOracleAccount?
    I tried this, I still got the 'Invalid Login Credentials' message.

  • How to manage large external images.

    Good day to all,
    I'm creating a movie object using images. I'm using PNG file
    types with an alpha channel. Each frame is approx 640 x 480, each
    single pitch image is 36 frames creating an image 23040 x 480. If
    it's a multidimensional image it is 23040 x 11520. I load the image
    in using "img_name".loadMovie("imageFileName", 1);
    The problem is it only seems to load around 2880 pix of the
    image.
    How can I get it to load the whole image?
    or
    How can I choose it to load the next section of the image?
    Cheers

    You can load 36, 640x480 images into one clip, and then move
    that to show
    your frames, but the max size of a single image is 2880 as
    you have found
    out yourself.
    Dave -
    www.offroadfire.com
    Head Developer
    http://www.blurredistinction.com
    Adobe Community Expert
    http://www.adobe.com/communities/experts/

  • Performance: How to manage large reports with high data volume

    Hi everybody,
    we actually make some tests on our BO server system, to define limitations and oppertunities. Among other things we constructed a large report with a high data volume (about 250.000 data records).
    When executing the query in SAP Query Designer it takes about 10 minutes to display it. In Crystal Reports we rebult the row and column structure of the query. The data retrieval in Crystal Reports Designer last about 9 minutes - even faster as in the query.
    Unfortunately in BO InfoView the report is not displayed. After 30 minutes of loading time we get a timeout error RCIRAS0244.
    com.crystaldecisions.sdk.occa.managedreports.ras.internal.ManagedRASException:
    Cannot open report document. ---
    The request timed out because there has been no reply from the server for 600.000 milliseconds.
    Also a refresh of an report with saved data is not possible.
    Now we are asking us some questions:
    1. Where can we set the timeout for InfoView to a value larger than 30 minutes?
    2. Why is InfoView so slow compared to Crystal Designer? Where is the bottleneck?
    3. Whats the impact of SAP single sign-on compared to Enterprise logon on the performance?
    Thanks for any helps and comments!
    Sebastian

    Hi Ingo,
    thank you for your reply.
    I will check the servers and maybe change the time limits.
    Unfortunately we have a quite slow server system that probably cause this timeout. In CR Designer we have no problems, its really quick. Is it to expect that CR Designer and InfoView have almost the same performance?
    Another nice point: When we execute the query in SAP BEx Query Designer it takes about 10 minutes to open it, in Crystal Designer it needs just about 5-6 minutes. We integrated exactly the same fields in the report, which exist in die SAP BEx query.
    What may cause the difference?
    - Exceptions and conditions in the query?
    - Free characteristics in the query?
    - anything else?
    Best regards,
    Sebastian

  • How to Enable Anonymous access to a SharePoint 2013 site e.g for specific site,list etc..

    Hi All,
          I'm working on an extranet and i would like users to be able to fill a form on the site.
    Since i'm going to use sharepoint 2013 how can i configure sharepoint to use both anonymous access and windows authentication at the same time.
    I know for sure it can be done but what can be allowed for anonymous access e.g specific list site etc..
    I would need to make some area available as anonymous e.g a whole site as  i would like to brand it a little to host the form.Any tips of who has configured similar would be appreciated

    Hi Patrick,
    Thanks for posting your query, Kindly follow the below mentioned steps to enable Anonymous access to a SharePoint 2013 site.
    In Central Administration, under Application Management., click Manage web applications.
    Select the web application you want to enable anonymous access for.
    In the Security group on the ribbon, click Authentication Providers.
    In the Authentication Providers dialog box, under Zone, click Default.
    On the Edit Authentication page, select the Enable anonymous access check box.
    Click Save.
    Close the Authentication Providers dialog box.
    Also, browse the below mentioned URLs for more details
    http://blog.cloudshare.com/2012/10/15/how-to-enable-anonymous-access-to-a-sharepoint-2013-site/
    http://www.sharepoint-journey.com/how-to-enable-anonymous-access-in-sharepoint-2013.html
    I hope this is helpful to you, mark it as Helpful.
    If this works, Please mark it as Answered.
    Regards,
    Dharmendra Singh (MCPD-EA | MCTS)
    Blog : http://sharepoint-community.net/profile/DharmendraSingh

  • User Management - How to submit Additional Access Request on behalf of employee

    User Management - how can we configure "Access Requests" so that Managers can submit Additional Access Requests, or Initial Access Requests on behalf of employee?
    Have looked at "Manage Proxies" but this seems to allow access to everything - not ideal
    Please assist with knowledge and/or experience
    Many Thanks
    Me

    Additional Access Request Registration Process is complete
    Giving access to User Management to users is not an option.
    What I would like is the scenario below - is this achievable?
    When employee goes to iProcurement > Preferences > Access Requests > Request Access | they can submit an access request on behalf of themselves.
    Would like an option where a manager, navigates to same UI as above, has option to choose a subordinate, and request additional access on their behalf
    The table UMX_REG_REQUESTS has columns REQUESTED_FOR_USER_ID & REQUESTED_BY_USER_ID - so it seems they don't have to be same person (manager can submit request on behalf of an employee)
    Can this be achieved through UI for "Access Requests"?

  • RDS 2012 R2 - How do I lockdown access to Local Computer Management and Windows Backup via Group Policy

    Greetings all,
    I am needing assistance in how to lockdown access to Local Computer Management and Windows Backup via Group Policy for users that access RDS service. I have followed this awesome guide - h t t p://w w w.it.ltsoy.com/windows/lock-down-remote-desktop-services-server-2012/
      - but it is missing two important resources that I would like to lock down.Currently, I have successfully locked down Control Panel for users via Group Policy, but I cannot find any group policy or guide on how to restrict user access
    to Computer Management (different to Server Manager). When using Win-X shortcut to open the 'Administrator's shortcuts' near the windows icon, I have locked down everything except Computer Management. Computer Management gives direct access to Disk Management,
    Shares etc, which are locked down for users. But Windows Server Backup is still accessible. Can someone please guide me on how to restrict access to both Computer Management and Windows Server Backup.
    Thanks in advance.
    Terry.

    Prevent running of Windows Server Backup
    Computer Configuration\Policies\Windows Settings\Security Settings\File System
    Right click on File System - Add File - Drill down to \System32\wbadmin.msc
    On the Database Security ACL that pops up - Remove Creator Owner, Remove Users and check Adminstrators have Full Access.
    On the Object window - choose Propagate inheritable permissions to all... (Default)

  • My family put multiple devices on the icloud, and I need to know how to manage duplicate entries.  Specifically contacts.  If I fix the contact list on my pc will it push the info out to the other devices and maintain it correctly?

    My family put multiple devices on the icloud, and I need to know how to manage duplicate entries.  Specifically contacts.  If I fix the contact list on my pc will it push the info out to the other devices and maintain it correctly?

    All devices signed into the same iCloud account will finish up with the same contacts. Of course if prior to joining iCloud two family members each had an entry for Uncle Fred, then you will finish up with two contact cards for Uncle Fred, and so on. If you tidy this up on your computer then the changes will propagate to everyone else.

Maybe you are looking for