Cisco 7604 Configuration Guide - Page 86

Configuring Resource Management Chapter 4 Configuring Security Contexts This section includes the following topics: • Classes and Class Members Overview, page 4-22 • Configuring a Class, page 4-24 Classes and Class Members Overview The FWSM manages resources by assigning contexts to resource classes. Each context uses the resource limits set by the class. This section includes the following topics: • Resource Limits, page 4-22 • Default Class, page 4-23 • Class Members, page 4-24 Resource Limits When you create a class, the FWSM does not set aside a portion of the resources for each context assigned to the class; rather, the FWSM sets the maximum limit for a context. If you oversubscribe resources, or allow some resources to be unlimited, a few contexts can "use up" those resources, potentially affecting service to other contexts. You can set the limit for all resources together as a percentage of the total available for the device. Also, you can set the limit for individual resources as a percentage or as an absolute value. You can oversubscribe the FWSM by assigning more than 100 percent of the resources across all contexts. For example, you can set the Bronze class to limit connections to 20 percent per context, and then assign 10 contexts to the class for a total of 200 percent. If contexts concurrently use more than the system limit, then each context gets less than the 20 percent you intended. (See Figure 4-5.) Figure 4-5 Max. 20% (199,800) 16% (159,984) 12% (119,988) 8% (79,992) 4% (39,996) Resource Oversubscription Total Number of System Connections = 999,900 Maximum connections allowed. Connections in use. Connections denied because system limit was reached. 104895 1 2 3 4 5 6 7 8 9 10 Contexts in Class The FWSM lets you assign unlimited access to one or more resources in a class, instead of a percentage or absolute number. When a resource is unlimited, contexts can use as much of the resource as the system has available. For example, Context A, B, and C are in the Silver Class, which limits each class member to 1 percent of the system inspections per second, for a total of 3 percent; but the three contexts are currently only using 2 percent combined. Gold Class has unlimited access to inspections. The contexts in the Gold Class can use more than the 97 percent of "unassigned" inspections; they can also use the 1 percent of inspections not currently in use by Context A, B, and C, even if that means that Context A, 4-22 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01