Symptoms

Overlapping checks for firewall rules take several minutes if a rule with 'any' is inserted in the middle of the rule list

Impact

If this happens, the firewall rule compilation process will appeared to hang. However the compilation will not generate any error message and will eventually finish successfully after several minutes.

Conditions

This happens if there are lower priority firewall rules that are covered (redundant or conflicted) by the rule just inserted. All the rules after the newly inserted rules need to be checked for the overlapping conditions so it take longer to do.

Workaround

You can disable the overlapping check by setting the db variable pccd.overlap.check value to "disable". The default is "enable". If the overlapping check is disabled, no checks will be done and no redundant or conflicted status will be reported.

Fix Information

Fixed the issue that overlapping checks for firewall rules may take several minutes if a rule with 'any' is inserted in the middle of the rule list.

Behavior Change