Chhabria, Kavita - Apogent wrote:> Greetings everyone:
>  
> In our organization, for our shorewall configuration, we have defined
> numerous zones, such that each zone contains a different subnet.   
> We have not however, used the concept of parent zone and sub-zones.
> That is why, may be, we are having difficulty starting shorewall.  
> We are assuming that the delay in starting shorewall could be due to huge
> numbers of chains being created 
> for the traffic policies between the different zones.
The time required for certain phases of "shorewall start" is O(n * n) 
where n = number of unique host groups. A host group is a 
zone:interface:network tuple.
>  
> Can someone suggest a solution to the above situation?
>  
If using a light-weight shell such as ''ash'' or
''dash'' doesn''t make the
start time acceptable (see FAQ 34), you will have to simplify your 
configuration.
-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net