When all rules are within the resource limit, the command reports no dropped rules:
inspect network-policy dropped
Network Policy Resource Usage:
Resource Limit : 1350000
Required Resources : 10
Adjusted Resource Use : 10
Non-Optimized Resource Use : 10
No dropped rules found.
When the resource limit is exceeded, the command lists each dropped rule:
Resource values shown in this output are internal resource-cost units used by the policy compiler/optimizer. They do not represent memory, CPU, bandwidth, or percentage utilization.
inspect network-policy dropped
Network Policy Resource Usage:
Resource Limit : 400
Required Resources : 423
Adjusted Resource Use : 400
Non-Optimized Resource Use : 423
Network Policy Rule : 15300304239150020 : newrelic-Policy
Policy Set : 15300304235910157 : MKC-OrigPolicySet1
Stack Index : 0
Application Count : 1
Source Prefix : none
Destination Prefix : none
Resource Count : 1
Network Policy Rule : 15300304237690074 : scps-Policy
Policy Set : 15300304235910157 : MKC-OrigPolicySet1
Stack Index : 0
Application Count : 1
Source Prefix : none
Destination Prefix : none
Resource Count : 1
. . .
Output Fields
- Resource Limit: The maximum number of resources the device can allocate across all network policy rules.
- Required Resources: The total resources the device needs to enforce all configured rules without optimization.
- Adjusted Resource Use: The actual resources the device uses after applying optimization. If this equals the resource limit, the device has dropped rules.
- Non-Optimized Resource Use: The resources the device would need without optimization.
- Network Policy Rule: The numeric ID and name of the dropped rule.
- Policy Set: The ID and name of the policy set the dropped rule belongs to.
- Stack Index: The position of the dropped rule within the policy set stack.
- Application Count: The number of applications the dropped rule matches.
- Source Prefix / Destination Prefix: The traffic match criteria defined in the dropped rule, or none if unconfigured.
- Resource Count: The resource cost of this specific rule.
Troubleshooting
| Condition | Possible Cause | Action |
|---|
| Rules are dropped even though Required Resources appears moderate | The device model has a lower resource limit than the default 1,350,000 | Check the Resource Limit value in the output; consolidate rules with overlapping applications or large prefix lists to reduce cost |
| Adjusted Resource Use equals Resource Limit but only a few rules appear as dropped | Other rules are consuming most of the budget; only the highest-cost ones are listed as dropped | Review Resource Count per rule; identify and consolidate high-cost rules or split large prefix lists into smaller sets |
| Non-Optimized Resource Use is much higher than Adjusted Resource Use | The device is applying optimization to stay within limits but the margin is narrow | Simplify policy rules proactively before the device reaches the point where optimization alone is insufficient |
