Filter
Top Products
Using ACL VLAN Groups
Use an ACL VLAN group to optimize ACL CAM usage by minimizing the number of CAM entries when you
apply an egress IP ACL on the member interfaces of specified VLANs.
When you apply an ACL on individual VLANs, the amount of CAM space required increases greatly
because the ACL rules are saved for each VLAN ID. To avoid excessive use of the CAM space, you can
configure ACL VLAN groups to combine all VLANs on which ACL filtering criteria is applied in a single
class ID instead of multiple VLAN IDs.
NOTE: CAM optimization applies only when you use an ACL VLAN group; it does not apply if you
apply an ACL on individual VLANs.
Guidelines for Configuring ACL VLAN Groups
Keep the following points in mind when you configure ACL VLAN groups:
• The VLAN member interfaces, on which the ACL in an ACL VLAN group is applied, function as
restricted interfaces. The ACL VLAN group name identifies the group of VLANs on which hierarchical
filtering is performed.
• You can add only one ACL to an interface at a time.
• When you apply an ACL VLAN group to a member interface, an error message is displayed if an ACL
with different criteria has already been separately applied to the interface.
• The maximum number of members in an ACL VLAN group is determined by the type of switch and its
hardware capabilities. This scaling limit depends on the number of slices that are allocated for ACL
CAM optimization. If one slice is allocated, the maximum number of VLAN members is 256 for all ACL
VLAN groups. If two slices are allocated, the maximum number of VLAN members is 512 for all ACL
VLAN groups.
• The maximum number of VLAN groups that you can configure also depends on the hardware
specifications of the switch. Each VLAN group is mapped to a unique ID in the hardware. The
maximum number of ACL VLAN groups supported is 31. Only a maximum of two components (iSCSI
counters, Open Flow, ACL optimization) can be allocated virtual flow processing slices at a time.
• Port ACL optimization is applicable only for ACLs that are applied without the VLAN range.
• You cannot view the statistical details of ACL rules per VLAN and per interface if you enable the ACL
VLAN group capability. You can view the counters per ACL only by using the show ip accounting
access list
command.
• On a port, you can apply Layer 2 ACLs on a VLAN or a set of VLANs. In this case, CAM optimization is
not applied.
• To enable optimization of CAM space for Layer 2 or Layer 3 ACLs that are applied to ports, the port
number is removed as a qualifier for ACL application on ports, and port bits are used. When you apply
the same ACL to a set of ports, the port bitmap is set when the ACL flow processor (FP) entry is added.
When you remove the ACL from a port, the port bitmap is removed.
• If you do not attach an ACL to any of the ports, the FP entries are deleted. Similarly, when the same
ACL is applied on a set of ports, only one set of entries is installed in the FP, thereby effectively saving
CAM space. The optimization is enabled only if you specify the optimized option with the ip
access-group command. This option is not valid for VLAN and LAG interfaces.
Access Control Lists (ACLs)
103