Administrator Guide

• When you attach an ACL VLAN group to the same interface, a validation is performed to determine
whether an ACL is applied directly to an interface. If you previously applied an ACL separately to the
interface, an error occurs when you attempt to attach an ACL VLAN group to the same interface.
• The maximum number of members in an ACL VLAN group is determined by the type of switch and its
hardware capabilities. This scaling limit depends on the number of slices that are allocated for ACL CAM
optimization. If one slice is allocated, the maximum number of VLAN members is 256 for all ACL VLAN
groups. If two slices are allocated, the maximum number of VLAN members is 512 for all ACL VLAN
groups.
• The maximum number of VLAN groups that you can configure also depends on the hardware
specifications of the switch. Each VLAN group is mapped to a unique ID in the hardware. The maximum
number of ACL VLAN groups supported is 31. Only a maximum of two components (iSCSI counters,
Open Flow, ACL optimization) can be allocated virtual flow processing slices at a time.
• The maximum number of VLANs that you can configure as a member of ACL VLAN groups is limited to
512 on the switch if two slices are allocated. If only one virtual flow processing slice is allocated, the
maximum number of VLANs that you can configure as a member of an ACL VLAN group is 256 for the
switch.
• Port ACL optimization is applicable only for ACLs that are applied without the VLAN range.
• You cannot view the statistical details of ACL rules per VLAN and per interface if you enable the ACL
VLAN group capability. You can view the counters per ACL only using the show ip accounting
access list command.
• Within a port, you can apply Layer 2 ACLs on a VLAN or a set of VLANs. In this case, CAM optimization is
not applied.
• To enable optimization of CAM space for Layer 2 or Layer 3 ACLs that are applied to ports, the port
number is removed as a qualifier for ACL application on ports, and port bits are used. When you apply
the same ACL to a set of ports, the port bitmap is set when the ACL flow processor (FP) entry is added.
When you remove the ACL from a port, the port bitmap is removed.
• If you do not attach an ACL to any of the ports, the FP entries are deleted. Similarly, when the same ACL
is applied on a set of ports, only one set of entries is installed in the FP, thereby effectively saving CAM
space. The optimization is enabled only if you specify the optimized option with the ip access-group
command. This option is not valid for VLAN and LAG interfaces.
Configuring ACL VLAN Groups and
Configuring FP Blocks for VLAN
Parameters
This section describes how to optimize the utilization of CAM blocks by configuring ACL VLAN groups that
you can attach to VLAN interfaces and also how to configure FP blocks for different VLAN operations.
Configuring ACL VLAN Groups
You can create an ACL VLAN group and attach the ACL with the VLAN members. The optimization is
applicable only when you create an ACL VLAN group. If you apply an ACL separately on the VLAN interface,
each ACL has a mapping with the VLAN and increases the CAM space utilization. Attaching an ACL individually
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM) 121