Deployment Guide

• Whether the maximum number of groups in the system has exceeded
• Whether the maximum number of VLAN numbers permitted per ACL group has exceeded
• When a VLAN member that is being added is already a part of another ACL group
After these verication steps are performed, the ACL manager considers the command as valid and sends the information to the ACL
agent on the line card. The ACL manager noties the ACL agent in the following cases:
• A VLAN member is added or removed from a group, and previously associated VLANs exist in the group.
• The egress ACL is applied or removed from the group and the group contains VLAN members. VLAN members are added or deleted
from a VLAN, which itself is a group member.
• A line card returns to the active state after going down, and this line card contains a VLAN that is a member of an ACL group.
• The ACL VLAN group is deleted and it contains VLAN members.
The ACL manager does not notify the ACL agent in the following cases:
• The ACL VLAN group is created.
• The ACL VLAN group is deleted and it does not contain any VLAN members.
• The ACL is applied or removed from a group, and the ACL group does not contain a VLAN member.
• The description of the ACL group is added or removed.
Guidelines for Conguring ACL VLAN groups
Keep the following points in mind when you congure ACL VLAN groups:
• The interfaces, to which the ACL VLAN group is applied, function as restricted interfaces. The ACL VLAN group name is used to
identify the group of VLANs that is used to perform hierarchical ltering.
• You can add only one ACL to an interface at a time.
• When you attach an ACL VLAN group to the same interface, a validation is performed to determine whether an ACL is applied directly
to an interface. If you previously applied an ACL separately to the interface, an error occurs when you attempt to attach an ACL VLAN
group to the same interface.
• The maximum number of members in an ACL VLAN group is determined by the type of switch and its hardware capabilities. This
scaling limit depends on the number of slices that are allocated for ACL CAM optimization. If one slice is allocated, the maximum
number of VLAN members is 256 for all ACL VLAN groups. If two slices are allocated, the maximum number of VLAN members is 512
for all ACL VLAN groups.
• The maximum number of VLAN groups that you can congure also depends on the hardware specications of the switch. Each VLAN
group is mapped to a unique ID in the hardware. The maximum number of ACL VLAN groups supported is 31. Only a maximum of two
components (iSCSI counters, Open Flow, ACL optimization) can be allocated virtual ow processing slices at a time.
• The maximum number of VLANs that you can congure as a member of ACL VLAN groups is limited to 512 on the switch if two slices
are allocated. If only one virtual ow processing slice is allocated, the maximum number of VLANs that you can congure as a member
of an ACL VLAN group is 256 for the switch.
• Port ACL optimization is applicable only for ACLs that are applied without the VLAN range.
• You cannot view the statistical details of ACL rules per VLAN and per interface if you enable the ACL VLAN group capability. You can
view the counters per ACL only using the show ip accounting access list command.
• Within a port, you can apply Layer 2 ACLs on a VLAN or a set of VLANs. In this case, CAM optimization is not applied.
• To enable optimization of CAM space for Layer 2 or Layer 3 ACLs that are applied to ports, the port number is removed as a qualier for
ACL application on ports, and port bits are used. When you apply the same ACL to a set of ports, the port bitmap is set when the ACL
ow processor (FP) entry is added. When you remove the ACL from a port, the port bitmap is removed.
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)
105