White Papers

When you use the log option, the CP processor logs details about the packets that match. Depending on
how many packets match the log entry and at what rate, the CP may become busy as it has to log these
packets’ details.
If you configure the sequence-number, the sequence-number is used as a tie breaker for rules with
the same order.
NOTE: When you configure ACL logging and byte counters simultaneously, byte counters may display
an incorrect value. Configure packet counters with logging instead.
Related
Commands
● deny — configure a filter to drop packets.
● permit — configure a filter to forward packets.
ACL VLAN Group Commands
Use the commands in this section to configure ACL VLAN groups and CAM optimization for ACLs applied to VLAN groups.
acl-vlan-group
Create an ACL VLAN group.
Syntax
acl-vlan-group group name
To remove an ACL VLAN group, use the no acl-vlan-group group name command.
Parameters
group-name Enter the name of the ACL VLAN group (140 characters maximum).
Default No default behavior or values
Command Modes ACL-VLAN-GROUP CONFIGURATION
Command
History
Version Description
9.5(0.1) Introduced on the Z9500.
9.3(0.0) Introduced on the S4810, S4820T and Z9000.
Usage
Information
You can configure up to eight different ACL VLAN groups at a time on the switch. When you configure an
ACL VLAN group, you enter ACL VLAN Group configuration mode.
To avoid the problem of excessive consumption of CAM area, you can configure ACL VLAN groups that
combines all the VLANs that are applied with the same ACL in a single group. A unique identifier for each
of ACL attached to the VLAN is used as a handle or locator in the CAM area instead of the VLAN id.
This method of processing significantly reduces the number of entries in the CAM area and saves memory
space in CAM.
You can create an ACL VLAN group and attach the ACL with the VLAN members. Optimization is
applicable only when you create an ACL VLAN group. If you apply an ACL separately on the VLAN
interface, each ACL maps with the VLAN and increased CAM space utilization occurs.
Attaching an ACL individually to VLAN interfaces is similar to the behavior of ACL-VLAN mapping storage
in CAM prior to the implementation of the ACL VLAN group functionality.
cam-acl-vlan
Configure the number of flow processor (FP) blocks of CAM allocated to ACL VLAN services on the switch.
Syntax
cam-acl-vlan {default | vlanopenflow <0-2> | vlaniscsi <0-2> | vlanaclopt
<0-2>}
200 Access Control Lists (ACL)