Setup Guide

Test CAM Usage
This command applies to both IPv4 and IPv6 CAM profiles, but is best used when verifying QoS optimization for IPv6 ACLs.
To determine whether sufficient ACL CAM space is available to enable a service-policy, use this command. To verify the actual CAM
space required, create a class map with all the required ACL rules, then execute the test cam-usage command in Privilege mode. The
following example shows the output when executing this command. The status column indicates whether you can enable the policy.
Example of the test cam-usage Command
DellEMC#test cam-usage service-policy input asd stack-unit 1 port-set 0
Stack-unit|Portpipe|CAM Partition|Available CAM|Estimated CAM per Port|Status
--------------------------------------------------------------------------
1| 1| IPv4Flow| 232| 0|Allowed
DellEMC#
Allocating ACL VLAN CAM
CAM optimization for ACL VLAN groups is not enabled by default. You must allocate blocks of ACL VLAN CAM to enable ACL CAM
optimization by using the cam-acl-vlan command.
By default, 0 blocks of CAM are allocated for VLAN services in the VLAN Content Aware Processor (VCAP), an application that modifies
VLAN settings before forwarding packets on member interfaces. The cam-acl-vlan {vlanaclopt | vlanopenflow} command
allows you to allocate filter processor (FP) blocks of memory for ACL VLAN services: Open Flow and ACL VLAN optimization.
You can configure CAM allocation for only two of these VLAN services at a time. You can allocate from 0 to 2 FP blocks for each VLAN
service.
To allocate the number of FP blocks for ACL VLAN optimization, enter the cam-acl-vlan vlanaclopt <0-2> command. After you
configure ACL VLAN CAM, reboot the switch to enable CAM allocation for ACL VLAN optimization.
To display the number of FP blocks currently allocated to different ACL VLAN services, enter the show cam-acl-vlan command.
To display the amount of CAM space currently used and available for Layer 2 and Layer 3 ACLs on the switch, enter the show cam-
usage command.
Implementing ACLs on Dell EMC Networking OS
You can assign one IP ACL per interface. If you do not assign an IP ACL to an interface, it is not used by the software.
The number of entries allowed per ACL is hardware-dependent.
If counters are enabled on ACL rules that are already configured, those counters are reset when a new rule which is inserted or prepended
or appended requires a hardware shift in the flow table. Resetting the counters to 0 is transient as the proginal counter values are retained
after a few seconds. If there is no need to shift the flow in the hardware, the counters are not affected. This is applicable to the following
features:
• L2 Ingress Access list
• L2 Egress Access list
In the Dell EMC Networking OS versions prior to 9.13(0.0), the system does not install any of your ACL rules if the available CAM space is
lesser than what is required for your set of ACL rules. Effective with the Dell EMC Networking OS version 9.13(0.0), the system installs
your ACL rules until all the allocated CAM memory is used. If there is no implicit permit in your rule, the Dell EMC Networking OS ensures
that an implicit deny is installed at the end of your rule. This behavior is applicable for IPv4 and IPv6 ingress and egress ACLs.
NOTE:
System access lists (system-flow entries) are pre-programmed in the system for lifting the control-plane
packets destined for the local device which the CPU needs to process. The system access lists always override the user
configured access lists. Even if you configure ACL to block certain hosts, control plane protocols such as, ARP, BGP,
LACP, VLT, VRRP and so on, associated with such hosts cannot be blocked.
Assigning ACLs to VLANs
When you apply an ACL to a VLAN using single port-pipe, a copy of the ACL entries gets installed in the ACL CAM on the port-pipe. The
entry looks for the incoming VLAN in the packet. When you apply an ACL on individual ports of a VLAN, separate copies of the ACL
entries are installed for each port belonging to a port-pipe.
98
Access Control Lists (ACLs)