Users Guide

-------
Pool ID App(s) Used rows Free rows
Max rows
------------------------------------------------------------------------------------------------
-------
0 USER_IPV4_EGRESS 2 254
256
1 USER_L2_ACL_EGRESS 2 254
256
2 USER_IPV6_EGRESS 2 254
256
3 USER_IPV6_EGRESS 2 254
256
------------------------------------------------------------------------------------------------
-------
Service Pools
------------------------------------------------------------------------------------------------
-------
App Allocated pools App group Configured rules Used rows Free rows
Max rows
------------------------------------------------------------------------------------------------
-------
USER_L2_ACL_EGRESS Shared:1 G1 1 2 254
256
USER_IPV4_EGRESS Shared:1 G0 1 2 254
256
USER_IPV6_EGRESS Shared:2 G2 1 2 254
256
Known behavior
• On the S4200-ON platform, the show acl-table-usage detail command output lists several hardware pools as available
(FREE), but you will see an "ACL CAM table full" warning log when the system creates a new service pool. The system will not be able
to create any new service pools. The existing groups, however, can continue to grow up to the maximum available pool space.
• On the S4200-ON platform, the show acl-table usage detail command output lists all the available hardware pools under
Ingress ACL utilization table and none under the Egress ACL utilization table. The system allocates pool space for Egress ACL table only
when you congure Egress ACLs. You can run the
show acl-table-usage detail command again to view pool space allocated
under Egress ACL utilization table as well.
• On S52xx-ON, Z91xx-ON, Z92xx-ON platforms, the number of Congured Rules listed under Service Pools for each of the features is
the number of ACLs multiplied by the number of ports on which they are applied. This number is cumulative. You can view the Used
rows and Free rows that indicate the actual amount of space that is utilized and available in the hardware.
ACL logging
You can congure ACLs to lter trac, drop or forward packets that match certain conditions. The ACL logging feature allows you to get
additional information about packets that match an access control list entry (ACE) applied on an interface in inbound direction.
OS10 creates a log message that includes additional information about the packet, when a matching packet hits a log-enabled ACL entry.
ACL logging helps to administer and manage trac that traverses your network and is useful for network supervision and maintenance
activities.
High volumes of network trac can result in large volume of logs, which can negatively impact system performance and eciency.
You can specify the threshold after which a log is created and the interval at which the logs must be created.
The threshold denes how often a log message is created after an initial packet match. The default is 10 messages. This value is
congurable and the range is from 1 to 100 messages.
Access Control Lists
1049