Reference Guide

To determine whether sufficient ACL CAM space is available to enable a service-policy, use this command. To verify the actual

CAM space required, create a class map with all the required ACL rules, then execute the test cam-usage command in

Privilege mode. The following example shows the output when executing this command. The status column indicates whether

you can enable the policy.

Example of the test cam-usage Command

Dell#test cam-usage service-policy input TestPolicy linecard all

--------------------------------------------------------------------------

2| 1| IPv4Flow| 232| 0|Allowed

2| 1| IPv6Flow| 0| 0|Allowed

4| 0| IPv4Flow| 232| 0|Allowed

4| 0| IPv6Flow| 0| 0|Allowed

Dell#

Implementing ACLs

You can assign one IP ACL per physical or VLAN interface. If you do not assign an IP ACL to an interface, it is not used by the

software in any other capacity.

The number of entries allowed per ACL is hardware-dependent.

If you enable counters on IP ACL rules that are already configured, those counters are reset when a new rule is inserted or

prepended. If a rule is appended, the existing counters are not affected. This is applicable to the following features:

● L2 Ingress Access list

● L2 Egress Access list

● L3 Egress Access list

ACLs and VLANs

There are some differences when assigning ACLs to a VLAN rather than a physical port.

For example, when using a single port-pipe, if you apply an ACL to a VLAN, one copy of the ACL entries is installed in the ACL

CAM on the port-pipe. The entry looks for the incoming VLAN in the packet. Whereas if you apply an ACL on individual ports of

a VLAN, separate copies of the ACL entries are installed for each port belonging to a port-pipe.

When you use the log keyword, the CP has to log the details about the packets that match. Depending on how many packets

match the log entry and at what rate, the CP might become busy as it has to log these packets’ details. However, the Route

Processor (RP) is unaffected. This option is typically useful when debugging some problem related to control traffic. We have

used this option numerous times in the field and have not encountered problems so far.

ACL Optimization

If an access list contains duplicate entries, the system deletes one entry to conserve CAM space.

Standard and extended ACLs take up the same amount of CAM space. A single ACL rule uses two CAM entries whether it is

identified as a standard or extended ACL.

Determine the Order in which ACLs are Used to Classify Traffic

When you link class-maps to queues using the service-queue command, the system matches the class-maps according to

queue priority (queue numbers closer to 0 have lower priorities).

As shown in the following example, class-map cmap2 is matched against ingress packets before cmap1.

ACLs acl1 and acl2 have overlapping rules because the address range 20.1.1.0/24 is within 20.0.0.0/8. Therefore (without the

keyword order), packets within the range 20.1.1.0/24 match positive against cmap1 and are buffered in queue 7, though you

intended for these packets to match positive against cmap2 and be buffered in queue 4.

Access Control Lists (ACLs)