Administrator Guide

• The maximum number of VLAN groups that you can congure also depends on the hardware specications of the switch. Each VLAN
group is mapped to a unique ID in the hardware. The maximum number of ACL VLAN groups supported is 31. Only a maximum of two
components (iSCSI counters, Open Flow, ACL optimization) can be allocated virtual ow processing slices at a time.
• Port ACL optimization is applicable only for ACLs that are applied without the VLAN range.
• You cannot view the statistical details of ACL rules per VLAN and per interface if you enable the ACL VLAN group capability. You can
view the counters per ACL only by using the show ip accounting access list command.
• On a port, you can apply Layer 2 ACLs on a VLAN or a set of VLANs. In this case, CAM optimization is not applied.
• To enable optimization of CAM space for Layer 2 or Layer 3 ACLs that are applied to ports, the port number is removed as a qualier for
ACL application on ports, and port bits are used. When you apply the same ACL to a set of ports, the port bitmap is set when the ACL
ow processor (FP) entry is added. When you remove the ACL from a port, the port bitmap is removed.
• If you do not attach an ACL to any of the ports, the FP entries are deleted. Similarly, when the same ACL is applied on a set of ports,
only one set of entries is installed in the FP, thereby eectively saving CAM space. The optimization is enabled only if you specify the
optimized option with the ip access-group command. This option is not valid for VLAN and LAG interfaces.
NOTE: Port-based CAM Optimization is supported only on LM/LP front panel interfaces and is not available on PeGigE
interfaces.
Conguring an ACL VLAN Group
Congure an ACL VLAN group to optimize ACL CAM use.
NOTE
: After you congure an ACL VLAN group, you must allocate CAM memory for ACL VLAN services to enable CAM
optimization. See Allocating ACL VLAN CAM for more information.
1 Create an ACL VLAN group
CONFIGURATION mode
acl-vlan-group group-name
You can create up to eight dierent ACL VLAN groups.
2 Add a description.
ACL-VLAN-GROUP CONFIGURATION (conf-acl-vl-grp) mode
description description
3 Apply an egress IP ACL.
ACL-VLAN-GROUP CONFIGURATION (conf-acl-vl-grp) mode
ip access-group access-list-name out implicit-permit
4 Specify the VLAN members in the ACL VLAN group.
ACL-VLAN-GROUP CONFIGURATION (conf-acl-vl-grp) mode
member vlan vlan-range
5 Verify the currently congured ACL VLAN groups on the switch.
ACL-VLAN-GROUP CONFIGURATION (conf-acl-vl-grp) mode
show acl-vlan-group {group-name | detail}
Dell#show acl-vlan-group detail
Group Name :
TestGroupSeventeenTwenty
Egress IP Acl :
SpecialAccessOnlyExpertsAllowed
Vlan Members :
Access Control Lists (ACLs)
125