Addendum

counters, Open Flow, ACL optimization) can be allocated virtual flow processing slices at a point in

time.

• The maximum number of VLANs that you can configure as a member of ACL VLAN groups is limited

to 512 on the S4180, Z9000, and MXL switches if two slices are allocated. If only one virtual flow

processing slice is allocated, the maximum number of VLANs that you can configure as a member of

an ACL VLAN group is 256 for the S4810, Z9000, and MXL switches.

• Port ACL optimization is applicable only for ACLs that are applied without the VLAN range.

• You cannot view the statistical details of ACL rules per VLAN and per interface if you enable the ACL

VLAN group capability because this type of statistical information is available only for ACLs that are

separately applied to VLANs. You can view the counters per ACL only.

• To display information using a particular ACL name, although you cannot display this detail using a

specified interface name, you can use the show ip accounting access list command.

• Within a port, you can apply Layer 2 ACLs on a VLAN or a set of VLANs. In this case, CAM optimization

is not applied.

• To enable optimization of CAM space for Layer 2 or Layer 3 ACLs that are applied to ports, the port

number is removed as a qualifier for ACL application on ports, and port bits are used. When you apply

the same ACL to a set of ports, the port bitmap is set when the ACL flow processor entry is added.

When you remove the ACL from a port, the port bitmap is removed.

• If you do not attach an ACL to any of the ports, the flow processor entries are deleted. In this manner,

when the same ACL is applied on set of ports, only one set of entries is installed in the flow processor

(FP), thereby effectively saving CAM space. The optimization is enabled only if you specify the

optimized option with the ip access-group command. This option is not valid for VLAN and LAG

interfaces.

Configuring ACL VLAN Groups and Configuring FP Blocks

for VLAN Parameters

. This section contains the following topics that describe how to configure ACL VLAN groups that you can

attach to VLAN interfaces to optimize the utilization of CAM blocks and also how to configure flow

processor (FP) blocks for different VLAN operations.

Configuring ACL VLAN Groups

You can create an ACL VLAN group and attach the ACL with the VLAN members. The optimization is

applicable only when you create an ACL VLAN group. If you apply an ACL separately on the VLAN

interface, each ACL has a mapping with the VLAN and increased CAM space utilization occurs. Attaching

an ACL individually to VLAN interfaces is similar to the behavior of ACL-VLAN mapping storage in CAM

prior to the implementation of the ACL VLAN group functionality.

1. Create an ACL VLAN group

CONFIGURATION mode

acl-vlan-group {group name}

You can have up to eight different ACL VLAN groups at any given time.

2. Add a description to the ACL VLAN group.

CONFIGURATION (conf-acl-vl-grp) mode

description description

ACL VLAN Groups and Content Addressable Memory (CAM)