Administrator Guide

• The ACL VLAN group is deleted and it does not contain VLAN members.
• The ACL is applied or removed from a group and the ACL group does not contain a VLAN member.
•
The description of the ACL group is added or removed.
Guidelines for Conguring ACL VLAN Groups
Keep the following points in mind when you congure ACL VLAN groups:
• The interfaces where you apply the ACL VLAN group function as restricted interfaces. The ACL VLAN group name identies the group
of VLANs that performs hierarchical ltering.
• You can add only one ACL to an interface at a time.
• When you attach an ACL VLAN group to the same interface, validation performs to determine whether the ACL is applied directly to an
interface. If you previously applied an ACL separately to the interface, an error occurs when you attempt to attach an ACL VLAN group
to the same interface.
• The maximum number of members in an ACL VLAN group is determined by the type of switch and its hardware capabilities. This
scaling limit depends on the number of slices that are allocated for ACL CAM optimization. If one slice is allocated, the maximum
number of VLAN members is 256 for all ACL VLAN groups. If two slices are allocated, the maximum number of VLAN members is 512
for all ACL VLAN groups.
• The maximum number of VLAN groups that you can congure also depends on the hardware specications of the switch. Each VLAN
group is mapped to a unique ID in the hardware. The maximum number of ACL VLAN groups supported is 31. Only a maximum of two
components
(iSCSI counters, Open Flow, ACL optimization, and so on) can be allocated virtual ow processing slices at a time.
• Port ACL optimization is applicable only for ACLs that are applied without the VLAN range.
• If you enable the ACL VLAN group capability, you cannot view the statistical details of ACL rules per VLAN and per interface. You can
only view the counters per ACL only using the show ip accounting access list command.
• Within a port, you can apply Layer 2 ACLs on a VLAN or a set of VLANs. In this case, CAM optimization is not applied.
• To enable optimization of CAM space for Layer 2 or Layer 3 ACLs that are applied to ports, the port number is removed as a qualier for
ACL application on ports, and port bits are used. When you apply the same ACL to a set of ports, the port bitmap is set when the ACL
ow processor (FP) entry is added. When you remove the ACL from a port, the port bitmap is removed.
• If you do not attach an ACL to any of the ports, the FP entries are deleted. Similarly, when the same ACL is applied on a set of ports,
only one set of entries is installed in the FP, thereby saving CAM space. Enable optimization using the optimized option in the ip
access-group
command. This option is not valid for VLAN and link aggregation group (LAG) interfaces.
Conguring ACL VLAN Groups and Conguring FP
Blocks for VLAN Parameters
This section describes how to optimize CAM blocks by conguring ACL VLAN groups that you can attach to VLAN interfaces. It also
describes how to congure FP blocks for dierent VLAN operations.
Conguring ACL VLAN Groups
You can create an ACL VLAN group and attach the ACL with the VLAN members. The optimization is applicable only when you create an
ACL VLAN group.
1 Create an ACL VLAN group.
CONFIGURATION mode
acl-vlan-group {group name}
2 Add a description to the ACL VLAN group.
CONFIGURATION (conf-acl-vl-grp) mode
102
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)