Connectivity Guide

Application Group Stage Feature(s) Default number of
pools
Minimum number of
pools required
Maximum number of
pools supported
ACL, IPV6-EGR-
USER-ACL
You can create a user-dened ACL table prole that denes the application groups you need and the number of hardware pools you wish to
allocate for those application groups. This prole-based approach assumes that not all features are used at the same time. You can even
allocate all the ACL hardware pools to ingress application group 1, or app-group-1.
The ingress app-group command allows you to specify the amount of space you wish to allocate for the dierent features within a
particular application group. You can choose to share the space among the various features in the group, or reserve a certain percentage of
space for each of the features in the group.
Important Notes
• The system ow entries are added to the hardware through the system-ow ACL table (ingress app-group-1). This group is mandatory
and by default is assigned one pool. You can congure the size of this group, from 1 to 5 pools.
• You can congure the size of ACL tables for ingress application groups 2 to 5 based on your requirements, from 0 to 4 pools.
• There is only one hardware pool supported for egress in the S5148F-ON platform. Hence, egress app-group-1 is mandatory and is not
congurable.
• Before you reduce the size of an ACL table for an application group, be sure to run the show acl-table-usage details
command to determine the current utilization and then congure the ACL table size for the dierent application groups accordingly.
• You might need to delete some of the existing ACL rules in order to reduce the utilization of the slice associated with the application
group, if you plan to reduce its size.
• After you apply the ACL table prole, be sure to save the conguration and reload the switch. The new prole takes eect only after
the system reboots.
• Do not add new ACL rules after you change the ACL table prole and before you reload the switch.
Congure ACL table prole
You can congure ACL table space for the ve ingress application groups. Before you congure the ACL table space, run the show acl-
table-usage detail command to view the current utilization.
1 Create an ACL table prole.
OS10(config)# configure terminal
OS10(config)# acl-table-profile V4-USER-SCALE
OS10(config-acl-table-profile)#
2 Dene the number of hardware pools for the application groups and the amount of space for the features within the application
group. There are a total of 5 pools, corresponding to the ve application groups.
OS10(config-acl-table-profile)# ingress app-group-1 pool-count 2 L2-USER-ACL shared VLT-ACL
max 50
OS10(config-acl-table-profile)# ingress app-group-3 pool-count 3 IPv4-USER-ACL shared IPV6-
USER-ACL shared
NOTE
: Ingress app-group-1 is mandatory and is assigned one hardware pool by default. You can increase the number of
pools for ingress app-group-1, if needed. You must explicitly congure the number of pools for ingress application
groups 2 to 5. In this example, app-group-2, app-group-4, and app-group-5 are not congured. In this case, the system
does not allocate any space for the respective ACL tables (L2-QOS-ACL, ISCSI-SNOOP-ACL, IPV4-QOS-ACL, etc).
Instead, the hardware space gets allocated to app-group-1 and app-group-3.
Using the shared keyword implies that you do not explicitly reserve space for the features that share the same group.
Instead, the ACL rules are allocated space in the pool on a rst come-rst serve basis. For example, when you congure
app-group-3 and choose to share the pool space between the IPv4-USER-ACL and IPv6-USER-ACL features, the pool
space could be shared between the two features, or used up by either IPv4-USER-ACLs or IPV6-USER-ACLs, depending on
whichever entries are added rst.
706 Access Control Lists