Avaya Cajun P580, User Manual, Page: 434 / 770

13-24 User Guide for the Avaya P580 and P882 Multiservice Switches, v6.0
Chapter 13
Design Safe, Efficient ACLs
The entry of ACL rules via the CLI, web or Avaya Policy Manager does not
encourage or enforce any checking beyond correct syntax. The general
guideline is that you are configuring a Layer-3 switch, not a firewall. The
following are some criteria for designing safe, efficient ACLs and how they
affect performance:
■
Specify Destination Address: The wildcard feature of rule creation
is a convenience but can explode the number of identified Flows.
Since the “standard” ACL implies “any” for the destination, it
should also be used with care. It is desirable for the wildcard to
match a specific set of addresses.
■
Use Protocols/Ports Carefully: By pushing the ACL-to-packet
matching up one or two levels of the IP stack, it refines the
granularity of the Flows to be very specific in what is matched. A
source-port range can cause a large number of “micro” Flows to be
created.
■
Minimize Rules: The number of rules has a direct impact on the
CPU effort to match rules to Flows. This is especially true when
there is a high frequency of packets that are “walked down” the
entire list and don’t match any rules.
■
Minimize Searching: The goal is to place the most frequently
matched rules toward the beginning of the ACL. This requires a
good knowledge of traffic patterns. This can be noticeable as ACLs
get longer.
■
Permit Management Traffic with High Priority: This include
routing updates (unicast for RIP 1, multicast for RIP 2), SNMP
(MSNM, HPOV), LDAP (for Cajun Rules/Avaya Policy Manager).
Not doing this can cause loss of management connectivity.
Identify the Ports
The chassis is organized by slots, fabric ports, PRE/F-chip’s, and physical
ports. The number of F-Chips and physical ports vary with the module type.
This information is useful in spreading the workload evenly among
resources, and identifying possible choke points:
■
Every Fabric port can manage up to 4 F-Chips
■
Slot 1 has 1 Fabric port only
■
Slots 2-7 (P580) and Slots 2-17 (P882) have 2 Fabric ports per slot
■
The Supervisor has 1 F-chip (FORE)