28-45
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-09
Chapter 28 Configuring Network Security with ACLs
Displaying ACL Information
ACL Configuration Fitting in Hardware
As previously stated, ACL processing in the Catalyst 3550 switch is mostly accomplished in hardware.
However, if the hardware reaches its capacity to store ACL configurations, the switch software attempts
to fit a simpler configuration into the hardware. This simpler configuration does not do all the filtering
that has been configured, but instead sends some or all packets to the CPU to be filtered by software. In
this way, all configured filtering will be accomplished, but performance is greatly decreased when the
filtering is done in software.
For example, if the combination of an input router ACL applied to a VLAN interface and a VLAN map
applied to the same VLAN does not fit into the hardware, these results might occur:
•
If the VLAN map alone fits in hardware, the software sets up the hardware to send to the CPU all
packets that need to be routed for filtering and possible routing (if the packet passes the filter).
Packets that only require bridging within the input VLAN are still handled entirely by hardware and
not sent to the CPU.
•
If the VLAN map does not fit in the hardware, all packets on that VLAN must be both filtered and
forwarded by software.
Any problem in fitting the configuration into hardware is logged. You can use the show fm privileged
EXEC commands to determine if any interface configuration or VLAN configuration did not fit into
hardware.
Port ACL Examples
This is an example of a port access list that is too big for the available TCAM space.
Switch(config-if)# interface gigabitethernet0/3
Switch(config-if)# ip access-group 100 in
Switch(config-if)#
00:04:58:%FM-3-UNLOADING:Unloading port label 3 feature from TCAM 1
To verify the port label or to see if a label was assigned to an interface, you can enter the show fm
interface command.
Switch# show fm interface gigabitethernet0/3
Input Port Label:3
Entering the show fm port-label 3 privileged EXEC command shows that label 3 is needed in CAM 1
but that it is not loaded in CAM 1; instead, it is sent to the CPU.
Switch# show fm port-label 3
Needed in CAM(s):1
Loaded into CAM(s):
Sent to CPU by CAM(s):1
Interfaces: Gi0/3
IP Access Group:100 3400 VMRs
DHCP Broadcast Suppression Disabled.
MAC Access Group:(None) 2 VMRs
The number of TCAMs on a switch varies (from 1 to 3) with switch model. On switches that have more
than one TCAM, if the same port ACL has been applied to several interfaces, it is possible that the
configuration fits into some, but not all, of the required TCAMs. In that case, a log message generated
when the ACL is applied specifies which TCAM was unable to load the ACL.
Switch(config)# interface gigabitethernet0/10
Switch(config-if)# ip access-group 101 in
Switch(config-if)#
01:46:25:%FM-3-UNLOADING:Unloading port label 4 feature from TCAM 1