15-82
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 15 Configuring Access Control
Configuring ACL Statistics
Optimizing an ACL involves removing the redundant ACEs, merging the ACEs, and reordering the
ACEs. Removing the redundant ACEs and merging the ACEs reduces the number of TCAM entries.
Reordering the ACEs reduces the number of TCAM entries and the number of TCAM masks.
The ACL statistics are derived from the counters of the ACEs that comprise the optimized ACL. A
mapping function maps these ACEs to the ACEs corresponding to the original user-configured ACLs.
Note
With PFC2 and PFC3A, the counters are based on software sampling and are not accurate. PFC3B/PFC3BXL
use the hardware counters that provide accurate statistics. With PFC2/PFC3A, the counters report if a
particular ACE was hit during a 300-ms window but the counters do not indicate how much traffic hit
the entry. For example, if you have two flows where one flow is 1000 packets per second and the second
flow is 10 packets per second, both flows return the same result with a PFC2/PFC3A. PFC3B/PFC3BXL
and later PFCs do not have this limitation.
Note
The ACL statistics could differ between the active and standby supervisor engines because the ACLs
cannot be programmed into the active/standby TCAMs at the exact time. However, if the traffic starts
hitting the TCAM after the TCAM is programmed, the ACL statistics should be the same.
Configuring ACL Statistics from the CLI
This section provides these example procedures:
•
Enabling the ACL Compiler Optimization, page 15-82
•
Enabling ACL Statistics on a Per-ACL Basis, page 15-83
•
Enabling ACL Statistics on a Per-VLAN Basis, page 15-84
•
Enabling ACL Statistics on a Per-ACE Basis, page 15-84
•
Clearing ACL Statistics, page 15-85
•
Displaying ACL Statistics Information, page 15-86
Enabling the ACL Compiler Optimization
Enter the
set security acl comp-opt
command to optimize the ACL compiler.
To enable ACL compiler optimization, perform this task in privileged mode:
This example shows how to enable ACL compiler optimization:
Console> (enable)
set security acl comp-opt enable
Acl Compiler Optimization Enabled.
Console> (enable)
show security acl comp-opt
Acl Compiler Optimization Enabled
Console> (enable)
Task
Command
Enable ACL compiler optimization.
set security acl comp-opt
{
enable
|
disable
}
