Cisco IE 4000, Software Configuration Manual

Page: 557 / 1066

553
Configuring Network Security with ACLs
Information About Network Security with ACLs
Note: If an ACL configuration cannot be implemented in hardware due to an out-of-resource condition on a switch, then
only the traffic in that VLAN arriving on that switch is affected (forwarded in software). Software forwarding of packets
might adversely impact the performance of the switch, depending on the number of CPU cycles that this consumes.
For router ACLs, other factors can cause packets to be sent to the CPU:

Using the log keyword

Generating ICMP unreachable messages
When traffic flows are both logged and forwarded, forwarding is done by hardware, but logging must be done by
software. Because of the difference in packet handling capacity between hardware and software, if the sum of all flows
being logged (both permitted flows and denied flows) is of significant bandwidth, not all of the packets that are forwarded
can be logged.
If router ACL configuration cannot be applied in hardware, packets arriving in a VLAN that must be routed are routed in
software, but are bridged in hardware. If ACLs cause large numbers of packets to be sent to the CPU, the switch
performance can be negatively affected.
When you enter the show ip access-lists privileged EXEC command, the match count displayed does not account for
packets that are access controlled in hardware. Use the show access-lists hardware counters privileged EXEC
command to obtain some basic hardware ACL statistics for switched and routed packets.
Troubleshooting ACLs
If this ACL manager message appears, where [chars] is the access-list name, the switch then has insufficient resources
to create a hardware representation of the ACL.
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The resources include hardware memory and label space but not CPU memory. A lack of available logical operation units
or specialized hardware resources causes this problem. Logical operation units are needed for a TCP flag match or a
test other than
eq ( ne , gt , lt , or range ) on TCP, UDP, or SCTP port numbers.
Use one of these workarounds:

Modify the ACL configuration to use fewer resources.

Rename the ACL with a name or number that alphanumerically precedes the ACL names or numbers.
To determine the specialized hardware resources, enter the show platform layer4 acl map privileged EXEC command.
If the switch does not have available resources, the output shows that index 0 to index 15 are not available.
For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug Toolkit.
Named MAC Extended ACLs
You can filter non-IPv4 traffic on a VLAN or on a Layer 2 interface by using MAC addresses and named MAC extended
ACLs. The procedure is similar to that of configuring other extended named ACLs.
Note: You cannot apply named MAC extended ACLs to Layer 3 interfaces.
Note: Though visible in the command-line help strings, appletalk is not supported as a matching condition for the deny
and permit MAC access-list configuration mode commands.