Statistics and ACLs
The device can maintain global statistics for each rule that you configure in IPv4, IPv6, and MAC ACLs. If
an ACL is applied to multiple interfaces, the maintained rule statistics are the sum of packet matches (hits)
on all the interfaces on which that ACL is applied.
The device does not support interface-level ACL statistics.
Note
For each ACL that you configure, you can specify whether the device maintains statistics for that ACL, which
allows you to turn ACL statistics on or off as needed to monitor traffic filtered by an ACL or to help
troubleshoot the configuration of an ACL.
The device does not maintain statistics for implicit rules in an ACL. For example, the device does not maintain
a count of packets that match the implicit
deny ip any any
rule at the end of all IPv4 ACLs. If you want to
maintain statistics for implicit rules, you must explicitly configure the ACL with rules that are identical to the
implicit rules.
Related Topics
Monitoring and Clearing IP ACL Statistics
, on page 269
Implicit Rules for IP and MAC ACLs
, on page 217
Atomic ACL Updates
By default, when a supervisor module of a Cisco Nexus 9000 Series device updates an I/O module with
changes to an ACL, it performs an atomic ACL update. An atomic update does not disrupt traffic that the
updated ACL applies to; however, an atomic update requires that an I/O module that receives an ACL update
has enough available resources to store each updated ACL entry in addition to all pre-existing entries in the
affected ACL. After the update occurs, the additional resources used for the update are freed. If the I/O module
lacks the required resources, the device generates an error message and the ACL update to the I/O module
fails.
If an I/O module lacks the resources required for an atomic update, you can disable atomic updates by using
the
no hardware access-list update atomic
command; however, during the brief time required for the device
to remove the preexisting ACL and implement the updated ACL, traffic that the ACL applies to is dropped
by default.
If you want to permit all traffic that an ACL applies to while it receives a nonatomic update, use the
hardware
access-list update default-result permit
command.
This example shows how to disable atomic updates to ACLs:
switch#
config t
switch(config)#
no hardware access-list update atomic
This example shows how to permit affected traffic during a nonatomic ACL update:
switch#
config t
switch(config)#
hardware access-list update default-result permit
This example shows how to revert to the atomic update method:
switch#
config t
switch(config)#
no hardware access-list update default-result permit
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
222
Configuring IP ACLs
Statistics and ACLs
