switch(config)#
hardware access-list update atomic
Session Manager Support for IP ACLs
Session Manager supports the configuration of IP and MAC ACLs. This feature allows you to verify ACL
configuration and confirm that the resources required by the configuration are available prior to committing
them to the running configuration.
ACL TCAM Regions
You can change the size of the ACL ternary content addressable memory (TCAM) regions in the hardware.
On Cisco Nexus 9300 and 9500 Series switches and Cisco Nexus 3164Q, 31128PQ, 3232C, and 3264Q
switches, the egress TCAM size is 1K, divided into four 256 entries. On Cisco Nexus NFE2-enabled devices
(such as the Cisco Nexus 3232C and 3264Q switches), the ingress TCAM size is 6K, divided into twelve 512
slices. Three slices are in one group. On other Cisco Nexus 9300 and 9500 Series switches and the 3164Q
and 31128PQ switches, the ingress TCAM size is 4K, divided into eight 256 slices and four 512 slices. A
slice is the unit of allocation. A slice can be allocated to one region only. For example, a 512-size slice cannot
be used to configure two features of size 256 each. Similarly, a 256-size slice cannot be used to configure two
features of size 128 each. The IPv4 TCAM regions are single wide. The IPv6, QoS, MAC, CoPP, and system
TCAM regions are double wide and consume double the physical TCAM entries. For example, a logical
region size of 256 entries actually consumes 512 physical TCAM entries.
You can create IPv6, port ACLs, VLAN ACLs, and router ACLs, and you can match IPv6 and MAC addresses
for QoS. However, Cisco NX-OS cannot support all of them simultaneously. You must remove or reduce the
size of the existing TCAM regions (TCAM carving) to enable the IPv6, MAC, or other desired TCAM regions.
For every TCAM region configuration command, the system evaluates if the new change can be fit in the
TCAM. If not, it reports an error, and the command is rejected. You must remove or reduce the size of existing
TCAM regions to make room for new requirements.
On Cisco Nexus 9200 Series switches, the egress TCAM size is 2K, and the ingress TCAM size is 4K. The
concepts of TCAM slices and single- and double-wide regions do not apply to these switches. For example,
the ing-ifacl region can host IPv4, IPv6, or MAC type entries. IPv4 and MAC types occupy one TCAM entry
whereas IPv6 types occupy two TCAM entries.
ACL TCAM region sizes have the following guidelines and limitations:
• To enable RACL or PACL on existing TCAM regions, you must carve the TCAM region beyond 12,
288.
• On Cisco Nexus 9300 Series switches, the X9536PQ, X9564PX, and X9564TX line cards are used to
enforce the QoS classification policies applied on 40G ports. It has 768 TCAM entries available for
carving in 256-entry granularity. These region names are prefixed with "ns-".
• For the X9536PQ, X9564PX, and X9564TX line cards, only the IPv6 TCAM regions consume double-wide
entries. The rest of the TCAM regions consume single-wide entries.
• When a VACL region is configured, it is configured with the same size in both the ingress and egress
directions. If the region size cannot fit in either direction, the configuration is rejected.
• On Cisco Nexus 9200 Series switches, the ing-sup region occupies a minimum size of 512 entries, and
the egr-sup region occupies a minimum size of 256 entries. These regions cannot be configured to lesser
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
223
Configuring IP ACLs
Session Manager Support for IP ACLs
