16-21
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 16 Configuring Access Control
Using VACLs with Cisco IOS ACLs
Note
There is no limit to the use of “eq” operators as the “eq” operator does not use a logical operator unit
(LOU) or a Layer 4 operation bit. See the
“Determining Logical Operation Unit Usage” section on
page 16-21
for a description of LOUs.
2.
Layer 4 operations are considered different if the same operator/operand couple applies once to a
source port and once to a destination port. For example, in this ACL there are two different Layer 4
operations because one ACE applies to the source port and one applies to the destination port.
... Src gt 10 ...
... Dst gt 10
Note
Check the ACL Layer 4 port operations resource usage using the
show security acl resource-usage
command.
Determining Logical Operation Unit Usage
LOUs are registers that store operator/operand couples. All ACLs use LOUs. There can be up to
32 LOUs; each LOU can store two different operator/operand couples with the exception of the range
operator. LOU usage per Layer 4 operation is as follows:
•
gt uses 1/2 LOU
•
lt uses 1/2 LOU
•
neq uses 1/2 LOU
•
range uses 1 LOU
•
eq does not require a LOU
For example, this ACL would use a single LOU to store two different operator/operand couples:
... Src gt 10 ...
... Dst gt 10
A more detailed example follows:
ACL1
... (dst port) gt 10 permit
... (dst port) lt 9 deny
... (dst port) gt 11 deny
... (dst port) neq 6 redirect
... (src port) neq 6 redirect
... (dst port) gt 10 deny
ACL2
... (dst port) gt 20 deny
... (src port) lt 9 deny
... (src port) range 11 13 permit
... (dst port) neq 6 redirect
The Layer 4 operations and LOU usage is as follows:
•
ACL1 Layer 4 operations: 5
•
ACL2 Layer 4 operations: 4
•
LOUs: 4
