Dell Brocade DCX, Configuration Manual

Page: 584 / 1436

512 BigIron RX Series Configuration Guide
53-1001810-01
How the device processes ACLs
21
How the device processes ACLs
The device processes traffic that ACLs filter in hardware. The device creates an entry for each ACL
in the Content Addressable Memory (CAM) at startup or when the ACL is created. The device uses
these CAM entries to permit or deny packets in the hardware, without sending the packets to the
CPU for processing.
General configuration guidelines
•
ACLs are supported on physical interfaces, trunk groups, and virtual routing interfaces.
•
ACLs are supported only for inbound traffic. An error message is displayed if you apply an ACL
to an outbound interface.
•
You can create up to 416 CAM entries, but you can have up to 8,000 statements (rules) in all
the ACL configurations on the device. Default is 4096 statements.
•
A port supports only one ACL; however, the ACL can contain multiple statements. For example,
both ACLs 101 and 102 cannot be supported on port 1, but ACL 101 can contain multiple
entries.
•
If you change the content of an ACL (add, change, or delete entries), you must remove and then
reapply the ACL to all the ports that use it. Otherwise, the older version of the ACL remains in
the CAM and continues to be used. You can easily re-apply ACLs using the ip rebind-acl
<num>
| <name> | all command. Refer to “Applying ACLs to interfaces” on page 551.
•
You cannot enable any of the following features on the interface if an ACL is already applied to
that interface:
•
Protection against ICMP or TCP Denial-of-Service (DoS) Attacks
•
ACL-based rate limiting
•
ACL Logging
•
Policy-based routing (PBR)
RX-BI-16XG (16 x 10GE ) Module EGRESS ACLconfiguration guidelines
•
The RX-BI-16XG 16 x 10GE module only supports standard, extended, named, and
numbered ACLs for outbound access-group applicationsACLs.
•
Egress filtering on subset ports of a VE is not supported, matching must apply to all VE
ports .
•
Matching the SPI field value is not supported for egress acl.
•
Matching field of fragment or fragmentation-offset is not supported.
•
A matching egress acl only compares to 3 bits of TOS field (delay, throughput, reliability)
•
ACLs that specify spi, .tos min monrtary cost, fragment or fragmentation-offset will cause
a configuration conflict and an error message "ACL configuration conflict specified filter
not supported" is entered in syslog.
•
802.1p-priority is not supported as a matching egress acl condition.
•
dscp-marking is not available as a condition matching egress acl action.
•
deny-logging is not supported for egress ACLs.