Cisco Catalyst 3560-X Series, Руководство по настройке программного обеспечения

Страница: 892 / 1538

1-24
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring Network Security with ACLs
Configuring IPv4 ACLs
The switch has insufficient resources to create a hardware representation of the ACL. The resources
include hardware memory and label space but not CPU memory. A lack of available logical operation
units or specialized hardware resources causes this problem. Logical operation units are needed for a
TCP flag match or a test other than
eq ( ne , gt , lt , or range ) on TCP, UDP, or SCTP port numbers.
Use one of these workarounds:
•
Modify the ACL configuration to use fewer resources.
• Rename the ACL with a name or number that alphanumerically precedes the ACL names or
numbers.
To determine the specialized hardware resources, enter the show platform layer4 acl map privileged
EXEC command. If the switch does not have available resources, the output shows that index 0 to
index 15 are not available.
For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug
Toolkit.
For example, if you apply this ACL to an interface:
permit tcp source source-wildcard destination destination-wildcard range 5 60
permit tcp source source-wildcard destination destination-wildcard range 15 160
permit tcp source source-wildcard destination destination-wildcard range 115 1660
permit tcp source source-wildcard destination destination-wildcard
And if this message appears:
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The flag-related operators are not available. To avoid this issue,
• Move the fourth ACE before the first ACE by using ip access-list resequence global configuration
command:
permit tcp source source-wildcard destination destination-wildcard
permit tcp source source-wildcard destination destination-wildcard range 5 60
permit tcp source source-wildcard destination destination-wildcard range 15 160
permit tcp source source-wildcard destination destination-wildcard range 115 1660
or
• Rename the ACL with a name or number that alphanumerically precedes the other ACLs (for
example, rename ACL
79 to ACL 1 ).
You can now apply the first ACE in the ACL to the interface. The switch allocates the ACE to available
mapping bits in the Opselect index and then allocates flag-related operators to use the same bits in the
hardware memory.
IPv4 ACL Configuration Examples
This section provides examples of configuring and applying IPv4 ACLs. For detailed information about
compiling ACLs, see the
Cisco IOS Security Configuration Guide, Release 12.4 and to the Configuring
IP Services” section in the “IP Addressing and Services” chapter of the Cisco IOS IP Configuration
Guide, Release 12.4.
•
ACLs in a Small Networked Office, page 1-25
• Numbered ACLs, page 1-26
•
Extended ACLs, page 1-26
• Named ACLs, page 1-27