15-24
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 15 Configuring Access Control
Using VACLs with Cisco IOS ACLs
Determining Layer 4 Operation Usage
The switch hardware allows you to specify these types of operations:
•
gt (greater than)
•
lt (less than)
•
neq (not equal)
•
eq (equal)
•
range (inclusive range)
We recommend that you do not specify more than nine
different
operations on the same ACL. If you
exceed this number, each new operation might cause the affected ACE to be translated into more than
one ACE.
Note
If you have a Cisco IOS ACL and a VACL on the same VLAN interface, the recommended total number
of Layer 4 operations is still nine or less.
Use the following two guidelines to determine the Layer 4 operation usage:
1.
Layer 4 operations are considered different if the operator or the operand differ. In this ACL, there
are four different Layer 4 operations (“gt 10” and “gt 11” are considered two different Layer 4
operations):
... gt 10 permit
... lt 9 deny
... gt 11 deny
... neq 6 redirect
Note
There is no limit to the use of “eq” operators, because the “eq” operator does not use a logical
operator unit (LOU) or a Layer 4 operation bit. See the
“Determining Logical Operation Unit
Usage” section on page 15-24
for a description of LOUs.
2.
Layer 4 operations are considered different if the same operator/operand couple applies once to a
source port and once to a destination port. In this ACL, there are two different Layer 4 operations
because one ACE applies to the source port and one applies to the destination port.
... Src gt 10 ...
... Dst gt 10
Note
Check the ACL Layer 4 port operations resource usage using the
show security acl
resource-usage
command.
Determining Logical Operation Unit Usage
The LOUs are registers that store the operator/operand couples. All the ACLs use the LOUs. There can
be up to 32 LOUs; each LOU can store two different operator/operand couples with the exception of the
range operator. The LOU usage per Layer 4 operation is as follows:
•
gt uses 1/2 LOU
•
lt uses 1/2 LOU
•
neq uses 1/2 LOU
