•
Removing a rule
—
Without using a sequence number, removing a rule requires that you enter the whole
rule, as follows:
switch(config-acl)#
no permit tcp 10.0.0.0/8 any
However, if the same rule had a sequence number of 101, removing the rule requires only the following
command:
switch(config-acl)#
no 101
•
Moving a rule
—
With sequence numbers, if you need to move a rule to a different position within an
ACL, you can add a second instance of the rule using the sequence number that positions it correctly,
and then you can remove the original instance of the rule. This action allows you to move the rule without
disrupting traffic.
If you enter a rule without a sequence number, the device adds the rule to the end of the ACL and assigns a
sequence number that is 10 greater than the sequence number of the preceding rule to the rule. For example,
if the last rule in an ACL has a sequence number of 225 and you add a rule without a sequence number, the
device assigns the sequence number 235 to the new rule.
In addition, the device allows you to reassign sequence numbers to rules in an ACL. Resequencing is useful
when an ACL has rules numbered contiguously, such as 100 and 101, and you need to insert one or more
rules between those rules.
Logical Operators and Logical Operation Units
IP ACL rules for TCP and UDP traffic can use logical operators to filter traffic based on port numbers.
The Cisco Nexus device stores operator-operand couples in registers called logical operation units (LOUs)
to perform operations (greater than, less than, not equal to, and range) on the TCP and UDP ports specified
in an IP ACL.
ACL TCAM Regions
You can change the size of the ACL ternary content addressable memory (TCAM) regions in the hardware.
The IPv4 TCAMs are single wide.
You can create IPv6 port ACLs, router ACLs, and you can match IPv6 addresses for QoS. Cisco NX-OS
provides simultaneous support for all three TCAMs. You must remove or reduce the size of the existing
TCAMs to enable these new IPv6 TCAMs.
TCAM region sizes have the following guidelines and limitations:
•
To revert to the default ACL TCAM size, use the
no hardware access list tcam region
command. You
need to reload the modules when you revert to default sizes.
•
Depending upon the platform, each TCAM region might have a different minimum/maximum/aggregate
size restriction.
•
The total number of TCAMs is 16.
◦
There are 12 large TCAMs
—
Each has 2048 entries that are 160 bit key size.
◦
There are 4 small TCAMs
—
Each has 256 entries that are 160 bit key size.
•
The TCAM regions RACL v6, QoS, CoPP, and Multicast cannot be set to 0.
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
78
Configuring IP ACLs
ACL TCAM Regions
Содержание Nexus 3600 NX-OS
Страница 10: ...Cisco Nexus 3600 NX OS Security Configuration Guide Release 7 x x Contents ...
Страница 20: ...Cisco Nexus 3600 NX OS Security Configuration Guide Release 7 x 6 Overview IP ACLs ...
Страница 42: ...Cisco Nexus 3600 NX OS Security Configuration Guide Release 7 x 28 Configuring AAA Default AAA Settings ...
