DACLs in ISE

[cajones]

Is there a size limitation on DACLs?  Is there a way to create something like an object group within DACLs so they are not so large?

[Karsten Iwen]

There are different limitations that can apply based on RADIUS and the switch-model:

• The whole dACL can not exceed 4000 characters as it has to fit into one RADIUS packet.
• up to 64 lines in a single dACL (you should have far less lines in practice).
• The total amount of ACEs the switch can store in it's TCAM. That can range from only a few hundreds on the low end switches and a few thousands on the more expensive models. This can often be adjusted by choosing the right SDM-template.

[cajones]

Thank you both very much.  This is great information.

[chyps]

While I don't make a normal practice of correcting old entries in the Cisco community, I discovered the info provided in this thread is not correct and appears to be the predominant response still returned by some search engines when asking the question about dACL size limits. 

• Cisco dACLs are NOT limited to 4000 characters in a single packet. While true that the size of RADIUS packets are limited, dACLs are not limited to a single packet. The contents of a dACL may be sent over multiple packets if needed. In other words, no hard limit on dACL characters.
• "Up to 64 lines in a single dACL" is a common best practice tip in various Cisco technical documents, but is NOT an actual limit. Best practices speak to the question of cumulative TCAM usage in the switch which would more likely be exceeded if attempting to send multiple unique dACLs to a switch with many ACL entries. Actual limits are highly variable based on switch TCAM capacity, number of unique dACLs sent, and the size of each unique dACL. 

For additional references on this topic, see:

• https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515
• https://community.cisco.com/t5/network-access-control/dacl-with-over-100-lines/td-p/3574279

[nspasov]

To add to the the great info already provided by Karsten:

- The DACLs should be kept short and simple. I have done many ISE deployments and 99% of the time the DACLs did not exceed 4 lines

- If DACLs start growing out of control then you should consider TrustSect/SGA/SGT

- Also, while not ideal, you can use VLAN override and then perform restriction(s) on a distribution type switch, Firewall, etc.

I hope this helps!

Thank you for rating helpful posts!