Hi,
I would like to receive feedback about our network design and posible drawbacks on ACL deployment in our layer 3 switches in the way we are using them. These ACLs, when applied and enough traffic traverses the interface, start to consume CPU in the switches up to 100% (ios-base (62%) and iprouting.iosproc (37%) processes), so the performance starts going down dangerously.
In our deployment we are implementing internal VLAN routing for customer VLANs via two HSRP Cisco 6504 (with IOS 12.2SX) on more than 30 VLANs hanging from them. Trying to control traffic between the VLANs, we implement ACLs in each VLAN interface, applied both outbound and inbound (not in all interfaces, for example, in the access to Internet there is no ACL as we have the perimter firewall).
As an example, in one VLAN interface we have the next two ACL implemented (there are some comments to understand them):
Applied inbound in the interface ("ip access-group ACL_XXX in"):
ip access-list extended ACL_XXX
permit udp any host 224.0.0.2 eq 1985 reflect udpHSRP
permit icmp any any echo
permit icmp any any echo-reply
!outbound ACL reflexive traffic
evaluate tcp_22
evaluate tcp_5666
evaluate tcp_NAT1
evaluate tcp_NAT2
!Denying traffic to the other internal VLANs
deny ip 10.10.X.0 0.0.0.255 10.10.0.0 0.0.255.255
!Permitting rest of Internet traffic
permit tcp 10.10.X.0 0.0.0.255 any reflect salida_tcp
permit udp 10.10.X.0 0.0.0.255 any reflect salida_udp
Applied outbound in the interface ("ip access-group ACL_YYY out"):
ip access-list extended ACL_YYY
permit udp any host 224.0.0.2 eq 1985 reflect udpHSRP
permit icmp any any echo
permit icmp any any echo-reply
!Some administrative permit rules
permit tcp 192.168.0.0 0.0.0.255 10.10.X.0 0.0.0.255 eq 22 reflect tcp_22
permit tcp host 192.168.0.1 10.10.X.0 0.0.0.255 eq 5666 reflect tcp_5666
!External NAT publication rules, that have correspondent on the perimeter firewall
permit tcp any host 10.10.X.X eq 443 reflect tcp_NAT1
permit tcp any host 10.10.X.Y eq 8443 reflect tcp_NAT2
!Reflexive traffic to Internet
evaluate salida_tcp
evaluate salida_udp
As said before, applying one of them while there is traffic in that concrete VLAN raises CPU consumption, and unapplying them suddenly falls again CPU consumption and things calm down. Things that we are reading about and are taking into account:
- Our ACLs are supposed to be processing packets via CEF in the interfaces and should not be kernel processed (what is called "process switching"). For that, we are using "no ip unreachables" and "no ip redirects" on each interface, and we have no explicit "log" command in ACL definition (enough for disabling logging, isn't it?)
- We know that in the moment that the ACLs apply there is a sudden raise in CPU computation, for the calculations that must be done. But these issue is continuous in time while the traffic is flowing
- As we are using reflexive ACLs, can they be processed in hardware (CEF)? Or should process switching be affected? Shouldn't we use them?
- Another question we have is why we don't have "object groups" in our IOS version so we can simplify some ACL design.
- There is no much flexibility in changing things, as is a production environment
Is there any advise you could tell us on what we are doing wrong? Is there a desing flaw or any other way to do this without this harm?
Thanks in advance!!
