3750 ACL design

[mustafa.s.raza]

Hi
The customer is using fourscout security software to authenticate and separate manufacturing and corporate environment.
The catalyst 3750 supports 3000-3500 acl entries.
Currently each host requires an acl entry which will out last ACL limit on 3750 switch. Basically 4000 host/ entries are required.
Since this is more of a design issue , the client is open for recommendations.

One Idea is to create Vlans for x amount of host and have them match ACL or AD authentication and not to worry about mapping each host with individual ACL

What would you recommend? The client will not changes catalyst 3750 switches .

How can we design so that we stay within 3750 ACL list and supports not only 4000 users but also thousands more.

Any help will be greatly appreciated.

Thanks

Sent from Cisco Technical Support iPhone App

[Vivek Ruhil]

Hi Mustafa

It is never a good design to have 4000 ACE in a single ACL. So I guess there are really two options:

1. Modify the ACL to have lower entries use wild card masks to reduce the size of the ACL. I mean its not like that the customer has such a dis-contiguous network that you cannot club entries together. By the way, why such a peculiar requirement ?

2. Like you said, create multiple vlans.

But I would recommend option 1.