08-12-2018 04:25 AM - edited 03-08-2019 03:53 PM
Solved! Go to Solution.
08-12-2018 09:27 PM
Hello Moments,
Did you take some time to review the provided links? I hope you can have a chance to go through those links.
The Catalyst 3850 Data Sheet suggests that 3,000 security ACL entries are supported. However, these rules define how these 3,000 ACEs can be configured: VACL/vlmaps support a total of 1.5K entries as they can use only one of the two TAQs. MAC VACL/vlmap needs three VMR/ACEs. This means 460 ACEs must be supported in each direction. IPv4 VACL/vlmap needs two VMR/ACEs. This means 690 ACEs must be supported in each direction. IPv4 PACL, RACL, and GACL need one VMR/ACE. This means 1,380 ACEs must be supported in each direction. <------- MAC PACL, RACL, and GACL need two VMR/ACEs. This means 690 ACEs must be supported in each direction. IPv6 PACL, RACL, and GACL need two VMR/ACEs. This means 690 ACEs must be supported in each direction.
Note: Even though the installed security ACEs are less than 3,072, one of the limits previously mentioned might have been reached. For example, if a customer has most of the RACLs applied in the input direction, they can use up 1,380 entries available for the inbound RACL. However, TCAM exhaustion logs can show up before all 3,072 entries are used.
3850#show platform tcam utilization asic all
CAM Utilization for ASIC# 0
Table Max Values Used Values
--------------------------------------------------------------------------------
Unicast MAC addresses 32768/512 85/22
Directly or indirectly connected routes 32768/7680 125/127
IGMP and Multicast groups 8192/512 0/16
QoS Access Control Entries 3072 68
Security Access Control Entries 3072 1648 <--------
Netflow ACEs 1024 15
Input Microflow policer ACEs 256 7
Output Microflow policer ACEs 256 7
Flow SPAN ACEs 256 13
Control Plane Entries 512 195
Policy Based Routing ACEs 1024 9
Tunnels 256 12
Input Security Associations 256 4
Output Security Associations and Policies 256 9
SGT_DGT 4096/512 0/0
CLIENT_LE 4096/64 0/0
INPUT_GROUP_LE 6144 0
OUTPUT_GROUP_LE 6144 0
http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3850-series-switches/I118957-troubleshoot-sec-acl-tcam-cat3850.html
I didn't find any information regarding the time that the switch will take to program the hardware when adding/removing ACEs from an ACL with a specific number of ACEs. However, logic dictates that it will take longer if the ACL have a big number of ACEs.
I hope that the information above results helpful to address your concerns.
08-12-2018 10:59 AM
Hello Moments,
There are several things to keep in mind regarding ACLs considering that they are processed and stored in hardware and also that there are different types of ACL. The behavior and restrictions of ACLs would depend on the platform capacity that could also be delimited by SDM templates on some switches.
Please check how SDM templates can affect/limit the number of ACEs depending on their type:
Understanding and Configuring Switching Database Manager on Catalyst 3750 Series Switches
https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/44921-swdatabase-3750ss-44921.html
SDM Templates - Catalyst 3850
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-6/configuration_guide/sys_mgmt/b_166_sys_mgmt_3850_cg/b_166_sys_mgmt_3850_cg_chapter_0110.html#con_1059809
Then, you will have to consider the limitations of having a mix of various types of ACLs and the associated use of TCAM resources:
Troubleshoot Security ACL TCAM Exhaustion on Catalyst 3850 Switches
https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3850-series-switches/118957-troubleshoot-sec-acl-tcam-cat3850.html
The previous would mean that there's no a simple answer to your question. I would not expect two ACLs to behave in the same way considering the might differ in the number of ACEs and also in the order, syntax, and way in which those entries are configured. Besides that, when considering the limitations imposed by hardware, you cannot think of the restrictions that will apply to a particular ACL without considering other existing ACLs.
So, if your ACLs are doing what they are supposed to do but you've some concerns regarding performance and ACLs with a lot of ACEs, then I would suggest checking if you can optimize those ACLs by checking things like:
I hope you find this information useful.
Regards,
08-12-2018 04:44 PM
08-12-2018 09:27 PM
Hello Moments,
Did you take some time to review the provided links? I hope you can have a chance to go through those links.
The Catalyst 3850 Data Sheet suggests that 3,000 security ACL entries are supported. However, these rules define how these 3,000 ACEs can be configured: VACL/vlmaps support a total of 1.5K entries as they can use only one of the two TAQs. MAC VACL/vlmap needs three VMR/ACEs. This means 460 ACEs must be supported in each direction. IPv4 VACL/vlmap needs two VMR/ACEs. This means 690 ACEs must be supported in each direction. IPv4 PACL, RACL, and GACL need one VMR/ACE. This means 1,380 ACEs must be supported in each direction. <------- MAC PACL, RACL, and GACL need two VMR/ACEs. This means 690 ACEs must be supported in each direction. IPv6 PACL, RACL, and GACL need two VMR/ACEs. This means 690 ACEs must be supported in each direction.
Note: Even though the installed security ACEs are less than 3,072, one of the limits previously mentioned might have been reached. For example, if a customer has most of the RACLs applied in the input direction, they can use up 1,380 entries available for the inbound RACL. However, TCAM exhaustion logs can show up before all 3,072 entries are used.
3850#show platform tcam utilization asic all
CAM Utilization for ASIC# 0
Table Max Values Used Values
--------------------------------------------------------------------------------
Unicast MAC addresses 32768/512 85/22
Directly or indirectly connected routes 32768/7680 125/127
IGMP and Multicast groups 8192/512 0/16
QoS Access Control Entries 3072 68
Security Access Control Entries 3072 1648 <--------
Netflow ACEs 1024 15
Input Microflow policer ACEs 256 7
Output Microflow policer ACEs 256 7
Flow SPAN ACEs 256 13
Control Plane Entries 512 195
Policy Based Routing ACEs 1024 9
Tunnels 256 12
Input Security Associations 256 4
Output Security Associations and Policies 256 9
SGT_DGT 4096/512 0/0
CLIENT_LE 4096/64 0/0
INPUT_GROUP_LE 6144 0
OUTPUT_GROUP_LE 6144 0
http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3850-series-switches/I118957-troubleshoot-sec-acl-tcam-cat3850.html
I didn't find any information regarding the time that the switch will take to program the hardware when adding/removing ACEs from an ACL with a specific number of ACEs. However, logic dictates that it will take longer if the ACL have a big number of ACEs.
I hope that the information above results helpful to address your concerns.
08-12-2018 11:19 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide