47-7
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs
TCAM Programming and ACLs for Supervisor Engine II-Plus, Supervisor Engine IV, Supervisor Engine V, and
TCAM Programming and ACLs for Supervisor Engine II-Plus, Supervisor Engine IV, Supervisor Engine V, and Supervisor Engine V-10GE
TCAM entry and mask utilization on the Catalyst 4500 series switch is based on the following elements:
• ACL configuration
• Supervisor engine model
• Cisco IOS software release
For Supervisor Engine II-Plus-10GE, Supervisor Engine V-10GE, and the Catalyst 4948-10GE switch,
the entry and mask utilization equals the number of ACEs in the ACL configuration divided by the
number of entries in the TCAM region, regardless of the Cisco IOS software release. Optimzed TCAM
utilization is not required.
For Supervisor Engine II-Plus-TS, Supervisor Engines IV, Supervisor Engines V, and the Catalyst 4948
switch, up to eight entries share a single mask in the TCAM regardless of the Cisco IOS software release.
TCAM utilization depends on the ACL configuration. It also depends on the order of configuring each
ACL; TCAM utilization may differ if one ACL is configured before another and vice versa. Copying the
same ACL configuration to the running-config may also cause TCAM utilization to change.
Note When an interface is in down state, TCAMs are not consumed for RACLs, but are for PACLs.
Depending on the ACL configuration and the Cisco IOS software release, you can optimize TCAM
utilization on the Catalyst 4948 switch and on Supervisor Engines II-Plus-TS, IV, and V. For instance,
Cisco IOS Release 12.2(31)SGA and later releases preserve masks by automatically reordering
order-independent ACL entries. Two ACEs are order-independent if a single packet can match only one
of them. For example, the following two ACEs are order-independent:
permit ip host 10.1.1.10 any
permit ip host 10.1.1.20 any
Any packet that would match the first ACE would not match the second, and vice versa. In contrast, the
following two ACEs are not order-independent:
permit ip host 10.1.1.10 any
permit ip any host 10.1.1.20
A packet with source IP address 10.1.1.10 and destination IP address 10.1.1.20 would be able to match
both ACEs, so their order matters.
When estimating TCAM utilization for Supervisor Engines II-Plus-TS, IV, V, and the Catalyst 4948
switch prior to deployment, start with the default configuration. Because of the dynamic nature of
programming ACEs that share masks, estimating TCAM utilization is unpredictable when ACLs are
already programmed.
Beginning with Cisco IOS Release 12.2(31)SGA, you can estimate TCAM utilization for an IP ACL if
the TCAM is empty. For each IP ACL, four ACEs are added automatically to the ACL: two static ACEs,
an appended IP deny-all ACE, and an appended permit-all ACE. The minimum number of masks for an
IP ACL is five. To find the number of masks utilized by the remaining ACEs, count the number of
different masks, adding one for every different mask with more than eight ACEs.