47-8
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs
TCAM Programming and ACLs for Supervisor Engine II-Plus, Supervisor Engine IV, Supervisor Engine V, and Supervisor
For Supervisor Engines II-Plus-TS, IV, V, and the Catalyst 4948 switch running the Cisco IOS software
prior to Release 12.2(31)SGA, ACLs are not automatically optimized before the TCAM is programmed.
Grouping ACEs with similar masks prior to configuring the ACL may improve mask utilization.
Note After upgrading to Cisco IOS Release 12.2(31)SGA or later on Supervisor Engines II-Plus-TS, IV, V,
and the Catalyst 4948 switch, TCAM ACL utilization may decrease because of independent ACE
reordering. Conversely, downgrading to Cisco IOS Release 12.2(31)SG or earlier may cause TCAM
utilization to increase.
TCAM Programming Algorithms
Note The TCAM programming algorithm is neither available on Supervisor Engine 6-E nor 6L-E.
Beginning with Cisco IOS Release 12.2(25)EWA, two TCAM programming algorithms are supported
on Catalyst 4500 and 4900 series switches: packed and scattered. The packed mode algorithm programs
the entries in the same 8-entry TCAM block if the entries’ masks match. If the current entry’ mask differs
from previous entries, the switch software programs the entry in a new 8-entry block. If the mask does
not change, or if the mask changes every eight entries across ACLs from the beginning to the end of the
configuration, the TCAM may be fully utilized in packed mode for Supervisor Engines II-Plus-TS, IV,
V, and the Catalyst 4948 series switch.
In scattered mode, the entries from a single ACL are distributed across different 8-entry blocks until the
ACL is fully programmed. If successive ACLs have the same mask pattern as the first ACL, the TCAM
on Supervisor Engines II-Plus-TS, IV, V, and the Catalyst 4948 series switch may be fully utilized.
Scattered mode is recommended for IP Source Guard configurations on Supervisor Engines II-Plus-TS,
IV, V, and the Catalyst 4948 switch. it is because the mask pattern for per-VLAN ACLs is the same for
all ports configured for IP Source Guard: permit ARP packets, permit Layer 2 traffic if port security is
not configured, permit IP traffic from a particular source IP address with a 32-bit mask, deny unknown,
and permit all.
Note The TCAM programming algorithm can be configured on Supervisor Engine V-10GE and the Catalyst
4948-10GE switch running Cisco IOS Release 12.2(25)EWA or its subsequent maintenance releases. On
Supervisor Engine V-10GE and the Catalyst 4948-10GE switch, however, because ACL masks are not
shared among ACEs, TCAM utilization is the same for all configured programming algorithms.
Note The TCAM programming algorithm cannot be configured on Supervisor Engines II-Plus-10GE or
V-10GE or the Catalyst 4948-10GE switch running Cisco IOS Release 12.2(25)SG and later.
Note The TCAM utilization should not change after you successively configure the same TCAM
programming algorithm. For example, configuring access list hardware entries packed twice should not
affect TCAM utilization. However, TCAM utilization may change if one or more commands are entered
between successive configurations of the same TCAM programming algorithm.