47-13
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs
TCAM Programming and ACLs for Supervisor Engine II-Plus, Supervisor Engine IV, Supervisor Engine V, and
Packets that match entries in partially programmed ACLs are processed in software using the CPU. This
may cause high CPU utilization and packets to be dropped. To determine whether packets are being
dropped due to high CPU utilization, reference the following:
http://www.cisco.com/en/US/products/hw/switches/ps663/products_tech_note09186a00804cef15.shtml
If the ACL and/or IPSG configuration is partially programmed in hardware, upgrading to
Cisco IOS Release 12.2(31)SGA or later and resizing the TCAM regions may enable the ACLs to be
fully programmed.
Note Removal of obsolete TCAM entries can take several CPU process review cycles to complete. This
process may cause some packets to be switched in software if the TCAM entry or mask utilization is at
or near 100 percent.
Selecting Mode of Capturing Control Packets
In some deployments, you might want to bridge control packets in hardware rather than globally capture
and forward them in software (at the expense of the CPU). The per-VLAN capture mode feature allows
a Catalyst 4500 series switch to capture control packets only on selected VLANs and bridge traffic in
hardware on all other VLANs.
With Supervisor Engine 6-E and 6L-E, when you use per-VLAN capture mode on your switch, it
partially disables the global TCAM capture entries internally and attaches feature-specific capture
ACLs on those VLANs that are enabled for snooping features. (All IP capture entries, and other
non-IP entries are still captured through global TCAM.)
For all other supervisor engines, when you use per-VLAN capture mode on your switch, it partially
disables the global TCAM capture entries internally and attaches feature-specific capture ACLs on
those VLANs that are enabled for snooping or routing features. (All IP capture entries, CGMP, and
other non-IP entries are still captured through global TCAM.)
Because this feature controls specific control packets, they are captured only on the VLANs on which
the internal ACLs are installed. On all other VLANs, the control traffic is bridged in hardware rather
than forwarded to CPU.
The per-VLAN capture mode allows you to apply user-defined ACLs and QoS policers (in hardware) on
control packets. You can also subject the aggregate control traffic ingressing the CPU to control plane
policing.
When you use per-VLAN capture mode, the following four protocol groups are selectable per-VLAN.
The breakdown of protocols intercepted by each group is as follows:
• IGMP Snooping—Cgmp, Ospf, Igmp, RipV2, Pim, 224.0.0.1, 224.0.0.2, 224.0.0.*
• DHCP Snooping—Client to Server, Server to Client, Server to Server
The following bullets only apply to supervisor engines other than 6-E and 6L-E.
• Unicast Routing—Ospf, Rip v2, 224.0.0.1, 224.0.0.2, 224.0.0.*
• Multicast Routing—Ospf, Rip v2, Igmp, Pim, 224.0.0.1, 224.0.0.2, 224.0.0.*
Because some of the groups have multiple overlapping ACEs (for example, 224.0.0.* is present in all the
groups except for DHCP Snooping), turning on a certain group will also trigger the interception of some
protocols from other groups.
Following are the programming triggers for the four protocol groups per-VLAN:
• IGMP Snooping should be enabled globally on a given VLAN.