Cisco Systems 4500 Configuration Guidelines for Layer 4 Operations

47-17
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs Layer 4 Operators in ACLs
• gt (greater than)
• lt (less than)
• neq (not equal)
• range (inclusive range)
For Supervisor Engine II+ through V-10GE, you should not specify more than six different operations
on the same ACL. If you exceed this number, each new operation might cause the affected ACE (access
control entry) to be translated into multiple ACEs in hardware. If you exceed this number, the affected
ACE might be processed in software.
For Supervisor Engine 6-E and 6L-E, the limits on the number of Layer 4 operations differ for each type
of ACL, and can also vary based on other factors: whether an ACL is applied to incoming or outgoing
traffic, whether the ACL is a security ACL or is used as a match condition for a QoS policy, and whether
IPv6 ACLs are being programmed using the compressed flow label format.
Note The IPv6 compressed flow label format uses the Layer 2 Address Table to compress a portion of the IPv6
source address of each ACE in the ACL. The extra space freed in the flow label can then be used to
support more Layer 4 operations. For this compression to be used, the IPv6 ACL cannot contain any
ACEs that mask in only a portion of the bottom 48 bits of the source IPv6 address.
Generally, you will receive at most the following number of Layer 4 operations on the same ACL:
Direction Protocol Type Operations
------------------------------------------------
Input IPv4 Security 16
Input IPv6 Compressed Security 16
Input IPv6 Uncompressed Security 7
Input IPv4 QoS 5
Input IPv6 Compressed QoS 12
Input IPv6 Uncompressed QoS 8
Output IPv4 Security 17
Output IPv6 Compressed Security 17
Output IPv6 Uncompressed Security 8
Output IPv4 QoS 5
Output IPv6 Compressed QoS 12
Output IPv6 Uncompressed QoS 8
Note Where up to 16 operations are supported, the seventeenth will trigger an expansion.
If you exceed the number of available Layer 4 operations, each new operation might cause the affected
ACE to be translated into multiple ACEs in the hardware. If this translation fails, packets are sent to the
CPU for software processing.
Configuration Guidelines for Layer 4 Operations
When using Layer 4 operators, consider these guidelines:
• Layer 4 operations are considered different if the operator or operand differ. For example, the
following ACL contains three different Layer 4 operations because gt 10 and gt 11 are considered
two different Layer 4 operations:
... gt 10 permit
... lt 9 deny
... gt 11 deny