47-19
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs Layer 4 Operators in ACLs
• For some packets, when the hardware runs out of resources, the software must perform the ACL
matches:
–
For Supervisor Engine 2-Plus to V-10GE, the TCP flag combinations rst ack and syn fin rst are
processed in hardware. rst ack is equivalent to the keyword established. Other TCP flag
combinations are supported in software.
–
For Supervisor Engine 6-E and 6L-E, the TCP flag combinations rst ack, syn fin rst, urg and psh
are processed in hardware. rst ack is equivalent to the keyword established. Other TCP flag
combinations are supported in software.
–
For Supervisor Engine 2-Plus to V-10GE, you can specify up to six Layer 4 operations (lt, gt,
neq, and range) in an ACL to ensure that all operations are processed in hardware. More than
six Layer 4 operations trigger an attempt to translate the excess operations into multiple ACEs
in hardware. If this attempt fails, packets are processed in software. The translation process is
less likely to succeed on large ACLs with a great number of Layer 4 operations, and on switches
with large numbers of ACLs configured. The precise limit depends on how many other ACLs
are configured and which specific Layer 4 operations are used by the ACLs being translated.
The eq operator does not require any Layer 4 operations and can be used any number of times.
–
For Supervisor Engine and 6L-E, refer to the “Restrictions for Layer 4 Operations” section on
page 47-16.
–
If the total number of Layer 4 operations in an ACL is less than six, you can distribute the
operations in any way you choose.
Examples
The following access lists are processed completely in hardware:
access-list 104 permit tcp any any established
access-list 105 permit tcp any any rst ack
access-list 107 permit tcp any synfin rst
Access lists 104 and 105 are identical; established is shorthand for rst and ack.
Access list 101, is processed completely in software:
access-list 101 permit tcp any any syn
Because four source and two destination operations exist, access list 106 is processed in
hardware:
access-list 106 permit tcp any range 100 120 any range 120 140
access-list 106 permit tcp any range 140 160 any range 180 200
access-list 106 permit tcp any range 200 220
access-list 106 deny tcp any range 220 240
In the following code, the Layer 4 operations for the third ACE trigger an attempt to translate
dst lt 1023 into multiple ACEs in hardware, because three source and three destination
operations exist. If the translation attempt fails, the third ACE is processed in software.
access-list 102 permit tcp any lt 80 any gt 100
access-list 102 permit tcp any range 100 120 any range 120 1024
access-list 102 permit tcp any gt 1024 any lt 1023
Similarly, for access list 103, the third ACE triggers an attempt to translate dst gt 1023 into
multiple ACEs in hardware. If the attempt fails, the third ACE is processed in software.
Although the operations for source and destination ports look similar, they are considered
different Layer 4 operations.
access-list 103 permit tcp any lt 80 any lt 80
access-list 103 permit tcp any range 100 120 any range 100 120