Access Control List (Acl) Vlan Groups And Content Addressable Memory (Cam); Optimizing Cam Utilization During The Attachment Of Acls To Vlans - Dell S4048–ON Configuration Manual

Access Control List (ACL) VLAN Groups and
Content Addressable Memory (CAM)
This chapter describes the access control list (ACL) virtual local area network (VLAN) group and content addressable memory
(CAM) enhancements.

Optimizing CAM Utilization During the Attachment of ACLs to VLANs

To minimize the number of entries in CAM, enable and configure the ACL CAM feature. Use this feature when you apply ACLs to a
VLAN (or a set of VLANs) and when you apply ACLs to a set of ports. The ACL CAM feature allows you to effectively use the Layer
3 CAM space with VLANs and Layer 2 and Layer 3 CAM space with ports.
To avoid using too much CAM space, configure ACL VLAN groups into a single group. A class identifier (Class ID) is assigned for
each of the ACLs attached to the VLAN and this Class ID is used as an identifier or locator in the CAM space instead of the VLAN
ID. This method of processing reduces the number of entries in the CAM area and saves memory space by using the Class ID for
filtering in CAM instead of the VLAN ID.
When you apply an ACL separately on the VLAN interface, each ACL has a mapping with the VLAN and you use more CAM space.
To maximize CAM space, create an ACL VLAN group and attach the ACL with the VLAN members.
The ACL manager application on the router processor (RP1) contains all the state information about all the ACL VLAN groups that
are present. The ACL handler on the control processor (CP) and the ACL agent on the line cards do not contain any information
about the group. After you enter the acl-vlan-group command, the ACL manager application performs the validation. If the
command is valid, it is processed and sent to the agent, if required. If a configuration error is found or if the maximum limit has
exceeded for the ACL VLAN groups present on the system, an error message displays. After you enter the acl-vlan-group
command, the ACL manager application verifies the following parameters:
• Whether the CAM profile is set in virtual flow processing (VFP).
• Whether the maximum number of groups in the system is exceeded.
• Whether the maximum number of VLAN numbers permitted per ACL group is exceeded.
• When a VLAN member that is being added is already a part of another ACL group.
After these verification steps are performed, the ACL manager considers the command valid and sends the information to the ACL
agent on the line card. The ACL manager notifies the ACL agent in the following cases:
• A VLAN member is added or removed from a group and previously associated VLANs exist in the group.
• The egress ACL is applied or removed from the group and the group contains VLAN members.
• VLAN members are added or deleted from a VLAN, which itself is a group member.
• A line card returns to the active state after going down and this line card contains a VLAN that is a member of an ACL group.
• The ACL VLAN group is deleted and it contains VLAN members.
The ACL manager does not notify the ACL agent in the following cases:
• The ACL VLAN group is created.
• The ACL VLAN group is deleted and it does not contain VLAN members.
• The ACL is applied or removed from a group and the ACL group does not contain a VLAN member.
106

Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)

7