Cisco WS-X6066-SLB-APC - Content Switching Module Software Manual page 314

Using VACLs with Cisco IOS ACLs
******** IOS ACL ************
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE **********
has 91 entries entries
Example 2
In Example
following equivalent ACL with improved merge results (note that a deny ACE is not specified):
******** VACL
1 permit udp host 194.72.72.33 194.72.6.160 0.0.0.15
2 permit udp host 147.150.213.94 194.72.6.64 0.0.0.15 eq bootps
3 permit udp 194.73.74.0 0.0.0.255 host 194.72.6.205 eq syslog
4 permit udp host 167.221.23.1 host 194.72.6.198 eq tacacs
5 permit udp 194.72.136.1 0.0.3.128 194.72.6.64 0.0.0.15 eq tftp
6 permit udp host 193.6.65.17 host 194.72.6.205 gt 1023
7 permit tcp any host 194.72.6.52
8 permit tcp any host 194.72.6.52 eq 113
9 permit tcp any host 194.72.6.51 eq ftp-data
10 permit tcp any host 194.72.6.51 neq ftp
11 permit tcp any eq domain host 194.72.6.51 neq ftp
12 permit tcp any host 194.72.6.51 gt 1023
13 permit ip
******** IOS ACL ************
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE ***********
has 78 entries
Example 3
This example shows the VACL does not follow the recommended guidelines, and the resultant merge
significantly increases the number of ACEs:
******** VACL
1 deny ip 0.0.0.0 255.255.255.0 any
2 deny ip 0.0.0.255 255.255.255.0 any
3 deny ip any 0.0.0.0 255.255.255.0
4 permit ip any host 239.255.255.255
5 permit ip any host 255.255.255.255
6 deny ip any 0.0.0.255 255.255.255.0
7 permit tcp any range 0 65534 any range 0 65534
8 permit udp any range 0 65534 any range 0 65534
9 permit icmp any any
10 permit ip any any
******** IOS ACL **********
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE **********
has 329 entries
Example 4
This example shows that the VACL does not follow the recommended guidelines (three different actions
are specified), and the resultant merge significantly increases the number of ACEs:
******** VACL
1 redirect 4/25 tcp host 192.168.1.67 host 255.255.255.255
2 redirect 4/25 udp host 192.168.1.67 host 255.255.255.255
3 deny tcp any any lt 30
4 deny udp any any lt 30
5 permit ip any any
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
16-18
1, if you follow the guidelines and remove line 9 and modify lines 11 and 12, you get the
**********
any host 1.1.1.1
***********
***********
Chapter 16 Configuring Access Control
78-13315-02