Cisco WS-C6506 Software Manual page 418

Using VACLs with Cisco IOS ACLs
With software release 8.1(1) and later releases, the BDD algorithm is no longer supported on any
Note
platform (PFC, PFC2, or PFC3A/PFC3B/PFC3BXL). The default ACL-merge algorithm is ODM. In
software release 8.1(1) and later releases, the following command changes appear: The set aclmerge
algo and set aclmerge bdd commands have been removed. The show aclmerge {bdd | algo} command
has been reduced to show aclmerge algo.
Examples
These examples show the merge results for the various Cisco IOS ACL and VACL configurations. One
VACL and one Cisco IOS ACL are configured on the same VLAN.
Example 1
******** VACL
1
2
3
4
5
6
7
8
9
10 permit tcp any host 194.72.6.51 eq ftp-data
11 permit tcp any host 194.72.6.51
12 permit tcp any eq domain host 194.72.6.51
13 permit tcp any host 194.72.6.51 gt 1023
14 permit ip
******** Cisco IOS ACL ************
1
2
*******
Using the new algorithm - 17 entries
Using the old algorighm - 91 entries
Example 2
******** VACL
1
2
3
4
5
6
7
8
9
10 permit tcp any host 194.72.6.51 neq ftp
11 permit tcp any eq domain host 194.72.6.51 neq ftp
12 permit tcp any host 194.72.6.51 gt 1023
13 permit ip
******** Cisco IOS ACL ************
1
2
******** MERGE ***********
Using the new algorithm - 16 entries
Using the old algorithm - 78 entries
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
15-22
***********
permit udp host 194.72.72.33 194.72.6.160 0.0.0.15
permit udp host 147.150.213.94 194.72.6.64 0.0.0.15 eq bootps
permit udp 194.73.74.0 0.0.0.255 host 194.72.6.205 eq syslog
permit udp host 167.221.23.1 host 194.72.6.198 eq tacacs
permit udp 194.72.136.1 0.0.3.128 194.72.6.64 0.0.0.15 eq tftp
permit udp host 193.6.65.17 host 194.72.6.205 gt 1023
permit tcp any host 194.72.6.52
permit tcp any host 194.72.6.52 eq 113
deny tcp any host 194.72.6.51 eq ftp
any host 1.1.1.1
deny ip any host 239.255.255.255
permit ip any any
MERGE **********
**********
permit udp host 194.72.72.33 194.72.6.160 0.0.0.15
permit udp host 147.150.213.94 194.72.6.64 0.0.0.15 eq bootps
permit udp 194.73.74.0 0.0.0.255 host 194.72.6.205 eq syslog
permit udp host 167.221.23.1 host 194.72.6.198 eq tacacs
permit udp 194.72.136.1 0.0.3.128 194.72.6.64 0.0.0.15 eq tftp
permit udp host 193.6.65.17 host 194.72.6.205 gt 1023
permit tcp any host 194.72.6.52
permit tcp any host 194.72.6.52 eq 113
permit tcp any host 194.72.6.51 eq ftp-data
any host 1.1.1.1
deny ip any host 239.255.255.255
permit ip any any
Chapter 15 Configuring Access Control
OL-8978-04