Cisco ACL performance question?

Question

We have ASR1006 Router and we are running ACL on it to allow specific port to specific server.

Question is there any ACL performance impact on individual IP vs full subnet. like following example.

we have 202.100.100.0/24 subnet now i want to use first 200 IPs for web server port 80 remaining 55 (whatever) mail service port 25.

Now how do i tell ACL to isolate them or subnet them? Other option i have i create individual ACL for each IP like following but question is does it impact on router performance?

access-list 102 permit tcp any host 202.100.100.1 eq www
access-list 102 permit tcp any host 202.100.100.2 eq www
access-list 102 permit tcp any host 202.100.100.3 eq www
access-list 102 permit tcp any host 202.100.100.4 eq www
...
...
access-list 102 permit tcp any host 202.100.100.201 eq smtp
access-list 102 permit tcp any host 202.100.100.202 eq smtp

is there any performance impact on individual ACL vs /24 full subnet?

Answer 1

You always can use wildcards to create your access list, i think with that, you will reduce the matching process of the router

The ACL of your example will result like this:

 access-list 102 permit tcp any 202.100.100.0 0.0.0.127 eq www
 access-list 102 permit tcp any 202.100.100.128 0.0.0.63 eq www
 access-list 102 permit tcp any 202.100.100.192 0.0.0.7 eq www
 access-list 102 permit tcp any 202.100.100.200 0.0.0.31 eq smtp
 access-list 102 permit tcp any 202.100.100.232 0.0.0.15 eq smtp
 access-list 102 permit tcp any 202.100.100.248 0.0.0.7 eq smtp