I have a N3K-C3064PQ-10GX and i have 2x 10g LACP uplink from my upstream and i have 2x 10G LACP downlink to my access switch, and i have 2x acl , one of them has been applied on UPLINK input and one of them has been applied to downlink input and every access list has around 30-50 lines for control packets, because i need to drop the specific traffic to some prefixes and both of them end line has permit IP any any , so i read 3064 datasheet and it shows its supporting 2k ingress and 1k egress acl, and i have around 15g bps and 4-5m pps on my network, so i want to make sure am i safe to continue using acl ? i do not need worry about cpu usages? because iread other questions and it seems i should check buffer instead of cpu, thanks,
ACLs are generally implemented using a TCAM device (ternary content-addressable memory) where all entries are checked simultaneously in real time and at wire speed. On some devices, activating an ACL on a port has a minute impact on the port's latency, but the number of ACL entries/lines doesn't matter.
The physically limited TCAM size is the reason for the hard limit of ACL entries that can be checked. The CPU is only used when you log (denied) hits, so the CPU load depends on the logging frequency.