I have a N3K-C3064PQ-10GX and i have 2x 10g LACP uplink from my upstream and i have 2x 10G LACP downlink to my access switch, and i have 2x acl , one of them has been applied on UPLINK input and one of them has been applied to downlink input and every access list has around 30-50 lines for control packets, because i need to drop the specific traffic to some prefixes and both of them end line has permit IP any any , so i read 3064 datasheet and it shows its supporting 2k ingress and 1k egress acl, and i have around 15g bps and 4-5m pps on my network, so i want to make sure am i safe to continue using acl ? i do not need worry about cpu usages? because iread other questions and it seems i should check buffer instead of cpu, thanks,

1 Answer 1


ACLs are generally implemented using a TCAM device (ternary content-addressable memory) where all entries are checked simultaneously in real time and at wire speed. On some devices, activating an ACL on a port has a minute impact on the port's latency, but the number of ACL entries/lines doesn't matter.

The physically limited TCAM size is the reason for the hard limit of ACL entries that can be checked. The CPU is only used when you log (denied) hits, so the CPU load depends on the logging frequency.

  • so number of lines is not important in acl and if i do not use log for acl it will not impact on cpu, right?so i can safely use my acl without worry about performance?
    – Blackmetal
    Oct 14, 2020 at 9:37
  • @Blackmetal Just be aware that there is a limit to the max number of lines of Access-Control-Entries for each model. You can adjust the numbers within a range to meet your needs, within reason. You may only be able to have 300 lines total, for example, so you'd have to figure out how to get what you need out of that limitation.
    – Jesse P.
    Oct 14, 2020 at 16:37
  • For example, on Nexus 3K, the limit as of 5.0(3)U2(2) was 2,000 ingress, 1000 egress. So, out of all of the ACLs for all of your interfaces, you have to combine the ACE count to fit within those constraints. You can refer to cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/… for more details.
    – Jesse P.
    Oct 14, 2020 at 16:40
  • From their site: cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/… Because the software stops testing conditions after it encounters the first match (to either a permit or deny statement), you will reduce processing time and resources if you put the statements that packets are most likely to match at the beginning of the access list. Place more frequently occurring conditions before less frequent conditions. I've always been told to leave large rules at the top, like permit tcp any any established for example
    – Josh Jobin
    Oct 14, 2020 at 19:08
  • @JoshJobin ACL rules are checked on a first-match base - the first entry from the top that matches a packet is the one used. (You likely know but the casual reader might not.)
    – Zac67
    Oct 14, 2020 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.