We are an ISP and I would like to implement ACL to protect our core network (Infrastructure) and implement some filtering on public subnet inside.
As border device we have a cisco WS-C4500X-32 4500x in VSS Cluster.
The peak traffic on downstream is 3Gbps. I follow the guidelines and I've already define the ACL, just left implement them.
My doubt now is how will be the throughput performance, if it's expected some degradation or the cpu will rise. Will the device can handle such traffic amount with filtering ?
I don't have the experience to implement ACL on so high throughput device.
Sample of ACL :
ip access-list extended iACL permit ip any 22.214.171.124 0.0.7.255 permit ip any 126.96.36.199 0.0.15.255 permit ip any 10.10.0.0 0.0.15.255 permit ip any 188.8.131.52 0.0.3.255 ! External IP needing full access to our network permit ip 184.108.40.206 0.0.31.255 any permit ip 220.127.116.11 0.0.31.255 any permit ip 18.104.22.168 0.0.31.255 any permit ip 22.214.171.124 0.0.31.255 any deny ip any any
Device : cisco WS-C4500X-32 (MPC8572) processor (revision 4) with 4194304K/20480K bytes of memory. MPC8572 CPU at 1.5GHz, Cisco Catalyst 4500X
IOS : cat4500e-universalk9.SPA.03.04.00.SG.151-2.SG (ROM: 15.0(1r)SG6)