3

I have a cisco nexus n3k-c3064pq-10gx and i want to have an acl and add 270x line (they will drop my interface vlan IP address because they are public IP), I want to know can I have this acl with 270x line of acl ?

here is my TCAM output :

INSTANCE 0x0
-------------

Ingress IPv4 PACL                        : 18 valid entries   363 free entries
Ingress IPv4 VACL                        : 0 valid entries   510 free entries
N3k Ingress IPv4 RACL                    : 20 valid entries   216 free entries
Ingress IPv4 PBR                         : 34 valid entries   221 free entries
Egress IPv4 VACL                         : 0 valid entries   509 free entries
Egress IPv4 RACL                         : 0 valid entries   509 free entries
N3K SUP                                  : 51 valid entries   14 free entries
N3K IPV6 SUP                             : 7 valid entries   247 free entries
Ingress IPv4 QoS                         : 4 valid entries   252 free entries
N3K SPAN                                 : 0 valid entries   114 free entries
N3K SPAN                                 : 7 used entries    121 free entries
NAT Rewrite Table                        : 0 valid entries   2048 free entries

here is sample of my acl :

show ip access-lists test

IP access list test
        10 permit ip any 192.168.2.1/32
        20 permit ip any 192.168.3.2/32
        30 permit ip any 192.167.4.1/32
        40 deny ip any 192.168.20.1/32
        50 deny ip any 192.168.80.1/32

which parameter show how many free acl do I have? and if its small how can increase that?

Thank you.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 23, 2021 at 20:57

1 Answer 1

Reset to default
3

No, you don't have enough room for 270 more Ingress Router ACL entries (216 free). Here is a Cisco document explaining the different ACL types on Nexus 3000.

It looks like you're trying to reproduce the functionality of control-plane filters using older methodology. Do you know about control-plane filtering? If not, learning that concept will help you immensely. If you do already understand that it is an available feature, I suggest you read the N3K Security Configuration Guide section on Configuring Control Plane Policing and determine what traffic you do want to admit to the switch control plane.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.