Cisco N3K-C3064 RACL question

Question

I have a cisco nexus n3k-c3064pq-10gx and i want to have an acl and add 270x line (they will drop my interface vlan IP address because they are public IP), I want to know can I have this acl with 270x line of acl ?

here is my TCAM output :

INSTANCE 0x0
-------------

Ingress IPv4 PACL                        : 18 valid entries   363 free entries
Ingress IPv4 VACL                        : 0 valid entries   510 free entries
N3k Ingress IPv4 RACL                    : 20 valid entries   216 free entries
Ingress IPv4 PBR                         : 34 valid entries   221 free entries
Egress IPv4 VACL                         : 0 valid entries   509 free entries
Egress IPv4 RACL                         : 0 valid entries   509 free entries
N3K SUP                                  : 51 valid entries   14 free entries
N3K IPV6 SUP                             : 7 valid entries   247 free entries
Ingress IPv4 QoS                         : 4 valid entries   252 free entries
N3K SPAN                                 : 0 valid entries   114 free entries
N3K SPAN                                 : 7 used entries    121 free entries
NAT Rewrite Table                        : 0 valid entries   2048 free entries

here is sample of my acl :

show ip access-lists test

IP access list test
        10 permit ip any 192.168.2.1/32
        20 permit ip any 192.168.3.2/32
        30 permit ip any 192.167.4.1/32
        40 deny ip any 192.168.20.1/32
        50 deny ip any 192.168.80.1/32

which parameter show how many free acl do I have? and if its small how can increase that?

Thank you.

Answer 1

No, you don't have enough room for 270 more Ingress Router ACL entries (216 free). Here is a Cisco document explaining the different ACL types on Nexus 3000.

It looks like you're trying to reproduce the functionality of control-plane filters using older methodology. Do you know about control-plane filtering? If not, learning that concept will help you immensely. If you do already understand that it is an available feature, I suggest you read the N3K Security Configuration Guide section on Configuring Control Plane Policing and determine what traffic you do want to admit to the switch control plane.