0

I have a cisco 4500x and n5k-5672up and in their datasheet mentioned that we can have "Security ACL Entries (1K=1024) 128K (64K ingress and 64K in egress) Shared with QoS" for 4500x and " Support for up to 4000 access control list (ACL) entries" for n5k-5672up so my question is that:

  1. I can have different acl names but totally they should have 128000 lines for 4500x or 4000 lines for n5k-5672 and I can assign the acls to unlimited SVIs or interfaces?
  2. for example "10 permit ip 192.168.10.5/32 any" count as 1 line and entries?

Thank you.

Improve this question
3
  • 1
    Yes, I would understand it like that as well. "128K" means 131,072 ACEs though, 65,536 for ingress and egress each. ;-)
    – Zac67 ♦
    Dec 14, 2021 at 7:41
  • so it's not important that how many ACL names do you have or you assigned them to how many interfaces or SVIs? the important thing is the number of entries/lines in each ACL , right?
    – Blackmetal
    Dec 14, 2021 at 7:43
  • 1
    Generally, yes. I'm not too familiar with those switches, so I was just commenting, not answering.
    – Zac67 ♦
    Dec 14, 2021 at 7:49

1 Answer 1

Reset to default
4

That's correct -- the ACL doesn't consume additional TCAM space as you apply it to more interfaces.

Improve this answer
4
  • each line count as 1 entery ? if I use /29 , /28 or .. in the line? in juniper if you use /29 it will use more tcam space.
    – Blackmetal
    Dec 14, 2021 at 10:26
  • @Blackmetal That's peculiar - could you provide a link to the docs?
    – Zac67 ♦
    Dec 14, 2021 at 10:54
  • kb.juniper.net/InfoCenter/…
    – Blackmetal
    Dec 14, 2021 at 11:03
  • @Blackmetal Can't find that information there, apart from using 10.0.0.0/24 and 10.0.1.0/24 separately instead of 10.0.0.0/23 aggregated consumes twice the TCAM amount.
    – Zac67 ♦
    Dec 14, 2021 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.