54-11
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 54 Configuring Network Security with ACLs
Layer 4 Operators in ACLs
Note The IPv6 compressed flow label format uses the Layer 2 Address Table to compress a portion of the IPv6
source address of each ACE in the ACL. The extra space freed in the flow label can then be used to
support more Layer 4 operations. For this compression to be used, the IPv6 ACL cannot contain any
ACEs that mask in only a portion of the bottom 48 bits of the source IPv6 address.
Generally, you will receive at most the following number of Layer 4 operations on the same ACL:
Direction Protocol Type Operations
------------------------------------------------
Input IPv4 Security 16
Input IPv6 Compressed Security 16
Input IPv6 Uncompressed Security 7
Input IPv4 QoS 5
Input IPv6 Compressed QoS 12
Input IPv6 Uncompressed QoS 8
Output IPv4 Security 17
Output IPv6 Compressed Security 17
Output IPv6 Uncompressed Security 8
Output IPv4 QoS 5
Output IPv6 Compressed QoS 12
Output IPv6 Uncompressed QoS 8
Note Where up to 16 operations are supported, the seventeenth will trigger an expansion.
If you exceed the number of available Layer 4 operations, each new operation might cause the affected
ACE to be translated into multiple ACEs in the hardware. If this translation fails, packets are sent to the
CPU for software processing.
Configuration Guidelines for Layer 4 Operations
When using Layer 4 operators, consider these guidelines:
• Layer 4 operations are considered different if the operator or operand differ. For example, the
following ACL contains three different Layer 4 operations because gt 10 and gt 11 are considered
two different Layer 4 operations:
... gt 10 permit
... lt 9 deny
... gt 11 deny
Note The eq operator can be used an unlimited number of times because eq does not use a Layer 4
operation in hardware.
• Layer 4 operations are considered different if the same operator/operand couple applies once to a
source port and once to a destination port, as in the following example:
... Src gt 10....
... Dst gt 10
To Next Page
Loading...
