Nokia 7210 SAS-M - Page 315

7210 SAS-M, T, R6, R12, Mxp, Sx, S Basic System
Configuration Guide
System Management
Edition: 01 3HE 16132 AAAB TQZZA 315
• The system fails a user attempt to use SAP ingress ACLs with IPv6 match
criteria (and other combinations listed in the preceding list items), because the
user has disabled these criteria.
Example 2:
config> system> resource-profile>
...
acl-sap-ingress 3
mac-match-enable max
ipv4-match-enable 1
no ipv6_128-ipv4-match-enable
ipv6_64-only-match-enable max
exit
...
In the preceding CLI example, the system performs the following actions.
• 3 chunks are allocated for use by the SAP ingress ACL entries. These resources
are available for use with mac-criteria, ipv4-criteria and ipv6-64-bit match
criteria.
• 1 chunk is allocated for use by SAP ingress ACL entries that use ipv4-criteria.
The system fails the configuration if the number of ACL entries using ipv4-
criteria exceeds the configured limit (that is, the system does not allocate more
than the configured limit of 1 chunk).
• 1 chunk is allocated for use by SAP ingress ACL entries that use mac-criteria
when the user associates an ingress ACL policy (with mac-criteria entries
defined) with a SAP. Because the max keyword is used, the system can allocate
more chunks, if a chunk is available for use.
In this example, (assuming a SAP with an ingress ACL policy that uses ipv6-64-
bit criteria is configured), as no additional chunks are available, mac-criteria
cannot allocate more than 1 chunk (even if the max keyword is specified). The
system fails the configuration if the number of ACL entries with mac-criteria
exceeds the limit of 1 chunk allocated to SAP ingress ACL mac-criteria (that is,
the system does not allocate more than the configured limit of 3 chunks = 1 for
mac-criteria + for ipv4-criteria + 1 for ipv6-criteria).
• A chunk is allocated for use by SAP ingress ACL entries that use ipv6-64-bit
criteria when the user associates an ingress ACL policy (with ipv6-64-bit-criteria
entries defined) with a SAP. Because the max keyword is specified, the system
can allocate more chunks, if a chunk is available for use.
In this example, as there are no more chunks available, ipv6-64-bit criteria
cannot allocate more than 1 chunk (even if the max keyword is specified). The
system fails the configuration when the number of ACL entries with ipv6-64-bit
criteria exceeds the limit of one chunk allocated to SAP ingress ACL match (that
is, the system does not allocate more than the configured limit of 3 chunks = 1
for mac-criteria + 1 for ipv4-criteria + 1 for ipv6-64-bit criteria).