Cisco Catalyst 3750-X User Manual

37-23
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-21521-01
Chapter 37 Configuring Network Security with ACLs
Configuring IPv4 ACLs
Use one of these workarounds:
• Modify the ACL configuration to use fewer resources.
• Rename the ACL with a name or number that alphanumerically precedes the ACL names or
numbers.
To determine the specialized har
dware resources, enter the show platform layer4 acl map privileged
EXEC command. If the switch does not have available resources, the output shows that index 0 to
index 15 are not available.
For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug
To
olkit.
For example, if you apply this ACL to an interface:
permit tcp source source-wildcard destination destination-wildcard range 5 60
permit tcp source source-wildcard destination destination-
wildcard range 15 160
permit tcp source source-wildcard destination destination-
wildcard range 115 1660
permit tcp source source-wildcard destination destination-
wildcard
And if this message appears:
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The flag-related operators are not available. To avoid this issue,
• Move the fourth ACE before the first ACE by using ip access-list resequence global configuration
command:
permit tcp source source-wildcard destination destination-wildcard
permit tcp source source-wildcard destination destination-
wildcard range 5 60
permit tcp source source-wildcard destination destination-
wildcard range 15 160
permit tcp source source-wildcard destination destination-
wildcard range 115 1660
or
• Rename the ACL with a name or number that alphanumerically precedes the other ACLs (for
example, rename ACL 79 to ACL 1).
You can now apply the first ACE in the ACL to the interface. The switch allocates the ACE to available
mapp
ing bits in the Opselect index and then allocates flag-related operators to use the same bits in the
hardware memory.
IPv4 ACL Configuration Examples
This section provides examples of configuring and applying IPv4 ACLs. For detailed information about
compiling ACLs, see the Cisco IOS Security Configuration Guide, Release 12.2 and to the Configuring
IP Services” section in the “IP Addressing and Services” chapter of the Cisco IOS IP Configuration
Guide, Release 12.2.
• ACLs in a Small Networked Office, page 37-24
• Numbered ACLs, page 37-25
• Extended ACLs, page 37-25
• Named ACLs, page 37-26
• Time Range Applied to an IP ACL, page 37-26
• Commented IP ACL Entries, page 37-26
• ACL Logging, page 37-27

Cisco Catalyst 3750-X Specifications

General

Brand	Cisco
Model	Catalyst 3750-X
Category	Switch
Language	English