Example of Commands Execution
Configure the test DHCP pool and specify the following for a DHCP client: test.ru—domain
name, 192.168.45.1—default gateway, and 192.168.45.112—DNS server.
console#
console# configure
console(config)# ip dhcp pool network test
console(config-dhcp)# address 192.168.45.0 255.255.255.0
console(config-dhcp)# domain-name test.ru
console(config-dhcp)# dns-server 192.168.45.112
console(config-dhcp)# default-router 192.168.45.1
5.31 ACL Configuration (Access Control Lists)
ACL (Access Control List) is a table which defines filtration rules for incoming traffic based on IP and
MAC addresses sent in packets of protocols and TCP/UPD ports.
In order to implement the ACL function, the switch uses TCAM (Ternary Content Addressable
Memory) system resources. This resource is used for implementation of other device functions, for
example Selective Q-in-Q. Given that TCAM life span is limited, there are two modes of its utilization for
various circumstances. These modes are named ACL-only and ACL & SQinQ.
In ACL-only mode, the entire TCAM resource is dedicated to the ACL service. It allows the device
user to create the maximum number of rules for access control lists. Moreover, this mode allows to group
the identical rules, if they are applied to all the switch ports. It allows to greatly reduce the consumption
of TCAM resources.
To manage ACL rules in the ACL-only mode, additional parameter is used—the 'profile'. For each
port, there are 3 profiles available—0, 1, and 2. You can assign access lists to these profiles. During the
analysis, the traffic continuously checked for conformance to the access control list rules in the order
determined by the profile number. First of all, profile 0 rules are checked, then the profile 1 and lastly the
profile 2.
In order to preserve TCAM resources, general rules for all ports should be grouped in one of the
profiles.
The ACL-only mode limitation is the inability to use Selective Q-in-Q and MAC-based VLAN
functions.
The ACL & SQinQ mode enables simultaneous TCAM resource utilization by multiple services. TCAM
distribution across the services is performed automatically.
To estimate TCAM utilization, use the 'show system resources tcam' command.