7Access Control List (ACL) VLAN Groups andContent Addressable Memory (CAM)This chapter describes the access control list (ACL) VLAN group and content addressable memory (CAM) enhancements.Optimizing CAM Utilization During the Attachment of ACLs to VLANsThis functionality is supported on the Z9000 platform.You can enable and configure the ACL CAM optimization functionality to minimize the number of entries in CAM while ACLs areapplied on a VLAN or a set of VLANs, and also while ACLs are applied on a set of ports. This capability enables the effective usage ofthe CAM space when Layer 3 ACLs are applied to a set of VLANs and when Layer 2 or Layer 3 ACLs are applied on a set of ports.In releases of Dell Networking OS that do not support the CAM optimization functionality, when an ACL is applied on a VLAN, theACL rules are configured with the rule-specific parameters and the VLAN as additional attributes in the ACL region. When the ACL isapplied on multiple VLAN interfaces, the consumption of the CAM space increases proportionally. For example, when an ACL with ‘n’number of rules is applied on ‘m’ number of VLAN interfaces, a total of n*m entries are configured in the CAM region that isallocated for ACLs. Similarly, when an L2 or L3 ACL is applied on a set of ports, a large portion of the CAM space gets used becausea port is saved as a parameter in CAM.To avoid excessive consumption of the CAM space, configure ACL VLAN groups, which combine all the VLANs that are applied withthe same ACL, into a single group. A class identifier (Class ID) is assigned for each of the ACLs attached to the VLAN and this ClassID is used as an identifier or locator in the CAM space instead of the VLAN ID. This method of processing reduces the number ofentries in the CAM area significantly and saves memory space by using the class ID as a filtering criterion in CAM instead of theVLAN ID.You can create an ACL VLAN group and attach the ACL with the VLAN members. The optimization is applicable only when youcreate an ACL VLAN group. If you apply an ACL separately on the VLAN interface, each ACL has a mapping with the VLAN andincreased CAM space utilization occurs. Attaching an ACL individually to VLAN interfaces is similar to the behavior of ACL-VLANmapping storage in CAM prior to the implementation of the ACL VLAN group functionality.The ACL manager application on router processor (RP1) contains all the state information about all the ACL VLAN groups that arepresent. The ACL handler on control processor (CP) and the ACL agent on line cards do not contain any stateful information aboutthe group. The ACL manager application performs the validation after you enter the acl-vlan-group command. If the commandis valid, it is processed and sent to the agent, if required. If a configuration error is found or if the maximum limit has exceeded for theACL VLAN groups present on the system, an appropriate error message is displayed. The ACL manager application verifies thefollowing parameters when you enter the acl-vlan-group command:• Whether the CAM profile is set in VFP• Whether the maximum number of groups in the system has exceeded• Whether the maximum number of VLAN numbers permitted per ACL group has exceeded• When a VLAN member that is being added is already a part of another ACL groupAfter these verification steps are performed, the ACL manager considers the command as valid and sends the information to theACL agent on the line card. The ACL manager notifies the ACL agent in the following cases:• A VLAN member is added or removed from a group, and previously associated VLANs exist in the group.114 Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)
