Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists - Revision history

Kkroeber: /* Maximum Number of ACL Entries */

2011-09-20T15:03:30Z

Maximum Number of ACL Entries

← Older revision		Revision as of 15:03, 20 September 2011
Line 70:		Line 70:
	==== Maximum Number of ACL Entries ====		==== Maximum Number of ACL Entries ====

-	ACLs are used in ACE as conventional access-groups, and also for use in class-maps. The ACLs are converted into trees of different data structures called nodes, ~~and these~~ are merged into a single tree instance that consists of nodes of one type ~~which are~~ called Policy Action Nodes (PANs). This merged tree is then transferred to the dataplane. A tree is created for each instance, and an instance is defined as a ~~vlan~~ interface in either the input or output direction. Therefore all ACLs that are applied to a given ~~vlan~~ and a given direction contribute to the node usage for that instance.	+	ACLs are used in ACE as conventional access-groups, and also for use in class maps. The ACLs are converted into trees of different data structures called nodes, which are merged into a single tree instance that consists of nodes of one type called Policy Action Nodes (PANs). This merged tree is then transferred to the dataplane. A tree is created for each instance, and an instance is defined as a VLAN interface in either the input or output direction. Therefore, all ACLs that are applied to a given VLAN and a given direction contribute to the node usage for that instance.

	The ACE supports a maximum of 256,000 Policy Action Nodes (PANs) entries. Some ACLs use more memory than others, such as an ACL that uses large port number ranges or overlapping networks (for example, one entry specifies 10.0.0.0/8 and another entry specifies 10.1.1.0/24). Depending on the type of ACL, the actual limit that the ACE can support may be less than 256,000 PANs entries.		The ACE supports a maximum of 256,000 Policy Action Nodes (PANs) entries. Some ACLs use more memory than others, such as an ACL that uses large port number ranges or overlapping networks (for example, one entry specifies 10.0.0.0/8 and another entry specifies 10.1.1.0/24). Depending on the type of ACL, the actual limit that the ACE can support may be less than 256,000 PANs entries.

Nmicic at 14:09, 14 September 2011

2011-09-14T14:09:34Z

← Older revision		Revision as of 14:09, 14 September 2011
Line 70:		Line 70:
	==== Maximum Number of ACL Entries ====		==== Maximum Number of ACL Entries ====

-	The ACE supports a maximum of 256,000 ~~ACL~~ entries. Some ACLs use more memory than others, such as an ACL that uses large port number ranges or overlapping networks (for example, one entry specifies 10.0.0.0/8 and another entry specifies 10.1.1.0/24). Depending on the type of ACL, the actual limit that the ACE can support may be less than 256,000 entries.	+	ACLs are used in ACE as conventional access-groups, and also for use in class-maps. The ACLs are converted into trees of different data structures called nodes, and these are merged into a single tree instance that consists of nodes of one type which are called Policy Action Nodes (PANs). This merged tree is then transferred to the dataplane. A tree is created for each instance, and an instance is defined as a vlan interface in either the input or output direction. Therefore all ACLs that are applied to a given vlan and a given direction contribute to the node usage for that instance.
		+
		+	The ACE supports a maximum of 256,000 Policy Action Nodes (PANs) entries. Some ACLs use more memory than others, such as an ACL that uses large port number ranges or overlapping networks (for example, one entry specifies 10.0.0.0/8 and another entry specifies 10.1.1.0/24). Depending on the type of ACL, the actual limit that the ACE can support may be less than 256,000 PANs entries.

	If you use object groups in ACL entries, you enter fewer actual ACL entries, but the same number of expanded ACL entries as you did when you entered entries without object groups. Expanded ACL entries count toward the system limit. To view the number of expanded ACL entries in an ACL, use the '''show access-list name''' command.		If you use object groups in ACL entries, you enter fewer actual ACL entries, but the same number of expanded ACL entries as you did when you entered entries without object groups. Expanded ACL entries count toward the system limit. To view the number of expanded ACL entries in an ACL, use the '''show access-list name''' command.

Dakelley at 21:30, 11 March 2011

2011-03-11T21:30:40Z

← Older revision		Revision as of 21:30, 11 March 2011
Line 5:		Line 5:
	\|align="center"\|'''Guide Contents'''		\|align="center"\|'''Guide Contents'''
	\|-		\|-
-	\|[[Cisco Application Control Engine (ACE) Troubleshooting Guide\|Main Article]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Overview of ACE Troubleshooting\|Overview of ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Understanding the ACE Module Architecture and Traffic Flow\|Understanding the ACE Module Architecture and Traffic Flow]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Preliminary ACE Troubleshooting\|Preliminary ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Boot Issues\|Troubleshooting ACE Boot Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting with ACE Logging\|Troubleshooting with ACE Logging]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Connectivity\|Troubleshooting Connectivity]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Ethernet Ports\|Troubleshooting ACE Appliance Ethernet Ports]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Remote Access\|Troubleshooting Remote Access]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists\|Troubleshooting Access Control Lists]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Network Address Translation\|Troubleshooting Network Address Translation]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Health Monitoring\|Troubleshooting ACE Health Monitoring]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 4 Load Balancing\|Troubleshooting Layer 4 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 7 Load Balancing\|Troubleshooting Layer 7 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Redundancy\|Troubleshooting Redundancy]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting SSL\|Troubleshooting SSL]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Performance Issues\|Troubleshooting Performance Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- ACE Resource Limits\|ACE Resource Limits]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Managing Resources\|Managing ACE Resources]]<br>	+	\|[[Cisco Application Control Engine (ACE) Troubleshooting Guide\|Main Article]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Overview of ACE Troubleshooting\|Overview of ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Understanding the ACE Module Architecture and Traffic Flow\|Understanding the ACE Module Architecture and Traffic Flow]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Preliminary ACE Troubleshooting\|Preliminary ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Boot Issues\|Troubleshooting ACE Boot Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting with ACE Logging\|Troubleshooting with ACE Logging]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Connectivity\|Troubleshooting Connectivity]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Ethernet Ports\|Troubleshooting ACE Appliance Ethernet Ports]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Remote Access\|Troubleshooting Remote Access]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists\|Troubleshooting Access Control Lists]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Network Address Translation\|Troubleshooting Network Address Translation]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Health Monitoring\|Troubleshooting ACE Health Monitoring]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 4 Load Balancing\|Troubleshooting Layer 4 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 7 Load Balancing\|Troubleshooting Layer 7 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Redundancy\|Troubleshooting Redundancy]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting SSL\|Troubleshooting SSL]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Compression\|Troubleshooting Compression]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Performance Issues\|Troubleshooting Performance Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- ACE Resource Limits\|ACE Resource Limits]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Managing Resources\|Managing ACE Resources]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Show Counter Reference\|Show Counter Reference]]<br>
	\|}		\|}

Dakelley at 23:43, 9 March 2011

2011-03-09T23:43:02Z

← Older revision		Revision as of 23:43, 9 March 2011
Line 5:		Line 5:
	\|align="center"\|'''Guide Contents'''		\|align="center"\|'''Guide Contents'''
	\|-		\|-
-	\|[[Cisco Application Control Engine (ACE) Troubleshooting Guide\|Main Article]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Overview of ACE Troubleshooting\|Overview of ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Understanding the ACE Module Architecture and Traffic Flow\|Understanding the ACE Module Architecture and Traffic Flow]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Preliminary ACE Troubleshooting\|Preliminary ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Boot Issues\|Troubleshooting ACE Boot Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting with ACE Logging\|Troubleshooting with ACE Logging]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Connectivity\|Troubleshooting Connectivity]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Remote Access\|Troubleshooting Remote Access]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists\|Troubleshooting Access Control Lists]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Network Address Translation\|Troubleshooting Network Address Translation]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Health Monitoring\|Troubleshooting ACE Health Monitoring]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 4 Load Balancing\|Troubleshooting Layer 4 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 7 Load Balancing\|Troubleshooting Layer 7 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Redundancy\|Troubleshooting Redundancy]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting SSL\|Troubleshooting SSL]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Performance Issues\|Troubleshooting Performance Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- ACE Resource Limits\|ACE Resource Limits]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Managing Resources\|Managing ACE Resources]]<br>	+	\|[[Cisco Application Control Engine (ACE) Troubleshooting Guide\|Main Article]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Overview of ACE Troubleshooting\|Overview of ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Understanding the ACE Module Architecture and Traffic Flow\|Understanding the ACE Module Architecture and Traffic Flow]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Preliminary ACE Troubleshooting\|Preliminary ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Boot Issues\|Troubleshooting ACE Boot Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting with ACE Logging\|Troubleshooting with ACE Logging]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Connectivity\|Troubleshooting Connectivity]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Ethernet Ports\|Troubleshooting ACE Appliance Ethernet Ports]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Remote Access\|Troubleshooting Remote Access]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists\|Troubleshooting Access Control Lists]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Network Address Translation\|Troubleshooting Network Address Translation]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Health Monitoring\|Troubleshooting ACE Health Monitoring]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 4 Load Balancing\|Troubleshooting Layer 4 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 7 Load Balancing\|Troubleshooting Layer 7 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Redundancy\|Troubleshooting Redundancy]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting SSL\|Troubleshooting SSL]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Performance Issues\|Troubleshooting Performance Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- ACE Resource Limits\|ACE Resource Limits]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Managing Resources\|Managing ACE Resources]]<br>
	\|}		\|}

Dakelley at 21:43, 8 March 2011

2011-03-08T21:43:27Z

← Older revision		Revision as of 21:43, 8 March 2011
Line 5:		Line 5:
	\|align="center"\|'''Guide Contents'''		\|align="center"\|'''Guide Contents'''
	\|-		\|-
-	\|[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~\|Main Article]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Overview of ACE ~~Module~~ Troubleshooting\|Overview of ACE ~~Module~~ Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Understanding the ACE Module Architecture and Traffic Flow\|Understanding the ACE Module Architecture and Traffic Flow]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Preliminary ACE ~~Module~~ Troubleshooting\|Preliminary ACE ~~Module~~ Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting ACE Boot Issues\|Troubleshooting ACE Boot Issues]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting with ACE Logging\|Troubleshooting with ACE Logging]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Connectivity\|Troubleshooting Connectivity]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Remote Access\|Troubleshooting Remote Access]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Access Control Lists\|Troubleshooting Access Control Lists]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Network Address Translation\|Troubleshooting Network Address Translation]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting ACE Health Monitoring\|Troubleshooting ACE Health Monitoring]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Layer 4 Load Balancing\|Troubleshooting Layer 4 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Layer 7 Load Balancing\|Troubleshooting Layer 7 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Redundancy\|Troubleshooting Redundancy]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting SSL\|Troubleshooting SSL]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Troubleshooting Performance Issues\|Troubleshooting Performance Issues]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- ACE ~~Module~~ Resource Limits\|ACE ~~Module~~ Resource Limits]]<br>[[Cisco Application Control Engine (ACE) ~~Module~~ Troubleshooting Guide~~, Release A2(x)~~ -- Managing Resources\|Managing ACE Resources]]<br>	+	\|[[Cisco Application Control Engine (ACE) Troubleshooting Guide\|Main Article]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Overview of ACE Troubleshooting\|Overview of ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Understanding the ACE Module Architecture and Traffic Flow\|Understanding the ACE Module Architecture and Traffic Flow]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Preliminary ACE Troubleshooting\|Preliminary ACE Troubleshooting]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Boot Issues\|Troubleshooting ACE Boot Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting with ACE Logging\|Troubleshooting with ACE Logging]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Connectivity\|Troubleshooting Connectivity]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Remote Access\|Troubleshooting Remote Access]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists\|Troubleshooting Access Control Lists]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Network Address Translation\|Troubleshooting Network Address Translation]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting ACE Health Monitoring\|Troubleshooting ACE Health Monitoring]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 4 Load Balancing\|Troubleshooting Layer 4 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Layer 7 Load Balancing\|Troubleshooting Layer 7 Load Balancing]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Redundancy\|Troubleshooting Redundancy]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting SSL\|Troubleshooting SSL]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Performance Issues\|Troubleshooting Performance Issues]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- ACE Resource Limits\|ACE Resource Limits]]<br>[[Cisco Application Control Engine (ACE) Troubleshooting Guide -- Managing Resources\|Managing ACE Resources]]<br>
	\|}		\|}

Dakelley: Cisco Application Control Engine (ACE) Module Troubleshooting Guide, Release A2(x) -- Troubleshooting Access Control Lists moved to Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists: Combining the

2010-02-15T20:59:07Z

Cisco Application Control Engine (ACE) Module Troubleshooting Guide, Release A2(x) -- Troubleshooting Access Control Lists moved to Cisco Application Control Engine (ACE) Troubleshooting Guide -- Troubleshooting Access Control Lists: Combining the

← Older revision

Revision as of 20:59, 15 February 2010

Dakelley: /* Troubleshooting ACLs */

2009-11-18T22:33:20Z

Troubleshooting ACLs

← Older revision		Revision as of 22:33, 18 November 2009
Line 326:		Line 326:
	Policy action nodes (used/shared): '''153''' / 261990 <------------------\|		Policy action nodes (used/shared): '''153''' / 261990 <------------------\|

-	You can calculate the percentage of use for each node type by dividing the used nodes value by the maximum number of nodes and multiplying the result by 100. If any of these percentages exceeds the maximum value of allocated ACL memory for the context, increase the '''max''' value of allocated ACL memory using the '''limit-resource acl-memory''' command in resource class configuration mode so that that value is greater than or equal to the highest used nodes percentage that you calculated.	+	You can calculate the percentage of use for each node type by dividing the used nodes value by the maximum number of nodes and multiplying the result by 100. If any of these percentages exceeds the maximum value of allocated ACL memory for the context, increase the '''max''' value of allocated ACL memory using the '''limit-resource acl-memory''' command in resource class configuration mode so that that value is greater than or equal to the highest used nodes percentage that you calculated. Alternatively, if you are approaching the limits of ACL resource capacity, you may consider consolidating your ACL configuration.

	If the ACL nodes are depleted while the ACE is downloading ACL configurations for an interface, the complete ACL merged list for that interface is deleted and no traffic flows through that interface. The ACE increments the download failure counter in the output of the '''show interface''' command and the ACE logs a system message from the configuration manager.		If the ACL nodes are depleted while the ACE is downloading ACL configurations for an interface, the complete ACL merged list for that interface is deleted and no traffic flows through that interface. The ACE increments the download failure counter in the output of the '''show interface''' command and the ACE logs a system message from the configuration manager.

Dakelley: /* Troubleshooting ACLs */

2009-09-14T15:01:43Z

Troubleshooting ACLs

← Older revision		Revision as of 15:01, 14 September 2009
Line 295:		Line 295:
	.		.

-	5. If the acl-memory Denied counter in the output of the '''show resource usage''' command is incrementing and the Peak (ACL) memory counter has not exceeded the Max Allocated ACL memory counter, the problem may lie with one of the nodes in the ACL merge tree. The ACL merge tree contains several different kinds of nodes (see the example output below), each of a different size and each with a maximum limit. If you allocate 10 percent of the ACE resources to ACL memory, the ACE will guarantee 10% of the maximum number of each node. If your configuration causes the ACE to exceed the maximum value of one of these nodes, the ACL resource allocation will fail and the acl-memory Denied counter will increment.	+	5. If the acl-memory Denied counter in the output of the '''show resource usage''' command is incrementing and the Peak (ACL) memory counter has not exceeded the Max Allocated ACL memory counter, the problem may lie with one of the nodes in the ACL merge tree. The ACL merge tree contains several different kinds of nodes (see the example output below), each of a different size and each with a maximum limit. If you allocate a minimum of 10 percent of the ACE resources to ACL memory, the ACE will guarantee 10% of the maximum number of each node. If your configuration causes the ACE to exceed the maximum value of one of these nodes, the ACL resource allocation will fail and the acl-memory Denied counter will increment.

	To monitor the ACL merge tree node usage in the ACE, enter the following command:		To monitor the ACL merge tree node usage in the ACE, enter the following command:
Line 326:		Line 326:
	Policy action nodes (used/shared): '''153''' / 261990 <------------------\|		Policy action nodes (used/shared): '''153''' / 261990 <------------------\|

-	You can calculate the percentage of use for each node type by dividing the used nodes value by the maximum number of nodes and multiplying the result by 100. If any of these percentages exceeds the maximum value of allocated ACL memory, increase the '''max''' value of allocated ACL memory using the '''limit-resource acl-memory''' command in resource class configuration mode so that that value is greater than or equal to the highest used nodes percentage that you calculated.	+	You can calculate the percentage of use for each node type by dividing the used nodes value by the maximum number of nodes and multiplying the result by 100. If any of these percentages exceeds the maximum value of allocated ACL memory for the context, increase the '''max''' value of allocated ACL memory using the '''limit-resource acl-memory''' command in resource class configuration mode so that that value is greater than or equal to the highest used nodes percentage that you calculated.

	If the ACL nodes are depleted while the ACE is downloading ACL configurations for an interface, the complete ACL merged list for that interface is deleted and no traffic flows through that interface. The ACE increments the download failure counter in the output of the '''show interface''' command and the ACE logs a system message from the configuration manager.		If the ACL nodes are depleted while the ACE is downloading ACL configurations for an interface, the complete ACL merged list for that interface is deleted and no traffic flows through that interface. The ACE increments the download failure counter in the output of the '''show interface''' command and the ACE logs a system message from the configuration manager.

Dakelley: /* Troubleshooting ACLs */

2009-09-04T22:27:28Z

Troubleshooting ACLs

← Older revision		Revision as of 22:27, 4 September 2009
Line 295:		Line 295:
	.		.

-	5. If the ~~ACL~~ memory ~~denied~~ counter in the output of the show resource usage command is incrementing and the Peak (ACL) memory counter has not exceeded the Max Allocated ACL memory counter, the problem may lie with one of the nodes in the ACL merge tree. The ACL merge tree contains several different kinds of nodes (see the example below), each of a different size and each with a maximum limit. If you allocate 10 percent of the ACE resources to ACL memory, the ACE will guarantee 10% of the maximum number of each node. If your configuration causes the ACE to exceed the maximum value of one of these nodes, the ACL resource allocation will fail and the acl-memory Denied counter will increment.	+	5. If the acl-memory Denied counter in the output of the '''show resource usage''' command is incrementing and the Peak (ACL) memory counter has not exceeded the Max Allocated ACL memory counter, the problem may lie with one of the nodes in the ACL merge tree. The ACL merge tree contains several different kinds of nodes (see the example output below), each of a different size and each with a maximum limit. If you allocate 10 percent of the ACE resources to ACL memory, the ACE will guarantee 10% of the maximum number of each node. If your configuration causes the ACE to exceed the maximum value of one of these nodes, the ACL resource allocation will fail and the acl-memory Denied counter will increment.

	To monitor the ACL merge tree node usage in the ACE, enter the following command:		To monitor the ACL merge tree node usage in the ACE, enter the following command:
Line 326:		Line 326:
	Policy action nodes (used/shared): '''153''' / 261990 <------------------\|		Policy action nodes (used/shared): '''153''' / 261990 <------------------\|

-	You can calculate the percentage of use for each node type by dividing the used nodes value by the maximum number of nodes and multiplying the result by 100. If any of these percentages exceeds the maximum value of allocated ACL memory, increase the '''max''' value of allocated ACL memory using the '''limit-resource acl-memory''' command in resource class configuration mode so that ~~the~~ value is greater than or equal to the highest used nodes percentage that you calculated.	+	You can calculate the percentage of use for each node type by dividing the used nodes value by the maximum number of nodes and multiplying the result by 100. If any of these percentages exceeds the maximum value of allocated ACL memory, increase the '''max''' value of allocated ACL memory using the '''limit-resource acl-memory''' command in resource class configuration mode so that that value is greater than or equal to the highest used nodes percentage that you calculated.

	If the ACL nodes are depleted while the ACE is downloading ACL configurations for an interface, the complete ACL merged list for that interface is deleted and no traffic flows through that interface. The ACE increments the download failure counter in the output of the '''show interface''' command and the ACE logs a system message from the configuration manager.		If the ACL nodes are depleted while the ACE is downloading ACL configurations for an interface, the complete ACL merged list for that interface is deleted and no traffic flows through that interface. The ACE increments the download failure counter in the output of the '''show interface''' command and the ACE logs a system message from the configuration manager.

Dakelley: /* Troubleshooting ACLs */

2009-09-04T22:11:42Z

Troubleshooting ACLs

← Older revision		Revision as of 22:11, 4 September 2009
Line 295:		Line 295:
	.		.

-	5. If the ACL memory denied counter in the output of the ~~'''~~show ~~interface'''~~ command is incrementing and the Peak (ACL) memory counter has not exceeded the Max Allocated ACL memory counter ~~in the output of the '''show resource usage''' command~~, the problem may lie with one of the nodes in the ACL merge tree. If your configuration causes the ACE to exceed the maximum value of one of these nodes, the ACL resource allocation will fail and the ~~ACL~~ memory ~~denied~~ counter ~~increments~~.	+	5. If the ACL memory denied counter in the output of the show resource usage command is incrementing and the Peak (ACL) memory counter has not exceeded the Max Allocated ACL memory counter, the problem may lie with one of the nodes in the ACL merge tree. The ACL merge tree contains several different kinds of nodes (see the example below), each of a different size and each with a maximum limit. If you allocate 10 percent of the ACE resources to ACL memory, the ACE will guarantee 10% of the maximum number of each node. If your configuration causes the ACE to exceed the maximum value of one of these nodes, the ACL resource allocation will fail and the acl-memory Denied counter will increment.

	To monitor the ACL merge tree node usage in the ACE, enter the following command:		To monitor the ACL merge tree node usage in the ACE, enter the following command: