Chapter 34
Understanding Cisco IOS ACL Support
•
IP packets with a header length of less than five will not be access controlled.
Note
•
•
•
•
Configuring IPv6 Address Compression
Access control lists (ACLs) are implemented in hardware in the Policy Feature Card (PFC), which uses
the source or destination IP address and port number in the packet to index the ACL table. The index has
a maximum address length of 128 bits.
The IP address field in an IPv6 packet is 128 bits, and the port field is 16 bits. To use full IPv6 addresses
in the ACL hardware table, you can turn on compression of IPv6 addresses using the mls ipv6 acl
compress address unicast command. This feature compresses the IPv6 address (including port) into
128 bits by removing 16 unused bits from the IPv6 address. Compressible address types can be
compressed without losing any information. See
Release 12.2(17a)SX and later releases support the IPv6 compression command on the Supervisor
Engine 720. The command is not supported on Supervisor Engine 2.
By default, the command is set for no compression.
Caution
Do not enable the compression mode if you have noncompressible address types in your network. A list
of compressible address types and the address compression method are listed in
OL-4266-08
The following ACL types are processed in software:
Internetwork Packet Exchange (IPX) access lists
–
Standard XNS access list
–
Extended XNS access list
–
DECnet access list
–
Extended MAC address access list
–
Protocol type-code access list
–
Unless you configure optimized ACL logging (OAL), flows that require logging are processed in
software without impacting nonlogged flow processing in hardware (see the
Logging with a PFC3" section on page
The forwarding rate for software-processed flows is substantially less than for hardware-processed
flows.
When you enter the show ip access-list command, the match count displayed does not include
packets processed in hardware.
When you enter the show policy-map interface command, sometimes the counters that are
displayed do not include all of the hardware switching platform counters.
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
Configuring IPv6 Address Compression
34-5).
Table 34-1
for details about the compression methods.
"Optimized ACL
Table
34-1.
34-3