Table of Contents
Advertisement
Using Cisco IOS ACLs in your Network
For PFC: By default, the MSFC sends Internet Control Message Protocol (ICMP) unreachables
Caution
when a packet is denied by an access group. These access-group denied packets are not dropped in
the hardware but are bridged to the MSFC so that the MSFC can generate the ICMP-unreachable
message. To drop access-group denied packets in the hardware, you must disable ICMP unreachables
using the no ip unreachables interface configuration command. Note that the ip unreachables
command is enabled by default.
For PFC2: If IP unreachables or IP redirect is enabled on an interface, the deny is performed in
hardware although a small number of packets are sent to the MSFC2 to generate the appropriate
ICMP-unreachable messages.
These sections describe hardware and software handling of ACLs with PFC and PFC2:
•
•
Hardware and Software Handling of Cisco IOS ACLs with PFC
This section describes hardware and software handling of Cisco IOS ACLs with the PFC.
For information on Cisco IOS ACLs with PFC2, see the
Note
IOS ACLs with PFC2" section on page
ACL feature processing requires forwarding of some flows by the software. The forwarding rate for
software-forwarded flows is substantially less than for hardware-forwarded flows. Flows that require
logging as specified by the ACL are handled in the software without impacting non-log flow forwarding
in the hardware.
Note
When you enter the show ip access-list command, the match count displayed does not account for
packets access controlled in the hardware.
IPX Cisco IOS ACLs with the source host node number specified cannot be enforced on the switch
Note
in the hardware; the MSFC has to process the ACL in the software. This process significantly
degrades system performance.
These sections describe how different types of ACLs and traffic flows are handled by the hardware and
the software:
•
•
•
•
•
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
16-10
Hardware and Software Handling of Cisco IOS ACLs with PFC, page 16-10
Hardware and Software Handling of Cisco IOS ACLs with PFC2, page 16-12
Security Cisco IOS ACLs, page 16-11
Reflexive ACLs, page 16-11
TCP Intercept, page 16-11
Policy Routing, page 16-12
WCCP, page 16-12
"Hardware and Software Handling of Cisco
16-12.
Chapter 16
Configuring Access Control
78-13315-02
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
