Číslo článku: 000144574

N-series and ACL Hardware Limitation

Zhrnutie: Information about N-series and ACL Hardware Limitations

Je možné, že tento článok bol preložený automaticky. Ak máte nejaké pripomienky ku kvalite prekladu, pošlite nám ich prostredníctvom formulára naspodku stránky.

Obsah článku

Symptómy

Hardware Limitation with ACLs on N-series and following with a true example:

Customer encountered the error listed below while adding access list.

"Error encountered applying ACL to HW. HW limit may have been exceeded."

It is not an error. The N-Series switches have the following ACL software limits:

ACL Software Limitations (As of firmware 6.3.1.8)	Dell N1500 Series	Dell N2000 Series	Dell N3000 Series	Dell N4000 Series
Maximum number of ACLs (any type)	100	100	100	100
Maximum number of configurable rules per list.	1023	1023	1023	1023
Maximum ACL Rules per Interface and Direction (IPv4/L2)	1023 (ingress) 1023 (egress)	1023 (ingress) 1023 (egress)	2048 (ingress) 1023 (egress)	1023 (ingress) 1023 (egress)
Maximum ACL Rules per Interface and Direction (IPv6)	255 (ingress) 125 (egress)	1023 (ingress) 509 (egress)	1659 (ingress) 509 (egress)	635 (ingress) 509 (egress)
Maximum ACL Rules (system-wide)	3030	3914	3914	3060
Maximum VLAN interfaces with ACLs applied	24	24	24	24
Maximum ACL Logging Rules (system-wide)	128	128	128	128

For additional information on ACL limitations, see the User’s Configuration Guide by visting the Dell Support Site.

Riešenie

Port ranges (highlighted in RED) are NOT supported on egress (out) interfaces. The only port operator supported on egress is the "eq" operator. This is a HW limitation and cannot be "fixed" via SW fix.

ip access-list PrivateNetOUT

permit tcp any any range 22 23

permit tcp 172.25.242.0 0.0.0.255 any eq telnet

permit tcp 172.25.242.0 0.0.0.255 any eq 22

permit icmp any any

permit tcp 172.28.128.21 0.0.0.0 eq 445 10.10.2.0 0.0.0.255

permit tcp 172.25.53.77 0.0.0.0 any

permit udp 172.28.128.21 0.0.0.0 range 135 139 10.10.2.0 0.0.0.255

permit tcp 172.28.128.21 0.0.0.0 range 135 139 10.10.2.0 0.0.0.255

permit tcp 172.28.129.63 0.0.0.0 10.10.2.0 0.0.0.255 eq 445

permit udp 172.28.129.63 0.0.0.0 10.10.2.0 0.0.0.255 range 135 139

permit tcp 172.28.129.63 0.0.0.0 10.10.2.0 0.0.0.255 range 135 139

permit tcp 172.28.129.64 0.0.0.0 10.10.2.0 0.0.0.255 eq 445

permit udp 172.28.129.64 0.0.0.0 10.10.2.0 0.0.0.255 range 135 139

permit tcp 172.28.129.64 0.0.0.0 10.10.2.0 0.0.0.255 range 135 139

permit udp 172.25.2.81 0.0.0.0 10.10.2.0 0.0.0.255 eq ntp

permit udp 172.25.254.1 0.0.0.0 10.10.2.0 0.0.0.255 eq ntp

permit tcp 172.28.128.124 0.0.0.0 10.10.2.51 0.0.0.0 eq ftp-data

permit tcp 172.28.128.124 0.0.0.0 10.10.2.51 0.0.0.0 eq ftp

permit tcp any 10.10.2.49 0.0.0.0 eq 5160

permit tcp 172.28.128.124 0.0.0.0 eq 1025 10.10.2.51 0.0.0.0

permit tcp 172.28.128.124 0.0.0.0 eq 1025 10.10.2.43 0.0.0.0

permit tcp 172.28.128.124 0.0.0.0 10.10.2.43 0.0.0.0 eq ftp-data

permit tcp 172.28.128.124 0.0.0.0 10.10.2.43 0.0.0.0 eq ftp

permit tcp 172.28.128.124 0.0.0.0 10.10.2.52 0.0.0.0 eq ftp-data

permit tcp 172.28.128.124 0.0.0.0 10.10.2.52 0.0.0.0 eq ftp

permit tcp 172.28.128.124 0.0.0.0 10.10.2.43 0.0.0.0 eq 1025

permit udp any 10.10.2.49 0.0.0.0 eq 5160

permit tcp 172.28.128.13 0.0.0.0 eq 1433 any

permit tcp 172.28.128.124 0.0.0.0 10.10.2.51 0.0.0.0 eq 1025

permit tcp 172.28.129.13 0.0.0.0 10.10.2.0 0.0.0.255 eq 1433

permit tcp 172.28.128.0 0.0.3.255 10.10.2.49 0.0.0.0 eq 1433

permit tcp 172.28.128.124 0.0.0.0 eq ftp-data 10.10.2.0 0.0.0.255

Vlastnosti článku

Dotknutý produkt

PowerSwitch N1500 Series, PowerSwitch N2000 Series, PowerSwitch N3000 Series, PowerSwitch N4000 Series

Dátum posledného zverejnenia

21 feb 2021

Verzia

Typ článku

Solution

Späť na začiatok

Vitajte

Vitajte v spoločnosti Dell!