which TCAM resource am I filling with this mac ACL?

One of the easiest things that can help the switch run smooth, is ensuring the firmware is up to date.

3.3.5.5 is the most current.

www.dell.com/.../powerconnect-6224

Does the number of ACEs you can add change if you remove the mirror option? Perhaps the mirror option is taking up a lot of resources.

Do we get any error messages if we try and make and apply a second ACL  with the additional ACEs.

So first ACL would be for VLANs 2-12, then a second for 13-16 & 2000-2005, etc.  See if we get the same error messages.

I will continue to do some research on this and if I find anything else will chime back in.

Thanks.

Thanks, Daniel.  My application is that I'd like to take a mirror port from another device, with multiple VLANs; and send each VLAN out a different 1gig port to a different IDS.  So I need the "mirror" keyword.

The Mirror port is connected to 1/xg3.  

The following works, spanning vlan 1002 traffic to 1/g1, and v2000 traffic to 1/g2.

Traffic is sent out ports 1 & 2 with no tags.  No vlans are defined in vlans database.

mac access-list extended v1002

permit any any vlan eq 1002 mirror 1/g1

exit

mac access-list extended v2000

permit any any vlan eq 2000 mirror 1/g2

exit

!

mac access-list extended denyAll

deny any any

exit

!

interface ethernet 1/xg3

mac access-group v1002 in 1002

mac access-group v2000 in 2000

!

interface ethernet 1/g1

mac access-group denyAll in 1

exit

interface ethernet 1/g2

mac access-group denyAll in 1

exit

…and this works, spanning both vlans to 1/g1.  Again, no dot1q tags on egress traffic:

mac access-list extended v1002

permit any any vlan eq 1002 mirror 1/g1

exit

mac access-list extended v2000

permit any any vlan eq 2000 mirror 1/g1

exit

!

interface ethernet 1/xg3

mac access-group v1002 in 1

mac access-group v2000 in 2

I tested adding multiple mac access-groups to interface 1/xg3, and got to about 5 before the PowerConnect started throwing "Error processing ACL" messages.  So then I tried a single mac access-group with multiple lines, and again, could not define very many.

BTW, I noticed that if one mac access-list mirrored a vlan to (say) port 1/g1, and a higher-numbered mac access-list on the same port tried to mirror the same vlan to 1/g2, 1/g2 did not see the traffic.  So I suspect that once traffic matches a mac access-group line on an interface, the packet is not processed further.

I haven't given up yet!

I am thinking it may be a resources issue, to help confirm this we should try the following. Make the ACL with the Max number of ACEs we were able to get it to accept without getting the error message. Then run the following show commands to see what our resource usage is at.

console#show process cpu

console#show memory cpu

console#show interfaces counters

Thanks