Acl Implicit Deny; Maximum Number Of Acls And Acl Entries; Acl Configuration Quick Start - Cisco 4700M Configuration Manual

ACL Configuration Quick Start

ACL Implicit Deny

Maximum Number of ACLs and ACL Entries

ACL Configuration Quick Start
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
1-4
All ACLs have an implicit deny entry at the end of the ACL, so, unless you
explicitly permit it, traffic cannot pass. For example, if you want to allow all users
to access a network through the ACE except for those users with particular IP
addresses, then you must deny the particular IP addresses in one entry and permit
all other IP addresses in another entry.
The ACE supports a maximum of 8,192 unique ACLs and 40,000 ACL entries.
Some ACLs use more memory than others, such as an ACL that uses large port
number ranges or overlapping networks (for example, one entry specifies
10.0.0.0/8 and another entry specifies 10.1.1.0/24). Depending on the type of
ACL, the actual limit that the ACE can support may be less than 40,000 entries.
If you use object groups in ACL entries, you enter fewer actual ACL entries, but
the same number of expanded ACL entries as you did when you entered entries
without object groups. Expanded ACL entries count toward the system limit. To
view the number of expanded ACL entries in an ACL, use the show access-list
name command.
If you exceed the memory limitations of the ACE, the appliance generates a syslog
message and increments the Download Failures counter in the output of the show
interface vlan number command. The configuration remains in the
running-config file and the interface stays enabled. The ACL entries stay the same
as they were before the failing configuration was attempted.
For example, if you add a new ACL with ten entries, but the addition of the sixth
entry fails because the ACE runs out of memory, the ACE removes the five entries
that you successfully entered.
Table 1-1 provides a quick overview of the steps required to configure ACLs.
Each step includes the CLI command or a reference to the procedure required to
complete the task. For a complete description of each feature and all the options
associated with the CLI commands, see the sections following
Chapter 1 Configuring Security Access Control Lists
Table 1-1.
OL-16202-01