You can create up to 100 access control lists (ACLs) in the device UI of the GS728TPv2, GS728TPPv2, GS752TPv2, and GS752TPP smart switches. You might not be able to use all of your ACLs if they contain too many access control entries (ACEs), also known as rules, or if you assign your ACLs to too many switch ports or VLANs.
For more information about ACLs, see What are Access Control Lists (ACLs) and how do they work with my managed switch?.
For more information about how to create an ACL, see your switch's user manual.
Your switch uses a special kind of memory called tertiary content-addressable memory (TCAM) to store your ACEs. This memory has extremely high search performance and allows you to use many ACEs without a performance penalty. Your switch has enough TCAM for 512 ACE entries. A single ACE might use more than one TCAM entry. If the TCAM is full, you cannot add another ACE to an ACL or assign an ACL to another port or VLAN.
The following table shows how many TCAM entries are used by an ACE per assigned port or VLAN:
| ACE Type | TCAM Entries Used |
|---|---|
| MAC | 1 per port or VLAN |
| IPv4 | 2 per port or VLAN |
| IPv6 | 4 per port or VLAN |
| Multiple ACEs of any type assigned to one port or VLAN | 4 per ACE per port or VLAN regardless of ACE type |
To calculate the number of TCAM entries used by an ACL:
- Determine the number of TCAM entries used by the ACE type in the previous table.
- Multiply by the number of ACEs in the ACL plus one for the default deny all ACE.
- Multiply the result by the number of ports or VLANs using the ACL.
The total TCAM entry usage for all ACLs combined must be less than 512. If the TCAM entry usage exceeds 512, the device UI displays an error message.
For example, the following list shows the parameters for an ACL:
- The ACL uses IPv4 ACEs which use 2 TCAM entries per ACE.
- The ACL has four ACEs and one default deny all ACE for a total of five ACEs.
- You assign the ACL to ten ports.
The total TCAM entry usage would be 2 * 5 * 10 or 100 entries.
For more information, see: