Netgear XCM8806 Chassis User Manual - Page 326

NETGEAR 8800 User Manual • Each group of 2 ports has 16 slices with each slice having enough memory for 256 ingress rules. • XCM8848T/XCM8824F- • Each group of 24 ports has 4 slices with each slice having enough memory for 128 egress rules. • Each group of 24 ports has 16 slices with each slice having enough memory for 256 ingress rules. This architecture also allows a single slice to implement ACLs that are applied to more than one port. When an ACL entry is applied, if its match conditions do not conflict with an already existing ACL, the entry is added to the rule memory of an already populated slice. Because the slices are much more flexible than masks, a much wider variety of rule entries can use the same slice. When ACLs are applied, the system programs each slice to select parts of the packet information to be loaded into it. For example, one possible way a slice can be programmed allows it to hold the information about a packet's ingress port, source and destination IP address, IP protocol, source and destination Layer 4 ports, DSCP value, TCP flag, and if it is a first fragment. Any rule entry that consists of match conditions drawn from that list is compatible with that slice. This list of conditions is just one example. A complete description of possible ways to program a slice is discussed in Compatible and Conflicting Rules on page 329. In the following example, the two rule entries are compatible and require only one slice in hardware even though they are applied to different ports. The following entry is applied to port 1: entry ex_A { if { source-address 10.10.10.0/24 ; destination-port 23 ; protocol tcp ; } then { deny ; } } and the following entry is applied to port 2: entry ex_B { if { destination-address 192.168.0.0/16 ; source-port 1000 ; protocol tcp ; } then { deny ; } 326 | Chapter 13. ACLs