EARL 8分類管理器：LOUs、L4Ops和Capmap表的行為檢查
下載選項
已更新: 2016 年 11 月 30 日
文件 ID:118649
無偏見用語
本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。
關於此翻譯
思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。
目錄
簡介
本檔案將說明邏輯運算單元(LOU)和第4層運算(L4Ops)如何程式設計到capmap表中。它提供故障情景、在這些情況下通常遇到的錯誤型別以及您應該從這些錯誤中推斷出的內容。
Classification Manager(CM)管理分類三重內容可定址儲存器(TCAM)和相關資源（如標籤、LOU、capmap條目等）。功能管理器(FM)和QoS管理器(QM)使用CM服務對TCAM條目進行程式設計以支援Cisco IOS® 存取控制清單(ACL)和服務品質(QoS)功能。
背景資訊
LOUs和L4Ops - LOUs代表邏輯運算單元，這是硬體暫存器，用於儲存ACL和VLAN訪問控制清單(VACL)中指定的TCP/UDP埠號的{operator， operand}元組。 這些元組也稱為L4Ops。例如，如果將主機X與主機Y gt 1023匹配，則元組將變為{gt， 1023}。
L4Ops — 第4層操作。
Capmap表 — 前面描述的L4Ops被程式設計到LOU暫存器中，由capmap表中的條目引用。每個capmap表都有一個10個條目（一個用於direction，將限制下限為9個）(L4Ops)。 Capmap表由TCAM標籤本身索引。
有兩個TCAM，A和B;每個TCAM有8K標籤。每個TCAM都有一個包含2000個條目的配置對映表。由於每個TCAM有8K標籤，此處有4:1的重疊 — 四個標籤對映到一個capmap條目。重疊為：1=2049=4097=6145。
基本上，這意味著TCAM標籤1、2049、4097和6145使用相同的capmap索引。由於這種重疊，思科對TCAM標籤分配的傳統實施導致了問題。思科分配的TCAM標籤的間隙為2K（準確來說是2048年）。 這意味著分配將採用1,2049、4097、6145、2,2050、4098、6146等形式。
所以，從一開始，這種TCAM分配就使得capmap表重疊。以下範例可說明此情況(摘自思科錯誤ID CSCuo0266)。 以下是已定義並套用於介面VLAN 1和介面VLAN 2的兩個ACL（a1和a2），如下所示：
Sup2T(config)#ip access-list extended a1
Sup2T(config-ext-nacl)# permit ip host 1.1.1.1 any dscp 1
Sup2T(config-ext-nacl)# permit ip host 1.1.1.1 any dscp 2
Sup2T(config-ext-nacl)# permit ip host 1.1.1.1 any dscp 3
Sup2T(config-ext-nacl)# permit ip host 1.1.1.1 any dscp 4
Sup2T(config-ext-nacl)# permit ip host 1.1.1.1 any dscp 5
Sup2T(config-ext-nacl)#exit
Sup2T(config)#int vlan 1
Sup2T(config-if)#ip access-group a1 in
Sup2T(config-if)#exit
Sup2T(config)#ip access-list extended a2
Sup2T(config-ext-nacl)# permit ip host 1.1.1.2 any dscp 6
Sup2T(config-ext-nacl)# permit ip host 1.1.1.2 any dscp 7
Sup2T(config-ext-nacl)# permit ip host 1.1.1.2 any dscp cs1
Sup2T(config-ext-nacl)# permit ip host 1.1.1.2 any dscp 9
Sup2T(config-ext-nacl)#exit
Sup2T(config)#int vlan 2
Sup2T(config-if)#ip access-group a2 in
Sup2T(config-if)#end
下面是這些介面的TCAM:
Sup2T#show platform hardware acl entry interface vlan 1 security in ip detail
mls_if_index:20000001 dir:0 feature:0 proto:0
pass#0 features
UAPRSF: U-urg, A-ack, P-psh, R-rst, S-syn, F-fin
MLGFI: M-mpls_plus_ip_pkt, L-L4_hdr_vld, G-gpid_present,F-global_fmt_match,
I-ife/ofe
's' means set; 'u' means unset; '-' means don't care
----------------------------------------------------------------
----------------------------------------------------------------
----------------------------------------------------------------
------
I INDEX LABEL FS ACOS AS IP_SA SRC_PORT
IP_DA DST_PORT F FF L4PROT TCP-F:UAPRSF MLGFI OtherL4OPs
RSLT CNT
---------------------------------------------------------------
---------------------------------------------------------------
---------------------------------------------------------------
---------
fno:0
tcam:B, bank:0, prot:0 Aces
I V 16366 2049 0 0 0 1.1.1.1 - 0.0.0.0
- 0 0 0 - ----- dscp=5; 0x0000000000000038
0
I M 16366 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 16367 2049 0 0 0 1.1.1.1 - 0.0.0.0
- 0 0 0 - ----- dscp=4; 0x0000000000000038
0
I M 16367 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 16368 2049 0 0 0 1.1.1.1 - 0.0.0.0
- 0 0 0 - ----- dscp=3; 0x0000000000000038
0
I M 16368 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 16369 2049 0 0 0 1.1.1.1 - 0.0.0.0
- 0 0 0 - ----- dscp=2; 0x0000000000000038
0
I M 16369 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 16370 2049 0 0 0 1.1.1.1 - 0.0.0.0
- 0 0 0 - ----- dscp=1; 0x0000000000000038
0
I M 16370 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 16371 2049 0 0 0 0.0.0.0 - 0.0.0.0
- 0 0 0 - ----- - 0x0000000040000038
0
I M 16371 0x1FFF 0 0x00 0x000 0.0.0.0 - 0.0.0.0
- 0 0 0x0
Sup2T#show platform hardware acl entry interface vlan 2 security in ip detail
mls_if_index:20000002 dir:0 feature:0 proto:0
pass#0 features
UAPRSF: U-urg, A-ack, P-psh, R-rst, S-syn, F-fin
MLGFI: M-mpls_plus_ip_pkt, L-L4_hdr_vld, G-gpid_present,F-global_fmt_match, I-ife/ofe
's' means set; 'u' means unset; '-' means don't care
----------------------------------------------------------------
----------------------------------------------------------------
----------------------------------------------------------------
------
I INDEX LABEL FS ACOS AS IP_SA SRC_PORT
IP_DA DST_PORT F FF L4PROT TCP-F:UAPRSF MLGFI OtherL4OPs
RSLT CNT
-----------------------------------------------------------------
-----------------------------------------------------------------
-----------------------------------------------------------------
fno:0
tcam:B, bank:1, prot:0 Aces
I V 32738 4097 0 0 0 1.1.1.2 - 0.0.0.0
- 0 0 0 - ----- dscp=9; 0x0000000000000038
0
I M 32738 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 32739 4097 0 0 0 1.1.1.2 - 0.0.0.0
- 0 0 0 - ----- dscp=8; 0x0000000000000038
0
I M 32739 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 32740 4097 0 0 0 1.1.1.2 - 0.0.0.0
- 0 0 0 - ----- dscp=7; 0x0000000000000038
0
I M 32740 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 32741 4097 0 0 0 1.1.1.2 - 0.0.0.0
- 0 0 0 - ----- dscp=6; 0x0000000000000038
0
I M 32741 0x1FFF 0 0x00 0x000 255.255.255.255 - 0.0.0.0
- 0 0 0x0
I V 32745 4097 0 0 0 0.0.0.0 - 0.0.0.0
- 0 0 0 - ----- - 0x0000000040000038
0
I M 32745 0x1FFF 0 0x00 0x000 0.0.0.0 - 0.0.0.0
- 0 0 0x0
分配給介面VLAN 1的TCAM標籤為2049，分配給介面VLAN 2的TCAM標籤為4097。這意味著這兩個介面使用相同的capmap表以便為其L4Op程式設計引用LOU暫存器。
您可以使用以下命令確認這點（ACL a1中有五個ACE，ACL a2中有四個ACE表示您應該看到容量對映表已滿）：
Sup2T#show platform hardware acl capmap tcam B label 4097
Hardware Capmap Table Entry For TCAM B. Free items are not shown
Index Loc[9] [8] [7] [6] [5] [4] [3] [2] [1] [0]
----- ------ --- --- --- --- --- --- --- --- ---
1 212 10 9 8 7 6 5 4 3 2
Sup2T#show platform hardware acl capmap tcam B label 2049
Hardware Capmap Table Entry For TCAM B. Free items are not shown
Index Loc[9] [8] [7] [6] [5] [4] [3] [2] [1] [0]
----- ------ --- --- --- --- --- --- --- --- ---
1 212 10 9 8 7 6 5 4 3 2
現在，在這個階段，如果您嘗試為任意這些介面安裝另一個基於L4Op的訪問控制條目(ACE)（不可擴展），您將收到No free capmap entry available錯誤。
Sup2T(config)#ip access-list extended a2
Sup2T(config-ext-nacl)#permit ip host 1.1.1.2 any dscp 10
Sup2T(config-ext-nacl)#end
*Sep 16 14:57:55.983: %EARL_CM-5-NOCAPMAP: No free capmap entry available
*Sep 16 14:57:55.991: %FMCORE-4-RACL_REDUCED: Interface Vlan2 routed traffic
will be software switched in ingress direction. L2 features may not be applied
at the interface
這會導致軟體橋接整個介面，這可能會導致交換速度變慢、CPU使用率高以及其他相關問題。
附註：為了解決此問題，引入了思科錯誤ID CSCuo0266。它引入的最大邏輯變化是TCAM標籤的分配方式。現在，思科在2048年之前一直不斷地分配TCAM標籤（2、3、4、5等），而不是在2K的間隙中分配。這意味著capmap表不再從頭開始共用。
請記住，與其他硬體資源一樣，LOU也是有限的。共有104個LOU可供使用：
Sup2T#show platform software acl lou
LOUs Registers (shadow copies)
Index Type A_Op A_Val A_Cnt B_Op B_Val B_Cnt
----- -------- ---- ----- ----- ---- ----- -----
0PKT_QOS_GI A is free. NEQ 0 1
1 DST_PORT LT 81 2 B is free.
2 B & A are free
3 B & A are free
4 B & A are free
5 B & A are free
6 B & A are free
7 B & A are free
8 B & A are free
9 B & A are free
10 B & A are free
11 B & A are free
12 B & A are free
13 B & A are free
14 B & A are free
15 B & A are free
*snip*
95 B & A are free
96 B & A are free
97 B & A are free
98 B & A are free
99 B & A are free
100 B & A are free
101 B & A are free
102 B & A are free
103 B & A are free
程式Capmap表和LOU暫存器
僅當必須考慮L4操作時才使用Capmap表。請注意，區分服務代碼點(DSCP)/服務類別(CoS)值的匹配也視為一個L4Op。以下是一個簡單的範例(使用包含修正思科錯誤ID CSCuo0266的程式碼版本)，本檔案是建立於增量基礎之上：
Sup2T#show ip access-lists a3
Extended IP access list a3
10 permit ip host 192.168.1.1 host 192.168.1.2
I have this applied to interface VLAN 1.
Sup2T#show run int vlan 1
Building configuration...
Current configuration : 84 bytes
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip access-group a3 in
end
此指令已正確寫入TCAM:
Sup2T#show platform hardware acl entry interface vlan 1 security in ip
mls_if_index:20000001 dir:0 feature:0 proto:0
pass#0 features
fno:0
tcam:B, bank:1, prot:0 Aces
Permit ip host 192.168.1.1 host 192.168.1.2
L3_Deny ip any any
Sup2t-MA1.7#show platform hardware acl entry interface vlan 1 security in ip detail
mls_if_index:20000001 dir:0 feature:0 proto:0
pass#0 features
UAPRSF: U-urg, A-ack, P-psh, R-rst, S-syn, F-fin
MLGFI: M-mpls_plus_ip_pkt, L-L4_hdr_vld, G-gpid_present,F-global_fmt_match, I-ife/ofe
's' means set; 'u' means unset; '-' means don't care
----------------------------------------------------------------
----------------------------------------------------------------
----------------------------------------------------------------
------
I INDEX LABEL FS ACOS AS IP_SA SRC_PORT
IP_DA DST_PORT F FF L4PROT TCP-F:UAPRSF MLGFI OtherL4OPs
RSLT CNT
----------------------------------------------------------------
----------------------------------------------------------------
-----------------------------------------------------------------
-----
fno:0
tcam:B, bank:1, prot:0 Aces
I V 32741 2 0 0 0 192.168.1.1 - 192.168.1.2
- 0 0 0 - ----- - 0x0000000000000038
0
I M 32741 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
- 0 0 0x0
I V 32745 2 0 0 0 0.0.0.0 - 0.0.0.0
- 0 0 0 - ----- - 0x0000000040000038
0
I M 32745 0x1FFF 0 0x00 0x000 0.0.0.0 - 0.0.0.0
- 0 0 0x0
Capmap表通過TCAM標籤本身進行引用。您可以使用show platform software [hardware] acl capmap tcam <> label <>命令中的TCAM標籤來檢視此TCAM標籤的對應表（軟體或硬體）。
Sup2T#show platform hardware acl capmap tcam B label 2
Hardware Capmap Table Entry For TCAM B. Free items are not shown
Index Loc[9] [8] [7] [6] [5] [4] [3] [2] [1] [0]
----- ------ --- --- --- --- --- --- --- --- ---
1 212 0 0 0 0 0 0 0 0 0
在capmap表中沒有為此標籤分配任何內容。定義的ACL沒有L4Ops;不需要在capmap表中安裝條目。
將此ACE更改為：
Sup2T#show ip access-lists a3
Extended IP access list a3
10 permit tcp host 192.168.1.1 host 192.168.1.2 eq www
再看一下卡佩圖表。
Sup2T#show platform software acl capmap tcam B label 2
Shadow Capmap Table Entry For TCAM B
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ---------------- ---------
------- ---------------- ---------------- ---------------- -------------
--- ---------------- ----------------
1 9 Reserved Free Free Free
Free Free Free Free Free
Free
如果直接等於port-number，則它不計為L4Op。
將其更改為：
Sup2T#show ip access-lists a3
Extended IP access list a3
10 permit tcp host 192.168.1.1 host 192.168.1.2 gt www
再次檢查capmap表：
Sup2T#show platform software acl capmap tcam B label 2
Shadow Capmap Table Entry For TCAM B
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ---------------- ---------
------- ---------------- ---------------- ---------------- ------------
---- ---------------- ----------------
2 8 212/0/1 Free Free Free
Free Free Free Free Free 3/1/1
capmap表中現在有一個條目。ACE已轉換為capmap表中的3/1/1。其格式為RST/INV/CNT。這裡的RST指定將此L4Op安裝到哪個LOU暫存器中，並且CNT描述了此LOU的聚合計數（稍後將對此進行詳細介紹）。 檢視以下輸出以瞭解如何對RST值建立索引：
Sup2T#show platform software acl capmap mapping
L4op_sel value Reference
============== =========
0 ------ LOU0 B register
1 ------ LOU0 A register
2 ------ LOU1 B register
3 ------ LOU1 A register
..... ..............
..... ..............
206 ----- LOU103 B register
207 ----- LOU103 A register
208 ----- Global format match for global acl
209 ----- Group id present
210 ----- L4_hdr_vld
211 ----- Mpls_plus_ip_pkt
212 ----- ife/ofe for direction
(213-223) ---- Reserved
(224-239) ---- 16 TCP flags map
(240-255) ---- 16 IPv6 ext header map
您可以看到，0的L4op_sel值指向LOU0B暫存器，1的LOU0A暫存器值，2的LOU1B暫存器值，3的LOU1B暫存器值等等。A暫存器總是首先程式設計。現在您會看到以下內容，3/1/1輸出更有意義。
在此輸出中，3表示L4Op被程式設計到LOU1A暫存器中。如果直接檢視LOU暫存器的內容，還可以驗證L4Op的程式設計位置：
Sup2T#show platform software acl lou
LOUs Registers (shadow copies)
Index Type A_Op A_Val A_Cnt B_Op B_Val B_Cnt
----- -------- ---- ----- ----- ---- ----- -----
0PKT_QOS_GI A is free. NEQ 0 1
1 DST_PORT LT 81 1 B is free.
2 B & A are free
3 B & A are free
4 B & A are free
*snip*
Sup2T#show platform hardware acl lou
Dumping h/w lou values
Index lou_mux_sel A_Opcode A_Value B_Opcode B_Value
----- ----------- -------- ------- -------- -------
0 7 NEQ 0 NEQ 0
1 1 LT 81 NEQ 0
2 0 NEQ 0 NEQ 0
3 0 NEQ 0 NEQ 0
*snip*
您可以看到，在LOU暫存器中，一個(gt， X)元組被程式設計為(LT， X+1)。
附註：只有將L4Ops應用於介面時，才會將其程式設計到LOU暫存器中。如果使用L4Ops建立ACL（沒有實際應用於介面的ACL），則它不會將適用的L4Ops程式設計到LOU暫存器中。
從介面VLAN 1中刪除ACL，然後再次檢視LOU暫存器：
Sup2T(config)#int vlan 1
Sup2T(config-if)#no ip access-group a3 in
Sup2T#show platform software acl lou
LOUs Registers (shadow copies)
Index Type A_Op A_Val A_Cnt B_Op B_Val B_Cnt
----- -------- ---- ----- ----- ---- ----- -----
0PKT_QOS_GI A is free. NEQ 0 1
1 B & A are free
2 B & A are free
3 B & A are free
4 B & A are free
*snip*
Sup2T#show platform hardware acl lou
Dumping h/w lou values
Index lou_mux_sel A_Opcode A_Value B_Opcode B_Value
----- ----------- -------- ------- -------- -------
0 7 NEQ 0 NEQ 0
1 1 NEQ 0 NEQ 0
2 0 NEQ 0 NEQ 0
3 0 NEQ 0 NEQ 0
*snip*
案例研#1 — 具有TCP標誌的ACL
TCP標誌具有在LOU暫存器範圍內分配的一組特殊暫存器。您可以通過show platform software acl capmap mapping命令檢視此範圍，如下所示：
Sup2T#show platform software acl capmap mapping
L4op_sel value Reference
============== =========
0 ------ LOU0 B register
1 ------ LOU0 A register
2 ------ LOU1 B register
3 ------ LOU1 A register
..... ..............
..... ..............
206 ----- LOU103 B register
207 ----- LOU103 A register
208 ----- Global format match for global acl
209 ----- Group id present
210 ----- L4_hdr_vld
211 ----- Mpls_plus_ip_pkt
212 ----- ife/ofe for direction
(213-223) ---- Reserved
(224-239) ---- 16 TCP flags map
(240-255) ---- 16 IPv6 ext header map
L4op_sel值224-239可用於TCP標誌，這為您提供了一組可供使用的16個暫存器。以下是一個簡單的例子來說明這一點。此ACL的定義為：
Sup2T(config)#ip access-list extended a13
Sup2T(config-ext-nacl)#permit tcp host 192.168.13.10 host 192.168.13.20 syn
Sup2T(config-ext-nacl)#exit
將此入站應用於介面VLAN 13:
Sup2T(config)#int vlan 13
Sup2T(config-if)#ip access-group a13 in
Sup2T(config-if)#end
Sup2T#show platform hardware acl entry interface vlan 13 security in ip detail
mls_if_index:2000000D dir:0 feature:0 proto:0
pass#0 features
UAPRSF: U-urg, A-ack, P-psh, R-rst, S-syn, F-fin
MLGFI: M-mpls_plus_ip_pkt, L-L4_hdr_vld, G-gpid_present,F-global_fmt_match, I-ife/ofe
's' means set; 'u' means unset; '-' means don't care
----------------------------------------------------------------
---------------------------------------------------------------
---------------------------------------------------------------
--------
I INDEX LABEL FS ACOS AS IP_SA SRC_PORT
IP_DA DST_PORT F FF L4PROT TCP-F:UAPRSF MLGFI OtherL4OPs
RSLT CNT
----------------------------------------------------------------
----------------------------------------------------------------
----------------------------------------------------------------
------
fno:0
tcam:B, bank:1, prot:0 Aces
I V 32545 13 0 0 0 192.168.13.10 - 192.168.13.20
- 0 0 1 ANY:----s- ----- - 0x0000000000000038
0
I M 32545 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
- 0 0 0xF
I V 32546 13 0 0 0 192.168.13.10 - 192.168.13.20
- 1 0 1 - ----- - 0x0000000000000038
0
I M 32546 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
- 1 0 0xF
I V 32547 13 0 0 0 0.0.0.0 - 0.0.0.0
- 0 0 0 - ----- - 0x0000000040000038
0
I M 32547 0x1FFF 0 0x00 0x000 0.0.0.0 - 0.0.0.0
- 0 0 0x0
Sup2T#show platform software acl capmap tcam B label 13
Shadow Capmap Table Entry For TCAM B
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ---------------- ----------------
---------------- ---------------- ---------------- ---------------- -----------
----- ----------------
13 8 212/0/1 Free Free Free
Free Free Free Free Free 224/0/1
在此示例中，TCP標誌被程式設計在暫存器224中（這對應於用於TCP標誌的第一可用暫存器）。 此值的聚合計數與具有相同TCP標誌的TCP流（讀取ACE）數相對應。
將另一個ACE新增到當前ACL a13。它應具有不同的TCP標誌：
Sup2T(config)#ip access-list extended a13
Sup2T(config-ext-nacl)#permit tcp host 192.168.1.1 host 192.168.1.2 ack
Sup2T(config-ext-nacl)#exit
如果再次檢視capmap表，您會看到使用另一個TCP暫存器：
Sup2T#show platform software acl capmap tcam b label 13
Shadow Capmap Table Entry For TCAM B
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ---------------- ----------------
---------------- ---------------- ---------------- ---------------- -----------
----- ----------------
13 7 212/0/1 Free Free Free
Free Free Free Free 225/0/1 224/0/1
如你所見，程式設計是根據標誌進行的；對於每個標誌，都使用獨立的TCP暫存器，並且您對此進行計數。這意味著，對於每個標誌，您還可以使用一個capmap條目。這進一步表明，從技術上講，您的ACL中實際上不能超過九個標誌，否則您將達到capmap限制（16個標誌TCP限制）。
放大TCP標誌，以便達到TCP暫存器限制以檢視發生的情況。以下範例顯示為了達到100%的TCP註冊使用率，已設定好幾個ACL並將其套用到不同的介面VLAN，如下所示：
Sup2T#show platform hardware capacity acl
Classification Mgr Tcam Resources
Key: Ttlent - Total TCAM entries, QoSent - QoS TCAM entries, LOU - LOUs,
RBLent - RBACL TCAM entries, Lbl - Labels, TCP - TCP Flags,
Dstbl - Destinfo Table, Ethcam - Ethertype Cam Table,
ACTtbl - Accounting Table, V6ext - V6 Extn Hdr Table
Module Ttlent QoSent RBLent Lbl LOU TCP Dstbl Ethcam ACTtbl V6ext
1 3% 7% 0% 1% 96% 100% 1% 0% 0% 0%
3 3% 7% 0% 1% 96% 100% 1% 0% 0% 0%
4 3% 7% 0% 1% 96% 100% 1% 0% 0% 0%
6 3% 7% 0% 1% 96% 100% 2% 0% 0% 0%
在這個階段，如果您決定使用唯一的TCP標誌（或使其成為唯一的TCP標誌的組合）配置另一個ACL並將其應用於介面，則必須將新的TCP標誌（或標誌的組合）程式設計到TCP暫存器。但是，沒有可用的硬體暫存器。在這種情況下，您可以橋接整個介面。
Sup2T(config)#ip access-list extended a29
Sup2T(config-ext-nacl)#permit tcp host 192.168.1.1 host 192.168.1.2 psh rst
Sup2T(config-if)#int vlan 29
Sup2T(config-if)#ip access-group a29 in
*Oct 6 13:57:47.612: %FMCORE-4-RACL_REDUCED: Interface Vlan29 routed traffic
will be software switched in ingress direction. L2 features may not be applied
at the interface
Sup2T#show platform hardware acl entry interface vlan 29 security in ip
mls_if_index:2000001D dir:0 feature:0 proto:0
pass#0 features
fno:0
tcam:B, bank:1, prot:0 Aces
Bridge ip any any
案例研#2- 100% LOU暫存器使用
請記住，LOU是有限資源 — 您也可能耗盡這些資源的空間。您可以使用以下命令監控LOU使用情況：
Sup2T#show platform hardware capacity acl
Classification Mgr Tcam Resources
Key: Ttlent - Total TCAM entries, QoSent - QoS TCAM entries, LOU - LOUs,
RBLent - RBACL TCAM entries, Lbl - Labels, TCP - TCP Flags,
Dstbl - Destinfo Table, Ethcam - Ethertype Cam Table,
ACTtbl - Accounting Table, V6ext - V6 Extn Hdr Table
Module Ttlent QoSent RBLent Lbl LOU TCP Dstbl Ethcam ACTtbl V6ext
1 2% 7% 0% 1% 1% 0% 1% 0% 0% 0%
3 2% 7% 0% 1% 1% 0% 1% 0% 0% 0%
4 2% 7% 0% 1% 1% 0% 1% 0% 0% 0%
6 2% 7% 0% 1% 1% 0% 2% 0% 0% 0%
擴展ACL以使用更多LOU。安裝多個ACL後(使用range命令，該命令需要兩個LOU暫存器（A和B），此示例顯示96%的LOU使用情況：
Sup2T#show platform hardware capacity acl
Classification Mgr Tcam Resources
Key: Ttlent - Total TCAM entries, QoSent - QoS TCAM entries, LOU - LOUs,
RBLent - RBACL TCAM entries, Lbl - Labels, TCP - TCP Flags,
Dstbl - Destinfo Table, Ethcam - Ethertype Cam Table,
ACTtbl - Accounting Table, V6ext - V6 Extn Hdr Table
Module Ttlent QoSent RBLent Lbl LOU TCP Dstbl Ethcam ACTtbl V6ext
1 3% 7% 0% 1% 96% 0% 1% 0% 0% 0%
3 3% 7% 0% 1% 96% 0% 1% 0% 0% 0%
4 3% 7% 0% 1% 96% 0% 1% 0% 0% 0%
6 3% 7% 0% 1% 96% 0% 2% 0% 0% 0%
建立另一個ACL並將其應用到導致LOU使用率超過100%的介面。
Sup2T(config)#ip access-list extended a12
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1401 1410
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1411 1420
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1421 1430
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1431 1440
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1441 1450
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1451 1460
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1461 1470
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1471 1480
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1481 1490
Sup2T(config-ext-nacl)#$68.14.1 host 192.168.14.2 range 1491 1500
Sup2T(config-ext-nacl)#exit
Sup2T(config)#int vlan 12
Sup2T(config-if)#ip access-group a12 in
該示例達到了100%的LOU使用率；但是請注意，未收到錯誤消息。
Sup2T#show platform hardware capacity acl
Classification Mgr Tcam Resources
Key: Ttlent - Total TCAM entries, QoSent - QoS TCAM entries, LOU - LOUs,
RBLent - RBACL TCAM entries, Lbl - Labels, TCP - TCP Flags,
Dstbl - Destinfo Table, Ethcam - Ethertype Cam Table,
ACTtbl - Accounting Table, V6ext - V6 Extn Hdr Table
Module Ttlent QoSent RBLent Lbl LOU TCP Dstbl Ethcam ACTtbl V6ext
1 3% 7% 0% 1% 100% 0% 1% 0% 0% 0%
3 3% 7% 0% 1% 100% 0% 1% 0% 0% 0%
4 3% 7% 0% 1% 100% 0% 1% 0% 0% 0%
6 3% 7% 0% 1% 100% 0% 2% 0% 0% 0%
這是另一個測試。現在LOU為100%，使用非常簡單的L4Op嘗試將其安裝到介面。設定此ACL:
Sup2T#show ip access-lists a13
Extended IP access list a13
10 permit tcp host 192.168.14.1 host 192.168.14.2 range 1600 1650
將此入站應用於介面VLAN 13。
Sup2T#show run int vlan 13
Building configuration...
Current configuration : 87 bytes
!
interface Vlan13
ip address 192.168.13.1 255.255.255.0
ip access-group a13 in
end
現在檢視此VLAN的TCAM:
Sup2T#show platform hardware acl entry interface vlan 13 sec in ip
mls_if_index:2000000D dir:0 feature:0 proto:0
pass#0 features
fno:0
tcam:B, bank:0, prot:0 Aces
Permit tcp host 192.168.14.1 host 192.168.14.2 eq 1650
Permit tcp host 192.168.14.1 host 192.168.14.2 range 1648 1649
Permit tcp host 192.168.14.1 host 192.168.14.2 range 1632 1647
Permit tcp host 192.168.14.1 host 192.168.14.2 range 1600 1631
Permit tcp host 192.168.14.1 host 192.168.14.2 fragments
L3_Deny ip any any
L4Ops已擴展。如果您檢視此TCAM標籤的capmap表，您會看到未安裝任何內容。
Sup2T#show platform hardware acl entry interface vlan 13 sec in ip detail
mls_if_index:2000000D dir:0 feature:0 proto:0
pass#0 features
UAPRSF: U-urg, A-ack, P-psh, R-rst, S-syn, F-fin
MLGFI: M-mpls_plus_ip_pkt, L-L4_hdr_vld, G-gpid_present,F-global_fmt_match, I-ife/ofe
's' means set; 'u' means unset; '-' means don't care
---------------------------------------------------------------
---------------------------------------------------------------
---------------------------------------------------------------
---------
I INDEX LABEL FS ACOS AS IP_SA SRC_PORT
IP_DA DST_PORT F FF L4PROT TCP-F:UAPRSF MLGFI OtherL4OPs
RSLT CNT
----------------------------------------------------------------
----------------------------------------------------------------
----------------------------------------------------------------
------
fno:0
tcam:B, bank:0, prot:0 Aces
I V 16136 14 0 0 0 192.168.14.1 - 192.168.14.2
1650 0 0 1 - ----- - 0x0000000000000038
0
I M 16136 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
0xFFFF 0 0 0xF
I V 16137 14 0 0 0 192.168.14.1 - 192.168.14.2
1648 0 0 1 - ----- - 0x0000000000000038
0
I M 16137 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
0xFFFE 0 0 0xF
I V 16138 14 0 0 0 192.168.14.1 - 192.168.14.2
1632 0 0 1 - ----- - 0x0000000000000038
0
I M 16138 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
0xFFF0 0 0 0xF
I V 16139 14 0 0 0 192.168.14.1 - 192.168.14.2
1600 0 0 1 - ----- - 0x0000000000000038
0
I M 16139 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
0xF
I V 16140 14 0 0 0 192.168.14.1 - 192.168.14.2
- 1 0 1 - ----- - 0x0000000000000038
0
Sup2T#show platform software acl capmap tcam B label 14
Shadow Capmap Table Entry For TCAM B
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ---------------- ----------------
---------------- ---------------- ---------------- ---------------- -----------
----- ----------------
14 9 212/0/1 Free Free Free
Free Free Free Free Free
Free
以下是對發生情況的解釋。由於LOU暫存器已滿，因此您無法再在此安裝任何新的L4Ops，並且在capmap表中無法引用任何內容。在這個階段，您仍會嘗試通過擴展L4Ops在TCAM中安裝。如果L4Ops不可擴展，則軟體會按照指定方向切換整個介面。
100%的LOU暫存器使用意味著什麼？TCAM開始快速填充（由於L4Op擴展）。 如果嘗試安裝非可擴展L4Ops，則使用當前實施時，整個介面會橋接軟體。
現在的情況是，只有當您在這種情況下嘗試安裝不可擴展的L4Op時，才會生成錯誤。此範例修改了應用於介面VLAN 13的目前ACL a13，並新增了不可擴充的L4Op。
Sup2T(config)#ip access-list extended a13
Sup2T(config-ext-nacl)#permit tcp host 192.168.14.1 host 192.168.14.2 dscp 40
Oct 5 04:50:13.104: %FMCORE-4-RACL_REDUCED: Interface Vlan13 routed traffic will
be software switched in ingress direction. L2 features may not be applied at the
interface
Oct 5 04:50:13.096: %EARL_CM-DFC3-5-NOLOU: No free LOU entry available on the EARL
Oct 5 04:50:13.096: %EARL_CM-DFC1-5-NOLOU: No free LOU entry available on the EARL
Oct 5 04:50:13.096: %EARL_CM-DFC4-5-NOLOU: No free LOU entry available on the EARL
Sup2T#show platform hardware acl entry interface vlan 13 security in ip
mls_if_index:2000000D dir:0 feature:0 proto:0
pass#0 features
fno:0
tcam:B, bank:0, prot:0 Aces
Bridge ip any any
案例研究#3 — 使用L4Ops的QoS程式設計
QoS原則也可能參考L4Ops;必須像安裝任何其他L4Op一樣安裝這些L4Op。這意味著每個介面，即使對於您的QoS策略，您也受到capmap表和LOU固有的限制。以下範例以小幅方式說明此情況：
Sup2T#show ip access-lists a1
Extended IP access list a1
10 permit tcp host 192.168.1.10 host 192.168.2.10 dscp ef
Sup2T#show class-map a1-class
Class Map match-all a1-class (id 37)
Match access-group name a1
Sup2T#show policy-map a1-policy
Policy Map a1-policy
Class a1-class
police cir 80000 bc 2500
conform-action transmit
exceed-action drop
此示例有一個與類對映匹配的策略對映，該類對映呼叫訪問清單a1，該訪問清單匹配從192.168.1.10到192.168.2.10的流量，該流量標有加速轉發(EF)。 DSCP值上的匹配是非可擴展的L4Op;這需要將其程式設計到LOU暫存器中，並通過capmap表中的條目進行引用。此策略對映現在安裝到gig3/23的入站方向。
Sup2T#show run int gig3/23
Building configuration...
Current configuration : 176 bytes
!
interface GigabitEthernet3/23
switchport
switchport trunk allowed vlan 1-30
switchport mode trunk
service-policy input a1-policy
end
要檢視介面的QoS程式設計，請使用以下命令：
Sup2T#show platform hardware acl entry interface gig3/23 qos in ip module 3
mls_if_index:8096000 dir:0 feature:1 proto:0
pass#0 features
fno:0
tcam:A, bank:0, prot:0 Aces
0x0000E0100000D00B tcp host 192.168.1.10 host 192.168.2.10 dscp eq 46
0x000000000080D00B ip any any
詳述此命令可為您提供在此介面上使用的TCAM標籤。
Sup2T#show platform hardware acl entry interface gig3/23 qos in ip detail module 3
mls_if_index:8096000 dir:0 feature:1 proto:0
pass#0 features
UAPRSF: U-urg, A-ack, P-psh, R-rst, S-syn, F-fin
MLGFI: M-mpls_plus_ip_pkt, L-L4_hdr_vld, G-gpid_present,F-global_fmt_match, I-ife/ofe
's' means set; 'u' means unset; '-' means don't care
-----------------------------------------------------------------------
-----------------------------------------------------------------------
--------------------------------------------------------
I INDEX LABEL FS ACOS AS IP_SA SRC_PORT
IP_DA DST_PORT F FF L4PROT TCP-F:UAPRSF MLGFI OtherL4OPs
RSLT CNT
------------------------------------------------------------------------------------
------------------------------------------------------------------------------------
------------------------------
fno:0
tcam:A, bank:0, prot:0 Aces
I V 16238 2 0 0 0 192.168.1.10 - 192.168.2.10
- 0 0 1 - ----- dscp=46; 0x0000E0100000D00B
0
I M 16238 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
- 0 0 0xF
I V 16239 2 0 0 0 0.0.0.0 - 0.0.0.0
- 0 0 0 - ----- - 0x000000000080D00B
0
I M 16239 0x1FFF 0 0x00 0x000 0.0.0.0 - 0.0.0.0
- 0 0 0x0
使用的TCAM標籤為2。請立即檢視capmap表：
Sup2T#show platform software acl capmap tcam A label 2 module 3
Shadow Capmap Table Entry For TCAM A
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ---------------- ----------------
---------------- ---------------- ---------------- ---------------- -----------
----- ----------------
2 8 212/0/1 Free Free Free
Free Free Free Free Free 2/1/1
附註：對於QoS TCAM，必須指定模組編號。如果沒有此項，輸出將不會產生任何結果。
Sup2T#show platform software acl capmap mapping
L4op_sel value Reference
============== =========
0 ------ LOU0 B register
1 ------ LOU0 A register
2 ------ LOU1 B register
3 ------ LOU1 A register
*snip*
LOU值2指向LOU1，暫存器B。您可以使用以下命令確認此程式設計：
Sup2T#show platform hardware acl lou
Dumping h/w lou values
Index lou_mux_sel A_Opcode A_Value B_Opcode B_Value
----- ----------- -------- ------- -------- -------
0 7 NEQ 0 NEQ 0
1 4 NEQ 0 NEQ 46
2 1 NEQ 0 NEQ 0
*snip*
擴大配置。
Sup2T#show ip access-lists a1
Extended IP access list a1
10 permit tcp host 192.168.1.10 host 192.168.2.10 dscp ef
20 permit tcp host 192.168.2.11 host 192.168.2.11 dscp ef
30 permit tcp host 192.168.3.11 host 192.168.3.11 dscp ef
40 permit tcp host 192.168.4.11 host 192.168.4.11 dscp ef
50 permit tcp host 192.168.5.11 host 192.168.5.11 dscp ef
60 permit tcp host 192.168.6.11 host 192.168.6.11 dscp ef
70 permit tcp host 192.168.7.11 host 192.168.7.11 dscp ef
80 permit tcp host 192.168.8.11 host 192.168.8.11 dscp ef
Sup2T#show platform software acl capmap tcam A label 2 module 3
Shadow Capmap Table Entry For TCAM A
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ----------------
---------------- ---------------- ---------------- ----------
------ ---------------- ---------------- ----------------
2 8 212/0/1 Free Free Free
Free Free Free Free Free 2/1/8
這不再使用任何條目；相反，它會根據第一個條目本身增加聚合引用計數，這很有意義。從capmap表和LOU暫存器角度來看，無需考慮源和目標。這僅儲存L4Op資訊。由於它與所有ACE上的相同DSCP值匹配，因此該DSCP值只需要一個條目。
請修改該設定，以便使用九個不同的DSCP值。
Sup2T#show ip access-lists a1
Extended IP access list a1
10 permit tcp host 192.168.1.10 host 192.168.2.10 dscp af11
20 permit tcp host 192.168.2.11 host 192.168.2.11 dscp af12
30 permit tcp host 192.168.3.11 host 192.168.3.11 dscp af13
40 permit tcp host 192.168.4.11 host 192.168.4.11 dscp af21
50 permit tcp host 192.168.5.11 host 192.168.5.11 dscp af22
60 permit tcp host 192.168.6.11 host 192.168.6.11 dscp af23
70 permit tcp host 192.168.7.11 host 192.168.7.11 dscp af31
80 permit tcp host 192.168.8.11 host 192.168.8.11 dscp af32
90 permit tcp host 192.168.9.11 host 192.168.9.11 dscp af33
現在，當您檢視capmap表時，可以看到它已滿：
Sup2T#show platform software acl capmap tcam A label 2 module 3
Shadow Capmap Table Entry For TCAM A
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2]
[1] [0]
----- ----- ---------------- ---------------- ---------------- -----------
----- ---------------- ---------------- ---------------- ----------------
---------------- ----------------
2 0 212/0/1 10/1/1 9/1/1 8/1/1
7/1/1 6/1/1 5/1/1 4/1/1 3/1/1
2/1/1
以下是嘗試安裝另一個不可擴充的L4Op型專案時發生的情況：
Sup2T(config-ext-nacl)#permit tcp host 192.168.10.11 host 192.168.10.11 dscp 2
Sup2T(config-ext-nacl)#end
%QM-4-TCAM_ENTRY: Hardware TCAM entry programming failed for slot 3 intf Gi3/23
dir IN: <CONFIG_UPDATE_REQ> TCAM Req Error: FAIL (4): Low TCAM Entries (1)
%QM-4-TCAM_ENTRY: Hardware TCAM entry programming failed for slot 3 intf Gi3/23
dir IN: <CONFIG_UPDATE_REQ> TCAM Req Error: FAIL (4): Low TCAM Entries (1)
%QM-4-TCAM_ENTRY: Hardware TCAM entry programming failed for slot 3 intf Gi3/23
dir IN: <CONFIG_UPDATE_REQ> TCAM Req Error: FAIL (4): Low TCAM Entries (1)
%QM-4-TCAM_ENTRY: Hardware TCAM entry programming failed for slot 3 intf Gi3/23
dir IN: <CONFIG_UPDATE_REQ> TCAM Req Error: FAIL (4): Low TCAM Entries (1)
%QM-4-TCAM_ENTRY: Hardware TCAM entry programming failed for slot 3 intf Gi3/23
dir IN: <CONFIG_UPDATE_REQ> TCAM Req Error: FAIL (4): Low TCAM Entries (1)
%FMCORE-6-RACL_ENABLED: Interface GigabitEthernet3/23 routed traffic is hardware
switched in ingress direction
Oct 20 17:12:54.304: %EARL_CM-DFC3-5-NOCAPMAP: No free capmap entry available
現在檢視此介面的TCAM:
Sup2T#show platform hardware acl entry interface gig3/23 qos in ip module 3
mls_if_index:8096000 dir:0 feature:1 proto:0
Couldnt find feature for mls_if_index 0x8096000, dir 0
此介面的TCAM中不再安裝任何QoS功能。
請注意，標籤不佔用任何L4Op。因此，如果您有一個沒有L4Ops的簡單ACL，並且您將DSCP值設定為match，則不會為此使用LOU暫存器。以下是範例：
Sup2T#show policy-map a1-policy
Policy Map a1-policy
Class a1-class
set dscp ef
Sup2T#show class-map a1-class
Class Map match-all a1-class (id 37)
Match access-group name a1
Sup2T#show ip access-lists a1
Extended IP access list a1
10 permit tcp host 192.168.1.1 host 192.168.2.1
這適用於介面gig3/23:
Sup2T#show run interface gig3/23
Building configuration...
Current configuration : 176 bytes
!
interface GigabitEthernet3/23
switchport
switchport trunk allowed vlan 1-30
switchport mode trunk
service-policy input a1-policy
end
Sup2T#show platform hardware acl entry interface gig3/23 qos in ip detail module 3
mls_if_index:8096000 dir:0 feature:1 proto:0
pass#0 features
UAPRSF: U-urg, A-ack, P-psh, R-rst, S-syn, F-fin
MLGFI: M-mpls_plus_ip_pkt, L-L4_hdr_vld, G-gpid_present,F-global_fmt_match, I-ife/ofe
's' means set; 'u' means unset; '-' means don't care
----------------------------------------------------------------
----------------------------------------------------------------
---------------------------------------------------------------
-------
I INDEX LABEL FS ACOS AS IP_SA SRC_PORT
IP_DA DST_PORT F FF L4PROT TCP-F:UAPRSF MLGFI OtherL4OPs
RSLT CNT
---------------------------------------------------------------
---------------------------------------------------------------
---------------------------------------------------------------
---------
fno:0
tcam:A, bank:0, prot:0 Aces
I V 16238 3 0 0 0 192.168.1.1 - 192.168.2.1
- 0 0 1 - ----- - 0x0000E010005D100B
0
I M 16238 0x1FFF 0 0x00 0x000 255.255.255.255 - 255.255.255.255
- 0 0 0xF
I V 16239 3 0 0 0 0.0.0.0 - 0.0.0.0
- 0 0 0 - ----- - 0x000000000080D00B
0
I M 16239 0x1FFF 0 0x00 0x000 0.0.0.0 - 0.0.0.0
- 0 0 0x0
Sup2T#show platform software acl capmap tcam A label 3 module 3
Shadow Capmap Table Entry For TCAM A
-----------------------------------------------------------------------
Output in a RST/INV/CNT format: RST - result value; INV - inverted;
CNT - aggregated reference account;
CBF - number of free cap bits (one per entry);
Free items are not shown
-----------------------------------------------------------------------
Index CBF [9] [8] [7] [6]
[5] [4] [3] [2] [1]
[0]
----- ----- ---------------- ---------------- ---------------- ----------------
---------------- ---------------- ---------------- ---------------- -----------
----- ----------------
3 9 212/0/1 Free Free Free
Free Free Free Free Free
Free
案例研#4 — 雙堆疊ACL導致CAPMAP耗盡
在本例中，有一個介面配置為同時使用IPv4和IPv6 ACL，這樣在介面啟動時就會產生以下錯誤：
%EARL_CM-5-NOCAPMAP: No free capmap entry available
%FMCORE-4-RACL_REDUCED: Interface Vlan500 routed traffic will be software switched in ingress direction.
L2 features may not be applied at the interface
但是，如果只刪除IPv4 ACL，然後將其重新讀入同一介面，則硬體程式設計將成功完成，並且不再生成錯誤。
在本範例中，這些ACL是在SVI下設定的：
Switch#sh ip access-lists INGRESS
Extended IP access list INGRESS
10 permit tcp host 1.1.1.1 host 1.1.1.2 range 1 10
20 permit tcp host 1.1.1.3 host 1.1.1.4 range 10 ftp-data
30 permit tcp host 2.1.1.3 host 2.1.1.4 range 30 40
40 permit tcp host 2.1.1.3 host 2.1.1.4 range 85 100
50 permit tcp host 2.1.1.3 host 10.1.1.1 range 222 333
60 permit tcp host 20.5.4.3 host 10.100.100.1 range www 443
70 permit tcp host 200.50.4.3 host 11.11.11.1 range 800 813
80 permit tcp host 200.50.40.30 host 12.12.11.1 range 50 60
90 permit tcp host 13.13.13.3 host 14.14.14.3 range gopher 90
100 permit tcp host 23.23.23.3 host 14.14.10.1 range 123 345
110 permit udp host 123.123.123.1 range 50 60 host 23.23.23.1 range 10 20
120 permit udp host 45.45.43.1 range 1000 1010 host 1.1.1.1 range 50 65
130 permit tcp host 78.78.78.1 range 89 95 host 2.3.4.5 range 1111 1200
140 permit tcp host 5.5.5.50 eq 65000 host 5.4.5.4
150 permit tcp host 5.15.5.150 range 1200 1250 host 1.7.8.4 range 45 65
Switch#show ipv6 access-list DENY-ALL-V6
IPv6 access list DENY-ALL-V6
permit udp FE80::/64 host FF02::66 eq 2000 sequence 10
deny ipv6 any any sequence 20
如上一個範例所示，IPv4 ACL具有超過九種不同的可擴充性L4Op。在只配置了IPv4的介面下，這些介面將根據需要擴展，以便不耗盡capmap表。
在雙協定棧環境中將這些協定程式設計到TCAM硬體時，交換機首先從IPv4 ACL開始。由於capmap表中的可用條目不足，交換機將展開一些可展開的L4Ops，以便在不超出該表的情況下填充capmap表。結果是，現在表中可用的條目數是0，這意味著現在沒有可用條目來程式設計下一個對IPv6 ACL進行程式設計時所需的非擴展L4Op。
僅刪除IPv4 ACL時，capmap表中的空閒條目數量會增加，IPv6 ACL現在已正確程式設計到硬體中，並使用一個新釋放的capmap條目。將IPv4 ACL重新應用到介面配置時，會再次發生相同的擴展。現在，由於IPv6 ACL使用了可用的capmap值，僅擴展了一個額外的IPv4條目。由於此ACL中的所有L4Op均可擴展，因此程式設計成功。
為了防止手動刪除和新增IPv4 ACL以允許條目在硬體中合併，建立了一個增強功能，以更改此類場景中的TCAM合併演算法。如需詳細資訊，請參閱Cisco錯誤ID CSCuq24924。
由於此增強功能，「固定內」版本的軟體現在將在全域性配置中有一個可配置的選項，該選項更改了在雙堆疊IPv4/v6 ACL部署等例項中對L4Ops進行程式設計的方式。這是可以進行的配置更改
Switch(config)#platform hardware acl tcam-exp-logic enable
附註：由於此增強後引入的變化，可擴展L4Ops的擴展速度大於正常擴展速度，因此擴展可能導致TCAM利用率顯著增加。
由思科工程師貢獻
- Aninda ChatterjeeCisco TAC Engineer
意見