Design Safe, Efficient ACLs

The entry of ACL rules via the CLI, web or Avaya Policy Manager does not encourage or enforce any checking beyond correct syntax. The general guideline is that you are configuring a Layer-3 switch, not a firewall. The following are some criteria for designing safe, efficient ACLs and how they affect performance:

• Specify Destination Address: The wildcard feature of rule creation is a convenience but can explode the number of identified Flows. Since the “standard” ACL implies “any” for the destination, it should also be used with care. It is desirable for the wildcard to match a specific set of addresses.
• Use Protocols/Ports Carefully: By pushing the ACL-to-packet matching up one or two levels of the IP stack, it refines the granularity of the Flows to be very specific in what is matched. A source-port range can cause a large number of “micro” Flows to be created.
• Minimize Rules: The number of rules has a direct impact on the CPU effort to match rules to Flows. This is especially true when there is a high frequency of packets that are “walked down” the entire list and don’t match any rules.
• Minimize Searching: The goal is to place the most frequently matched rules toward the beginning of the ACL. This requires a good knowledge of traffic patterns. This can be noticeable as ACLs get longer.
• Permit Management Traffic with High Priority: This include routing updates (unicast for RIP 1, multicast for RIP 2), SNMP (MSNM, HPOV), LDAP (for Cajun Rules/Avaya Policy Manager). Not doing this can cause loss of management connectivity.