If per access control entry (ACE) accounting is required, the router limits you to 64K ACEs for each access control list (ACL). Otherwise, the available TCAM space defines the ACE limitation. If no TCAM space is available, the ACE is not placed into TCAM and the router uses an ACE equivalent to deny ip any any. When sufficient space becomes available in TCAM, you must first remove the ACL from the interface and then reapply it to activate it.