7200 Router and Turbo ACL

[stevenormoyle]

I am trying to get a better understanding of turbo acl. I have read the following link http://www.cisco.com/en/US/docs/ios/12_1t/12_1t5/feature/guide/dttacl.html#wp1019702.

I know once you enter the access-list compiled a lookup table is created which speeds up the lookup process.

I am would like to know that how the table works in conjunction with the lines in the ACL. For example if a match is found in the lookup table does the router look at the line number of the ACL? When using turbo acl's does the line sequencing in the ACL matter to the lookup table.

When using the command show access-list compiled there are column heading labeled Entries, Config, Fragment, Redundant. I read these as Entries = number of lines in ACL, Config = lines compiled in lookup table, fragment = number lines that are fragmented in the ACL and redundant = number of redundant lines in the ACL.

If I have an entry under fragment or redundant how can one locate those lines in the ACL without having to go line by line. This can be really aggravating process if the ACL is large (1000+ lines).

This is the first time I have worked with the 7200 series. Prior the 3640 was the biggest router I have worked with.

Thanks for any info and help.

[paolo bevilacqua]

Which exact IOS do you have ? If you type "show ip access-list" do you see line number helping you in locating/editing/deleting the desired entry ?

[stevenormoyle]

IOS image is 12.4

[paolo bevilacqua]

So you should have the support for numbered access-lists.

[stevenormoyle]

Thanks. I know I have support for the line numbering in the access list. What I am looking is the information stated in my first post pertaining to how the lookup table works when matching packets and the other items I stated in my post.

[marikakis]

Hello,

This is a most interesting question.

First, in the URL that you posted it is clearly stated that "The Turbo ACL feature compiles the ACLs into a set of lookup tables, while maintaining the first match requirements". The original ACL is transformed, but it is a mandatory requirement for the actually used data structures to behave exactly as expected by the familiar with normal ACLs network operator. Else, we are in trouble and cannot configure what we want.

Second, the Turbo ACL feature takes care of the redundant entries for you. Even if redundant entries do exist in your original ACL, the data structures actually used at the forwarding path do not do redundant checks (to the extent possible). So, from a performance perspective you are quite ok. I suppose you would like some output to tell you which entries are redundant, so you can remove them. I don't know if this is possible or whether it cannot be easily done for some reason.

As far as I know, this feature is based on research work done at Stanford University

"Packet Classification on Multiple Fields" by Gupta and McKeown (1999). (I attach this .pdf that I had dowloaded some time ago because right now it is hard if impossible to browse it from the citeseer website.) In the acknowledgements section you will see that there has been collaboration with people from Cisco. The actual algorithm in Cisco routers might not be exactly the same, but I believe the paper is indicative of the general idea.

This is research paper, so do not expect it to be very easy reading, although I can say that it is much more easy to read than other types of papers. If you are curious for more, just ignore the mathematical formalities. (I once had to present this in class and now I can grasp only the simple stuff :-) Search for the terms backward and forward redundancy, if you are interested. If you have any questions, please do not hesitate to ask.

Kind Regards,

Maria

[stevenormoyle]

Ugh. Thanks for the paper. Just did a quick scan of the file and it made my brain glaze over.

[marikakis]

Sorry about that. Anyway, the line in the ACL does matter when other data structures are used. Preserving initial ACL semantics is mandatory. The redundancies are taken care of by the feature, so you do not have to do the checks yourself (the guys from Standford and Cisco thought this through and the router does it for you). I hope this is clear.

[marikakis]

Hello,

Sorry about messing up with your head. My only excuse is that you seemed to be exploring the Turbo ACL concept very deep. I will try to explain the concept as simply as I can.

The idea is to gradually map a packet (incoming or outgoing) to an action (permit or deny). Let's consider only incoming packets.

We have an ACL with 3 entries (4 with the implicit deny at the end).

access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet

access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1

access-list 101 permit udp host 10.1.1.2 host 172.16.1.1

For the particular ACL we have :

2 options for source address (10.1.1.2 or any other)

2 options for destination address (172.16.1.1 or any other)

3 options for protocol (tcp, udp, any other)

2 options for port (telnet or any other)

Now, a packet arrives. What would you check first? I would check the protocol (shorter than IP address). Let's say this is UDP packet. We directly know this packet can match the last ACL entry or the implicit deny. Let's say we check the source IP and doesn't match 10.1.1.2. We drop packet and are done. No more checks needed. (Compare this to checking competely one entry after the other and imagine an ACL with 1000 entries.)

The algorithm can be more complicated than the example above, but this is the basic idea.

Hope this helps,

M.

[ugmz_gonzalez]

Mrs.a

I read the same document stevenormoyle showed in this forum, but I would like to supplement this article with a question;

I made a list of 3451 lines and applied in two different devices, the first and one a 3725 the second 7200 the same list, the statistics differ as to the fields:
Entries - fragments - redundant

Because when we include two different IOS statistics differ?

I found the document explains how to work with TURBO ACL show bit a bit, but does not explain the fields of statistics, not found any official document that explains these fields until I looked at ciscopedia.

www.tacack.com

Router#show ver
Cisco Internetwork Operating System Software
IOS (tm) 7200 Software (C7200-IS-M), Version 12.2(15)T5,  RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Wed 11-Jun-03 19:39 by eaarmas
Image text-base: 0x60008954, data-base: 0x61BF0000

ROM: ROMMON Emulation Microcode
BOOTLDR: 7200 Software (C7200-IS-M), Version 12.2(15)T5,  RELEASE SOFTWARE (fc1)

Router uptime is 0 minutes
System returned to ROM by unknown reload cause - suspect boot_data[BOOT_COUNT] 0x0, BOOT_COUNT 0, BOOTDATA 19
System image file is "tftp://255.255.255.255/unknown"

cisco 7206VXR (NPE400) processor (revision A) with 245760K/16384K bytes of memory.
Processor board ID 4294967295
R7000 CPU at 150Mhz, Implementation 39, Rev 2.1, 256KB L2, 512KB L3 Cache
6 slot VXR midplane, Version 2.1

Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
1 FastEthernet/IEEE 802.3 interface(s)
125K bytes of non-volatile configuration memory.

65536K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes).
8192K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2142

Router#

Router#show ver
Cisco IOS Software, 3700 Software (C3725-IPVOICE-M), Version 12.3(14)T7, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Wed 22-Mar-06 23:38 by pwade

ROM: ROMMON Emulation Microcode
ROM: 3700 Software (C3725-IPVOICE-M), Version 12.3(14)T7, RELEASE SOFTWARE (fc2)

Router uptime is 1 minute
System returned to ROM by unknown reload cause - suspect boot_data[BOOT_COUNT] 0x0, BOOT_COUNT 0, BOOTDATA 19
System image file is "tftp://255.255.255.255/unknown"

Cisco 3725 (R7000) processor (revision 0.1) with 124928K/6144K bytes of memory.
Processor board ID XXXXXXXXXXX
R7000 CPU at 240MHz, Implementation 39, Rev 2.1, 256KB L2, 512KB L3 Cache
2 FastEthernet interfaces
DRAM configuration is 64 bits wide with parity enabled.
55K bytes of NVRAM.
16384K bytes of ATA System CompactFlash (Read/Write)

Configuration register is 0x2142

Router#