How ACL's are applied in TCAM Entries for a SPAN Session and how they use that space.


Recommended Posts

I was searching regarding how many ACL's can be applied on a SPAN Session CISCO 5672UP, for that I have referred to the document mentioned below and there what I have noticed is that it is written that for a SPAN session with single switch port as source with both tx and Rx enable will have : "Current available TCAM entries/2 ". Please explain how many ACL's can be applied to a SPAN Session, how they use TCAM Entries and also how many TCAM entries are available in CISCO 5672UP.

 

Please visit page no. 6 of the Link Mentioned Below :-

https://www9.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5600/sw/system_management/7x/b_5600_System_Mgmt_Config_7x/configuring_span.pdf

aren't homework questions easy anymore?

 

anytime I have an issue with my kids homework due to how they are "teaching" them (stupid common core garbage), I use google to look it up. 

 

If you have problems understanding that google link, or for that matter how to google (I cannot teach you how to scan/look for keywords in documents as that is a learned trait apparently...if I could do that I could teach my relatively new hire who can't do that, they read word for word and takes them weeks to find information that takes me seconds or minutes...this goes along with knowing how to google). 

 

If this continues on how to do your homework, I will have to lock it up.   If you need further explanation on something, feel free to ask...we are not here to tell you how to do your homework, we are here for technical support.

I need to set up 24 span sessions  on nexus 5672up on 24 10gbps lines. So now I need to apply ip based acl with 2000 ip subnets and one protocol based acl on each of these 24 span sessions. And while I was going through the documentation I was stuck at the wording like tcam/2 or /3 for acl size so I needed to figure out that will my scenario work or not. And on that switch I just need to configure span and nothing else.

So can anyone let me know if the above will work.

I will say this once more, we are not here for your homework.

 

If you really are stuck and you need this done asap, Cisco tac is very responsive and with a site that large and a switch of that magnitude there is a 99.999% chance that you will have that covered under a support agreement. Fwiw, if you are in dire straights you will have a tech on the phone with you in about 15 minutes. 

 

Cisco's documentation horrible, many times they give you 3/4-9/10 of the info you need. 

 

In real life I have never needed 24 span ports active at the same time.  I could never monitor 24 computers at the same time. Span in Cisco world is putting it in mirror or basically a troubleshooting mode so you can see packets go across with a capture tool. I have never needed 24 captures running at the same time.  I have common captures sitting dormant so that if I need to I can enable the capture, but in no means do I ever have more than 1 running at a time.  Usually you are troubleshooting a specific issue or you are capturing all packets on the switch. 

  On 28/01/2017 at 06:13, sc302 said:

there is a 99.999% chance

Expand  

There is ZERO chance they do not have support on such switch with such connections..   If you need to setup something like 24 span ports.. Which I don't even think is possible to be honest..

 

Page 4

"SPAN supports 16 active bi-directional SPAN sessions"

 

You need to call TAC..

 

As to that wording.. That is you current tcam size divided by 2 or 3 or 4 depending on on the criteria in the left column is your limit on number of ACLs you can have.. you don't know what /2 means??  What is 1/2 or 1/3 or 2/4 etc. etc. Fractions not big while you were in school? ;) hehehe

 

 

what if I can use it to setup just 16 span session and setup 2 acl on all of these span session as my first acl will be having 2000 rules i.e. 2000 cidr with /8 and /16 subnets in total and acl 2 will having port 53 permit rules. So will it work on 5672up.

I don't know what is your current

 

"Current Available TCAM Entries"

 

And then divided that by 2..

 

2000 rules in acl...  Seems a bit much - you really need to call tac..

this would never happen in the real world, lab simulations sure. 

 

 

Again we are not here for you homework.

 

But I will give you this bit...ACLs utilized with span ports are rules as to which you are applying to a span port to single out traffic. 

 

If I am looking for email traffic, I can either look for all email traffic between specific ips or I can exclude all email traffic and give me everything else.  ACLs are what defines what traffic is sent to the span port for you to be able to monitor.   I can include all vlans, specific vlans, or have it look for specific traffic.

 

Again, when you enable this you are looking for specific traffic or all traffic...you would never have 24, 16, or even 12 ports going at the same time unless you have 12 engineers looking at 12 completely different issues.  You would have to be really really big to have a need for this and have a really really really really big switch.   This goes above and beyond a 9 blade chassis.  I have been at sites that have 10's of 1000's of computers, never has there been more than 2 span ports enabled at the same time....rarely ever more than 1, there really is no need for it.  When filtering further, most people have the software on their computers filter out components further.   Always has been testing, troubleshooting, and verification....I don't know why you would ever have more than 2 dozen or so rules in your ACL, that is a lot to write out/single out.  At that point, I would capture everything then use the software on the capture computer to filter out the traffic I wouldn't want or would need.

While you might want to duplicate traffic via a span to send traffic to some place for monitoring, etc.  I am with sc302.. I am having a hard time trying to come up with a scenario where you would use so many spans at the same time.

 

If you really need to monitor traffic that is flowing on that many ports at the same time - then you would normally use external taps vs having the switch do it.  Span ports can be a real hit on the performance of the switch..  ACLs on the span normally would be used to lower the traffic volume to get it inline with what your monitoring software could handle by weeding out all but the traffic your interested in, etc.  This is why they put limits on what you can do via span..

 

Other than some odd ball homework question I am not understanding how this could be a real world problem or something your trying to accomplish.  If so you seem to be going about it the wrong way.  What is it you want to do exactly and we can discuss ways to accomplish it.

 

To me 24 span ports on even the big baddest switch would seem to be a bad idea..  Especially if think you need to put 1000's of ACL's on it??

 

If this is something that is real world - again you should contact cisco TAC..  They can answer any questions you might have on doing such a thing, if possible then how you would do it, etc. etc.  While I am all for discussing how best to accomplish something - without details of what that is its hard to discussing.. If your just asking if you can do 24 span ports with 1000's of ACL's my easy answer is NO! ;) 

  On 31/01/2017 at 12:44, John Teacake said:
Yeah, Why you would need to span that much data I dont know, Maybe your the NSA though. 

They would just forward all data. They would not have 1000 rules or have 24 span ports. 1 port, mirror all data, go.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Not after SP1. There was a legitimate file copy issue prior.
    • Microsoft 365 security in the spotlight after Washington Post hack by Paul Hill The Washington Post has come under cyberattack which saw Microsoft email accounts of several journalists get compromised. The attack, which was discovered last Thursday, is believed to have been conducted by a foreign government due to the topics the journalists cover, including national security, economic policy, and China. Following the hack, the passwords on the affected accounts were reset to prevent access. The fact that a Microsoft work email account was potentially hacked strongly suggests The Washington Post utilizes Microsoft 365, which makes us question the security of Microsoft’s widely used enterprise services. Given that Microsoft 365 is very popular, it is a hot target for attackers. Microsoft's enterprise security offerings and challenges As the investigation into the cyberattack is still ongoing, just how attackers gained access to the accounts of the journalists is unknown, however, Microsoft 365 does have multiple layers of protection that ought to keep journalists safe. One of the security tools is Microsoft Defender for Office 365. If the hackers tried to gain access with malicious links, Defender provides protection against any malicious attachments, links, or email-based phishing attempts with the Advanced Threat Protection feature. Defender also helps to protect against malware that could be used to target journalists at The Washington Post. Another security measure in place is Entra ID which helps enterprises defend against identity-based attacks. Some key features of Entra ID include multi-factor authentication which protects accounts even if a password is compromised, and there are granular access policies that help to limit logins from outside certain locations, unknown devices, or limit which apps can be used. While Microsoft does offer plenty of security technologies with M365, hacks can still take place due to misconfiguration, user-error, or through the exploitation of zero-day vulnerabilities. Essentially, it requires efforts from both Microsoft and the customer to maintain security. Lessons for organizations using Microsoft 365 The incident over at The Washington Post serves as a stark reminder that all organizations, not just news organizations, should audit and strengthen their security setups. Some of the most important security measures you can put in place include mandatory multi-factor authentication (MFA) for all users, especially for privileged accounts; strong password rules such as using letters, numbers, and symbols; regular security awareness training; and installing any security updates in a timely manner. Many of the cyberattacks that we learn about from companies like Microsoft involve hackers taking advantage of the human in the equation, such as being tricked into sharing passwords or sharing sensitive information due to trickery on behalf of the hackers. This highlights that employee training is crucial in protecting systems and that Microsoft’s technologies, as advanced as they are, can’t mitigate all attacks 100 percent of the time.
    • Comments like these are genuinely fascinating to me because they're so far from anything I experience as a daily user of Win 11 since the first public beta. AI stuff? Have it turned off completely, never pops up anywhere. Forced MS account? Yes, they strongly recommend it and kinda push it lately during big updates and such, but it's still not forced. Pop up dialogs when you're not using Edge? Yeah, I vaguely remember seeing some reminders about using Edge a long time ago. I just clicked them away and kept using Vivaldi as usual (but frankly, I'd still much rather use Edge than Chrome - which I'm forced to use at work - I've grown to dislike Google a lot more than Microsoft lately, even if I am still deeply rooted in their ecosystem unfortunately). Awful context menus? A single simple tweak will get you the old context menus. Search in Windows using Bing? People use search in Windows for anything else than to search for local files or apps? Why? I just don't get a lot of the complains people have about Win 11.
    • Nice, but if you change the colour, the folder no longer shows image preview on the actual folder icon.
    • Taiwan hits Huawei and SMIC with new export restrictions by David Uzondu Taiwan has added Huawei and Semiconductor Manufacturing International Corporation, or SMIC, to its export control entity list. According to CNBC, this means companies in Taiwan now need a special license to ship certain high-tech goods to these two mainland Chinese firms. The conflict has been escalating for a while. The United States government, for instance, has been going after Huawei since at least 2019, putting the telecom equipment maker on its own Entity List over national security fears. The worry has always been about Huawei's connections to the Chinese government and the potential for its network gear to be used for spying. The United Kingdom eventually followed suit, ordering all Huawei 5G equipment to be ripped out of its networks by 2027. Remember, in December 2020, the US added SMIC to its Entity List over its alleged ties to the Chinese military. The goal was to choke off the chipmaker's access to the tools it needs to produce the most advanced semiconductors. Despite all the pressure, the two firms managed to collaborate and produce a 7nm chip for Huawei's Mate 60 phone, which annoyed some people in Washington who thought the sanctions had completely crippled China's chipmaking ambitions. This new blacklisting from Taiwan just tightens the screws even more. Last year, research firm TechInsights found a TSMC-made chip inside a Huawei AI training card. That was a huge "oh no" moment because it showed that, despite all the American restrictions, Huawei was still getting its hands on advanced Taiwanese silicon. That discovery led directly to the U.S. Commerce Department leaning on TSMC to shut down access for Chinese clients to specific AI chips. Huawei had cleverly exploited loopholes to hoard millions of GPU dies for its Ascend AI chip program, a direct attempt to build a homegrown alternative to Nvidia's dominant hardware. For Taiwan, this feels less like a trade issue and more like a matter of survival. The island's lead in chipmaking, largely thanks to TSMC, is often seen as its "silicon shield." The idea is that global reliance on Taiwanese chips makes any military action by China a huge risk for the world. Letting its most advanced tech reach the country that threatens its very existence could seriously weaken that shield. Source: CNBC
  • Recent Achievements

    • Explorer
      Legend20 went up a rank
      Explorer
    • One Month Later
      jezzzy earned a badge
      One Month Later
    • First Post
      CSpera earned a badge
      First Post
    • One Month Later
      MIR JOHNNY BLAZE earned a badge
      One Month Later
    • Apprentice
      Wireless wookie went up a rank
      Apprentice
  • Popular Contributors

    1. 1
      +primortal
      617
    2. 2
      ATLien_0
      277
    3. 3
      +FloatingFatMan
      179
    4. 4
      Michael Scrip
      150
    5. 5
      Steven P.
      115
  • Tell a friend

    Love Neowin? Tell a friend!