I don't think ASR1k has LOU concept. In EARL platforms LOU is HW optimisation to handle port-ranges without burning huge amount of TCAM, OPs example showed no port ranges being used which would mean no LOUs being used.
To answer OP's question, yes, it is cheaper in ASR1k (and all HW implementations that I know off) to aggregate the networks to as few entries as possible. However there is often smart algorithm between configuration and HW, which will optimise things for you, so even badly written ACL might end up as well implemented HW rules. In all platforms that I've seen, it is possible to review what actually ended up in HW. This will allow you to easily compare resource cost of your two strategies and gives general insight how ACL is implemented in given hardware, and what will the scale limits be in your use-case. On 21 August 2016 at 00:42, Randy via cisco-nsp <[email protected]> wrote: > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > ---------- Forwarded message ---------- > From: Randy <[email protected]> > To: Satish Patel <[email protected]>, Cisco Network Service Providers > <[email protected]> > Cc: > Date: Sat, 20 Aug 2016 21:38:49 +0000 (UTC) > Subject: Re: [c-nsp] ACL performance question > ----- Original Message ----- > > From: Satish Patel <[email protected]> > To: Cisco Network Service Providers <[email protected]> > Sent: Saturday, August 20, 2016 1:23 PM > Subject: [c-nsp] ACL performance question > > We have ASR1006 Router and we are running ACL on it to allow specific > port to specific server. > > Question is there any ACL performance impact on individual IP vs full > subnet. like following example. > > we have 202.100.100.0/24 subnet now i want to use first 200 IPs for > web server port 80 remaining 55 (whatever) mail service port 25. > > Now how do i tell ACL to isolate them or subnet them? Other option i > have i create individual ACL for each IP like following but question > is does it impact on router performance? > > access-list 102 permit tcp any host 202.100.100.1 eq www > access-list 102 permit tcp any host 202.100.100.2 eq www > access-list 102 permit tcp any host 202.100.100.3 eq www > access-list 102 permit tcp any host 202.100.100.4 eq www > ... > ... > access-list 102 permit tcp any host 202.100.100.201 eq smtp > access-list 102 permit tcp any host 202.100.100.202 eq smtp > > > what would be the best approach here? > ---------------------------------------------------------------------------------------------------- > > You ask *interesting-generic* questions. Answers will vary. > > Generally speaking: > > > a) if acl in question gets implemented in hardware, you will run out of LOU's > before TCAM exhaustion. > b) in software: How many such entries will you have: 4 - your are ok. 1000 - > not so much. ACE's are processed sequentially. > > How about you do a little bit of legwork yourself? > > ./Randy > > _______________________________________________cisco-nsp mailing list > [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
