Extended acl - multiple ports on same acl line

hello
i'm working on a (long) acl and have started looking at putting multiple ports on the same line
e.g.
instead of:
ip access-list extended test3
permit tcp any host 10.10.10.1 eq 80
permit tcp any host 10.10.10.1 eq 443
i'd use:
ip access-list extended test3
permit tcp any host 10.10.10.1 eq 80 443
its shortening the acl considerably but the question is:
does this method reduce the TCAM resources required (compared to writing the acl in long hand)?
what are the maximum number of ports that can be included on the same line - is it platform/ios dependant?
thanks
andy

Hello
No. I went ahead with the acl with multiple ports in each ACE and it worked fine. It was deployed on an old WS-C3750G-24PS-E and worked pretty well. When I checked the tcam on the switch I got the following output:
Cisco3750#show platform tcam utilization
CAM Utilization for ASIC# 0                      Max            Used
                                                         Masks/Values    Masks/values
IPv4 security aces:                          1024/1024         33/33
Note: Allocation of TCAM entries per feature uses
a complex algorithm. The above information is meant
to provide an abstract view of the current TCAM utilization
As there were other ACLs on the switch it was difficult to gauge if the multiple ports per ACE approach to ACLs actually saved any TCAM resources. If you find anything out post back - I'd be interested to hear.
thanks
Andy

Similar Messages

Mail deletes / removes drafts when I try to save multiple messages with same subject line.

Hi,
Running 10.7.5, Mail version 5.3, I find that I cannot save multiple messages with the same subject line when I want to store them for sending to different people later. It automatically deletes the older message and only saves the new one.
Any idea/help? Can't find it online or using Macs's Help program. They are NOT being stored on my mail server, just checked.
Thanks!

I am experiencing exactly the same problem. Mail will not keep multiple email drafts with the same subject line, although they are addressed to different people. At one point, I had drafted and saved a dozen or so such messages intending to send them later only to discover that Mail had deleted all of them but one. Have you received any help or guidance on this? I'm baffled. This did not happen with previous Mail versions.

ISE 1.2 and ACL's with multiple ports

When creating a DACL for my groups I used the Syntax " permit tcp any 192.168.20.0 0.0.0.255 eq 22 443" for one of my acl's inside the DACL and the syntax check validated it. When I pushed it to my groups it also worked but I have heard that this type of multiple port ACL in ISE is not supported. Does anyone know if this is accurate?

Thanks for the response but it's wrong. Cisco supports stacked ports in 1.2 for wired users. They carried over 1.1documentation to 1.2 and never updated it. We have it in writing from Cisco tac.

Router ACL and Port ACL

how to find out after looking at the ACl that this is router acl and this is port acl.
is there is any syntax difference between these two acl's? or these two look the same.

how to find out after looking at the ACl that this is router acl and this is port acl.
It depends on where the ACL is applied:
Layer-3 interface (SVI, routed port): Router ACL
Layer-2 interface (physical switch interfaces): Port ACL
is there is any syntax difference between these two acl's?
Both support Standard and Extended ACLs, the Port ACLs support MAC Extended ACLs in addition.
Link: c3560 Configuring Network Security with ACLs

Multiple ports on single node cannot communicate

I am a Sr. Tech Architect from SBC that it evaluating your product for utilization in our enterprise online order application in combination with the Solarmetric Kodo product.
I was able to install and utilize your application and line command, sample applications no problem on a single jvm utilizing multiple ports and all the members were being recognized no problem. Suddenly, they are no longer being picked up. I am using the packaged configuration xml files as is, just running multiple dos windows on a Win 2k box and launching the line command application. The only other development work I have been doing on the box is test deploys to Apache of the product along with the integration of the Kodo product in a WSAD 5.1 environment, however, I have both those applications shut down and rebooted the machine with no success. I tried running the multicast test just for kicks and got no response back. Scratching my head as to what my be the problem all of a sudden.
Thanks,
Scott

Scott,
Did you, by any chance, install and enable "Microsoft Loopback Adapter"? If so, you'd need to disable it. If not, could you please e-mail me the command line and some output of the multicast test.
Thanks,
Gene
[email protected]

Service PO - Multiple account assignments for service line items

Hi All,
I'm trying to create a service purchase order using BAPI 'BAPI_PO_CREATE1'.
But i need to create service line items with multiple account assignments say
For line item 10 -
1)Service line 1 -Cost center 'XYZ'.
2)Service line 2 -Cost center 'ABC'.
In POACCOUNT there is no option to specify the service line item .
Moreover in POSERVICES also there is no option to mention costcenter.
How can i create the same...
Thanks in advance
Regards
Prasanthi

Dear Prithviraj,
CAPEX (Category 'A'), can it apply to OPEX/Blanket and Sm. Proj?
I know create multiple account assigment under ME51N/ME52N.
Any solution by using FM (BAPI_REQUISITION_CREATE and BAPI_REQUISITION_CHANGE)?
thanks
Regards,
Weng

How to stop this multiple entry against same condition type in pricing

My client is using manual condition type for the basic price "ZBPR". Now system allowing multiple entry against this condition type in the pricing screen during order creation i.e in the first line if we put ZBPR 00 , in the second line system allowing to put another value against same ZBPR say for example 2000 & doing all subsequent calculations on the basis of 3000 .which is not at all acceptable by my client .Please suggest how to stop this multiple entry against same condition type

You have to make the condition type as Mandatory and not manual.
If you are entering many condition records of the ZPR0 then the latest entry will be taken for further processing for subtotal rebate and total price.
For all the other entered condition records will have yellow traffic signal which is not active.
you can assign a routine with the help pf your abaper...
In the Transaction VOFM define a requirement such that
you condition type takes value only one at the time of order entry.
regards,
Amlan Sarkar

Need to Restrict the usage of same conditn type multiple times in same PO

Dear All
The system is allowing the usage of one condition type multiple times in the same PO line item.
We want to put restriction in such a way that "one condition type if used should not be allowed to use again for that line item.
Is there any solution for this through Configuration settings or we need to go for some enhancements?
Please suggest me the enhancements available to achieve this requirement.
Thanks & Regards
Bala

I think you have to make use of an exit (EXIT_SAPLMEKO_002) or a BADI (ME_PO_PRICING_CUST)

Problem with running multiple servlet in same webapplication with tomcat 3

Hi all,
I am using Tomcat 3.0 as webserver with jdk1.3, Servlet 2.0,
Templates for html file and oracle 8i on UNIX platform.
I have problem with multiple servlet running same webapplication.
There are two servlet used in my application. 1) GenServlet.class
and 2) ServletForPrinting.class
All of my pages go through GenServlet.class which reads some property files
and add header and footer in all pages.
I want reports without header & footer that is not possible through GenServlet in my application.
So I have used another servlet called ServletForPrinting --- just for reading html file.
It is as follow:
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class ServletForPrinting extends HttpServlet {
public void service (HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException
// set content-type header before accessing the Writer
response.setContentType("text/html");
PrintWriter out = response.getWriter();
File f1 = null;
String report = null;
String path = request.getPathInfo();
try{
String p = "/var/home/latif/proj/webapps/WEB-INF/classes" + path;
System.out.println(p);
f1 = new File(p);
p = null;
if (f1.exists()) {
FileReader fr = new FileReader(f1);
BufferedReader br = new BufferedReader(fr);
report = new String();
while ((report = br.readLine()) != null) {
out.println(report);
}catch(Exception e) {
out.close();
report = null;
path = null;
f1 = null;
} // end class
It works fine and display report properly.
But now Problem is that if report is refreshed many times subsequently,
WebServer will not take any new change in any of java file used in web-application.
It works with the previous class only and not with updated one.
Then I need to touch it. As soon as I touch it, webserver will take updated class file.
Anybody has any idea regarding these situation?
Is there any bug in my ServletForPrinting.java ?
Any solution ????? Please suggest me.
Suggestion from all are invited. That will help me a lot.
Thanks in advance
Deepalee.

Llisas wrote:
I solved the problem, I just had to wire the blocks in a sequential way (I still don't know why, but it works).
Feel free to delete this topic.
I would strongly suggest at least reading this tutorial to give you an idea of why your fix worked (or maybe only appeared to work). Myself, I never just throw up my hands and say, "Whatever," and wash my hands of the situation without trying my best to understand just what fixed it. Guranteed you'll run into the same/similar problem and this time your fix won't work.
Please do yourself a favor and try to understand why it is working now, and save yourself (or more likely, the next poor dev to work on this project) some heartache.
Bill
(Mid-Level minion.)
My support system ensures that I don't look totally incompetent.
Proud to say that I've progressed beyond knowing just enough to be dangerous. I now know enough to know that I have no clue about anything at all.

Multiple monitors showing same video in different rooms

I would like to upgrade the video technology in some patient exam rooms. Is there a way to set up multiple monitors connected to the same PC or Laptop - to run the same video loop?

Hi,
As HiLogics says, it will work with video card with more than one DVI ports
Watch set of videos here to experience the fix:
https://www.youtube.com/watch?v=ZkbaXkMQrIM
To Configure Dual Monitor , please look at this link:
http://www.wikihow.com/Set-Up-Dual-Monitors
Setup 3 monitors:
http://www.tomshardware.com/faq/id-1839185/set-triple-monitors.html
Hope this will give you some idea to setup multiple monitors with same image.
Binu Kumar - MCP, MCITP, MCTS , MBA - IT , Director Aarbin Technology Pvt Ltd - Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Multiple entries for same apps showing next to 'Open With' in contextual menu since last backup

I did a back up of my MBPs internal drive recently, using Carbon Copy Cloner - since then there are multiples of the same icons for all apps under 'Open With' in the contextual menu. I seem to remember there being a command line that could be entered in Terminal to fix this, but I can't find it anywhere.
Can anyone help?

Yes, LaunchServices. These are only cache files but can get corrupted. Launch /Utilities/Terminal and copy & paste this at the command line to rebuild LaunchServices: (be sure to copy the entire line it's a scroll)
Code:
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -kill -r -domain local -domain system -domain user
Then press return. Wait until terminal returns to the command line. Quit Terminal. After that, log out and back in or restart. Let us know

ACE: a class-map with multiple ports... what about the probe/serverfarm?

Hello Gilles,
One question about something I was not able to find in the documentation.
Lets say I have one class-map which includes 2 ports (in this case https and 5061).
Can I associate this class-map to just 1 generic serverfarm and probe for both ports or I have to specify 2 serverfarms/rservers/probes?
So, by not specifying the ports on the rserver, if a request is received on port 443 (or 5061), it is sent to the same respective port on the rserver?
The same way is valid for the generic probe. ACE module is able to probe both ports based on the class-map?
Thanks and have a great day!!
Giulio.
probe tcp PROBE_GENERIC_TCP
description This probe works for all TCP services by inheriting the VIP port.
interval 15
faildetect 2
passdetect interval 15
passdetect count 2
open 2
rserver host SERVER1_ACCESS
ip address <1AC>
inservice
rserver host SERVER2_ACCESS
ip address <2AC>
inservice
serverfarm host ACCESS-SFARM
probe PROBE_GENERIC_TCP
rserver SERVER1_ACCESS
    inservice
rserver SERVER2_ACCESS
    inservice
class-map match-any OCS_L4ACCESS
2 match virtual-address x.x.x.176 tcp eq https
2 match virtual-address x.x.x.176 tcp eq 5061
policy-map type loadbalance first-match OCS_L4ACCESS
class class-default
    sticky-serverfarm ACCESS_STICKY
policy-map multi-match POLICY
class OCS_L4ACCESS
loadbalance vip inservice
loadbalance policy OCS_L4ACCESS
loadbalance vip icmp-reply active
connection advanced-options OCS_VIPTIMEOUT
nat dynamic XXX vlan 503

Even if you use the 4710 appliance or expect the inheritance in the module software, it's worth considering if this is really what you want. If you keep multiple ports in the L3/L4 class-map you can't handle the services independently. You will have a common serverfarm for both https and 5061. If https service stops on one rserver, the ACE will place that rserver (and not that service) in out-of-operation state and it won't receive any 5061 traffic either. (You have the fail-on-all probe option but I wouldn't say it's a better choice. In that case, https traffic would be sent to the rserver even if https port is closed as long as there is at least one working service on it.) That's why I prefer a separate class-map and separate serverfarm for each service. (They can contain the same rservers, no need to duplicate.) BUT if the software supports probe port inheritance, you can benefit from it even in this scenario: serverfarm-443 and serverfarm-5061 can both use your PROBE_GENERIC_TCP.

Multiple Sequences on same Timeline = Failed Export?

I'm trying to make a compilation reel - combining about 7 or 8 previous projects into one long timeline - for export from FCP 5 to Compressor2 - to make a m2v. I'm using Best Quality, 90 minute presets.
The way I laid out the timeline was to copy the squences from all the projects that I needed and the copy/paste, or drag and drop them into the one new
compilation sequence.
Problem that I run into is that it fails every time when I try to export using Compressor 2.
I can export it to Compressor and set everything up to run, and Compressor will start out fine, but then it never finishes - at some point in the process it just stalls and then if i touch anything in the Batch window or in FCP the export willl fail.
It's only a 1 hour sequence, so it shouldn't be takking 8+ hours to render - it's not like I'm being impatient.
I've exported lots of other projects with Compressor 2 and FCP HD, so I'm not sure whats wrong/different this time - the only thing I can think of is that I combined multiple sequences in one time line.
Does anyone know what could be going wrong?
If the sequences are the problem, what the best way around that?
Do I just export ref movies for each project and then use those to combine
in the new compilation timeline?
I'm going to try to just export a ref movie from FCP and then take that to Compressor, but I have a feeling the same thing is going to happen.
Thanks,
Steve

Check the file size. The .mov extension doesn't have a lot to do with it. If it's big, you did a self-contained movie. Or pen it it in QT Player Pro and check the files used - Command-J, Resources tab. Should be just one entry there.
Pretty hard to do it wrong, just one little checkbox...
Russ

2 Modems on the same ADSL line?

I have a NetComm NB5Plus4W ADSL2+ modem router through which I can connect wirelessly to my iMac, MacBook and iPhone. There also another iMac at the other side of the house which rarely gets enough signal strength to connect to the internet. And due to our building type it is not realistic to establish a wired connection.
My question is this - Is it possible to connect 2 separate modems to the same phone line to piggyback the ADSL, or do I need to use a wifi range extender? Any recommendations ...

You could look into the line of products that use the electrical wiring to create a wired network. It's a UK site but it'll give you an idea of the products possibly available to you. Here is the link.

Listen on multiple ports for smtp?

Traditionally, we've provided setup smtp to listen on an additional port to 25 for travellers who find themselves on an ISP which blocks that port. We used a line in master.cf like:
<newportnumber> inet n - y - - smtpdproxywrite unix - - n - 1 proxymap
This seems to make snow leopard's postfix unhappy. It also doesn't work. I'd be grateful if anybody could tell me:
* what is or where to look for info on setting up postfix to do multiple ports? I've tried Apple docs and found nothing and only old-style in postfix docs -- though I could be missing something obvious as always.
* is this the modern and preferred way to get around the blocked port 25 problem or is it better to do some fancy-schmancy port redirection eg at the firewall to map multiple ports on to port 25 for postfix?
thanks and allbests,

In the past I've used the following with great success. Add the following line to /etc/postfix/master.cf file:
2525 inet n - n - - smtpd
Stop and start the mail service. Then test with telnet to ensure that the port is responding. Sadly, this still appears to be the best way, sans the use of a VPN, to get around ISP blocking.
Obviously port 25 needs to be open to receive mail. But instead of opening additional port in the firewall, you could drive all users to VPN.
I just tested the above line in 10.6.1 and it is responding.
Hope this helps

Extended acl - multiple ports on same acl line

Similar Messages

Maybe you are looking for