Count the access control entries a router or switch ACL will expand to and check it against the platform's TCAM budget.
Object groups are a configuration convenience only — the hardware expands them into the full cross-product of source, destination and protocol entries. Multiply the three dimensions, double it if the ACL is applied inbound and outbound, and add one for the implicit deny that terminates every list. Silently exceeding the platform's TCAM budget makes the ACL fall back to software forwarding or fail to install at all, which either tanks throughput or leaves traffic unfiltered.
ACL Rule
ACEs = sources × destinations × protocol entries × directions, plus the implicit deny.
ACEs = sources × destinations × protocol entries × directions, plus the implicit deny. Object groups are a configuration convenience only — the hardware expands them into the full cross-product of source, destination and protocol entries. Multiply the three dimensions, double it if the ACL is applied inbound and outbound, and add one for the implicit deny that terminates every list.
Silently exceeding the platform's TCAM budget makes the ACL fall back to software forwarding or fail to install at all, which either tanks throughput or leaves traffic unfiltered.
This calculator takes 5 inputs: Source prefixes or object-group members, Destination prefixes, Protocol / port entries per source-destination pair, Apply the ACL in both directions, Platform ACL / TCAM entries available. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
On hardware that programmes the ACL into TCAM, lookups are parallel and order does not affect speed — only correctness. On software or virtual data planes the list is walked top down, so putting your highest-volume permit entries first roughly halves the average entries evaluated per packet.