Skip to content
ENExplore Calculators

ACL Rule Calculator

Count the access control entries a router or switch ACL will expand to and check it against the platform's TCAM budget.

About ACL Rule Calculator

Object groups are a configuration convenience only — the hardware expands them into the full cross-product of source, destination and protocol entries. Multiply the three dimensions, double it if the ACL is applied inbound and outbound, and add one for the implicit deny that terminates every list. Silently exceeding the platform's TCAM budget makes the ACL fall back to software forwarding or fail to install at all, which either tanks throughput or leaves traffic unfiltered.

Formula

ACL Rule

ACEs = sources × destinations × protocol entries × directions, plus the implicit deny.

sources
Source prefixes after object-group expansion
destinations
Destination prefixes in the rule set
protocol entries
Distinct protocol/port lines per pair

Worked example

With the default values below, ACL Rule Calculator returns Total ACL Entries of 1,153. Change any input above and every figure here is recalculated in your browser.

Inputs used

Source prefixes or object-group membersaccepts 1–4,096 prefixes
24 prefixes
Destination prefixesaccepts 1–4,096 prefixes
8 prefixes
Protocol / port entries per source-destination pairaccepts 1–128 entries
3 entries
Apply the ACL in both directions
Yes
Platform ACL / TCAM entries availableaccepts 64–1,000,000 entries
16,000 entries

Results

Total ACL Entries
1,153
Expanded ACEs
1,152
TCAM Utilisation
7.2%
Entries Remaining
14,847
Average Entries Evaluated per Packet
577

Step by step

  1. 1Values used
  2. 2ACL Rule
  3. 3Total ACL Entries= 1,153
  4. 4Expanded ACEs= 1,152
  5. 5TCAM Utilisation= 7.2
  6. 6Entries Remaining= 14,847
  7. 7Average Entries Evaluated per Packet= 577

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is ACL Rule calculated?

ACEs = sources × destinations × protocol entries × directions, plus the implicit deny. Object groups are a configuration convenience only — the hardware expands them into the full cross-product of source, destination and protocol entries. Multiply the three dimensions, double it if the ACL is applied inbound and outbound, and add one for the implicit deny that terminates every list.

Why does ACL Rule matter?

Silently exceeding the platform's TCAM budget makes the ACL fall back to software forwarding or fail to install at all, which either tanks throughput or leaves traffic unfiltered.

What values do I need to enter?

This calculator takes 5 inputs: Source prefixes or object-group members, Destination prefixes, Protocol / port entries per source-destination pair, Apply the ACL in both directions, Platform ACL / TCAM entries available. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Does entry order affect performance?

On hardware that programmes the ACL into TCAM, lookups are parallel and order does not affect speed — only correctness. On software or virtual data planes the list is walked top down, so putting your highest-volume permit entries first roughly halves the average entries evaluated per packet.

Related Calculators

ACL Rule Calculator | Calcrivo