ACL Rule Calculator

Count the access control entries a router or switch ACL will expand to and check it against the platform's TCAM budget.

Inputs

Source prefixes or object-group membersprefixes

Destination prefixesprefixes

Protocol / port entries per source-destination pairentries

Apply the ACL in both directions

Platform ACL / TCAM entries availableentries

Total ACL Entries

1,153

Expanded ACEs

1,152

TCAM Utilisation

7.2%

Entries Remaining

14,847

Average Entries Evaluated per Packet

577

Step by step

Values used
Source prefixes or object-group members = 24 prefixes; Destination prefixes = 8 prefixes; Protocol / port entries per source-destination pair = 3 entries; Apply the ACL in both directions = Yes; Platform ACL / TCAM entries available = 16,000 entries
ACL Rule
ACEs = sources × destinations × protocol entries × directions, plus the implicit deny.
Total ACL Entries
= 1,153
Expanded ACEs
= 1,152
TCAM Utilisation
= 7.2
Entries Remaining
= 14,847
Average Entries Evaluated per Packet
= 577

How it works

Object groups are a configuration convenience only — the hardware expands them into the full cross-product of source, destination and protocol entries. Multiply the three dimensions, double it if the ACL is applied inbound and outbound, and add one for the implicit deny that terminates every list. Silently exceeding the platform's TCAM budget makes the ACL fall back to software forwarding or fail to install at all, which either tanks throughput or leaves traffic unfiltered.

Formula

ACL Rule

ACEs = sources × destinations × protocol entries × directions, plus the implicit deny.

sources: Source prefixes after object-group expansion
destinations: Destination prefixes in the rule set
protocol entries: Distinct protocol/port lines per pair

Frequently Asked Questions

How is ACL Rule calculated?

ACEs = sources × destinations × protocol entries × directions, plus the implicit deny. Object groups are a configuration convenience only — the hardware expands them into the full cross-product of source, destination and protocol entries. Multiply the three dimensions, double it if the ACL is applied inbound and outbound, and add one for the implicit deny that terminates every list.

Why does ACL Rule matter?

Silently exceeding the platform's TCAM budget makes the ACL fall back to software forwarding or fail to install at all, which either tanks throughput or leaves traffic unfiltered.

What values do I need to enter?

This calculator takes 5 inputs: Source prefixes or object-group members, Destination prefixes, Protocol / port entries per source-destination pair, Apply the ACL in both directions, Platform ACL / TCAM entries available. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Does entry order affect performance?

On hardware that programmes the ACL into TCAM, lookups are parallel and order does not affect speed — only correctness. On software or virtual data planes the list is walked top down, so putting your highest-volume permit entries first roughly halves the average entries evaluated per packet.

You might also need

Firewall Rule Count Calculator Security Group Coverage Calculator Packet Inspection Capacity Calculator