Wide Key ACLs

Wide key capability provides greater capacity for rules than single-wide key ACLs.

For example on ExtremeSwitching series switches, except X870, a double-wide match key provides a 362-bit capacity, instead of a standard 181-bit single-wide key to be used with match conditions. A double-wide key allows you to add more match conditions to an ACL. It also allows matching on a full destination-source IPv6 address.

As indicated, the ExtremeSwitching X870 has different wide key capabilities than the other ExtremeSwitching series switches. The different capabilities are summarized as follows:

On all platforms, except the ExtremeSwitching X870 series switches, key width is configured manually (see Configuring Wide Key ACL Modes) and applies to all ACLs on the switch. An individual switch cannot be configured to operate in a mixed double- and single-wide mode. However, a SummitStack can have a mixture of modules and switches with some of them operating in a single-wide mode and some in a double-wide mode.

For example, your single-wide mode supports condition combination A, B, and C, and the double-wide mode adds condition combinations D1 and D2. Then in a single-wide mode, the conditions of your rule should be a subset of either {A}, or {B}, or {C} and in a double-wide mode, the conditions of your rule should be a subset of either {A U D1}, or {A U D2}, or {B U D1}, or {B U D2}, or {C U D1}, or {C U D2}.

For ExtremeSwitching X870 series switches, key width (single, introslice double, double, and triple) is assigned automatically based on ACL rule size, and a single switch can contain ACLs with different key widths.