However, due to the chip belongs to low-end series, there are 3 limitation as follows.

1. Each ACL rule belongs to ethernet type consumes 3 ACL rules. In other words, when user issues the “create access_profile profile_id <value 1-n> profile_name <name> ethernet {source_mac <macmask> |destination_mac <macmask>}” command, it will consume 3 ACL rules to process the incoming packet with the different types(IPv4/IPv6/non-IP).

2. The access profile with Ethernet type always has higher priority than the access profile with IP/IPv6 type.

For example, when user creates access-profile 1 with IP type and also creates access-profile 2 with ethernet type, if an incoming packet multiple matches two ACL rules and one is in “access-profile 1 with IP type” and the other is in “access-profile 2 with ethernet type”, the final resolution will be “the ACL rule of access-profile 2 with ethernet type”.

3. For back work compatible, we will recommend adding a new command to switch the new implementation and the original implementation.

Ø When user issues the new command, DUT will examine if hardware has enough available ACL rules for the new implementation or not, due to new implementation will let each ACL rule belongs to ethernet type consumes 3 ACL rules.

If no, DUT will prompt an error message for warning user.

If yes, DUT will implement the new solution.