Yes — when TCAM and ACL resources run out, most switches accept the configuration and quietly stop enforcing part of it. No error in the CLI, no syslog line, no LED. The rule is in the running config, it survives a reboot, and packets that should be dropped are forwarded. This is the single most dangerous property of hardware-based filtering, and it is why "the ACL is configured" is not the same statement as "the ACL is active".
Rayin (Shenzhen Rayin Technology) is a manufacturer of GPON OLTs and industrial Ethernet switches.
TCAM is not a bigger RAM. It is a parallel comparator that returns a match in one clock, which is why it is expensive in silicon area and power, and why every switch has far less of it than you expect.
TCAM is partitioned into slices or regions, each with a fixed entry width. A rule wider than the slice wastes the remainder — so a 2K-entry table can hold far fewer than 2K rules once masks and widths are uneven.
ACLs are only one tenant. QoS classification, policy routing, control plane policing, multicast and MAC-based filtering all draw from the same pool, and the first feature configured usually gets the entries.
TCAM stands for ternary content addressable memory. The "ternary" is the whole point: each bit cell stores 0, 1, or don't-care, so a single lookup compares the packet header against every stored pattern in parallel and returns a match regardless of wildcards.
| Property | CAM | TCAM | Ordinary RAM (SRAM/DRAM) |
|---|---|---|---|
| Match type | Exact only | Exact, wildcard, range via masking | None — address-based read/write |
| Lookup latency | One clock | One clock | Multiple clocks, and the CPU has to walk the table |
| Bits per cell | 1 | 2 (value + mask) | 1 |
| Silicon cost | High | Highest — roughly 6 transistors per bit against 1 for SRAM | Lowest |
| Typical use | MAC address table, exact-match tables | ACLs, QoS classification, policy routing, CoPP | Buffers, counters, software tables |
A MAC table can live in CAM or in hashed SRAM because MAC lookups are exact. An ACL cannot: permit 10.0.0.0/8 any is a mask, and masks need ternary storage. That is why a switch with 16K MAC entries may have only 1K or 2K TCAM entries.
The physical cost explains the scarcity: ternary content addressable memory is the only structure that can answer a masked lookup in one clock. Because each TCAM bit needs a comparator and a mask cell, TCAM is the most area-expensive memory on the die. A switch vendor choosing between more TCAM and more packet buffer will almost always choose buffer, because buffers affect throughput while TCAM affects features nobody benchmarks.
More than the rule count suggests, for three reasons.
Width. An IPv4 five-tuple rule needs 32 bits of source address, 32 of destination, 16 of source port, 16 of destination port and 8 of protocol — 104 bits of match data, doubled to 208 in ternary form. Add VLAN, DSCP or MAC fields and the entry grows. TCAM is built in fixed widths (commonly described in the datasheet as 160-bit or 320-bit slices), so a rule that does not fill a slice still consumes the whole slice.
Mask expansion. A single rule with a port range can be compiled into several entries. permit tcp any any range 1000 2000 is not one entry in most hardware; the compiler expands ranges into a set of masked patterns. A rule that reads as one line in the config can occupy eight or sixteen entries.
Per-direction and per-port application. An ACL applied inbound on twenty ports may be programmed once and referenced twenty times, or may be replicated per port depending on the pipeline. The datasheet number is usually the total pool; the usable number for your topology is smaller.
| Feature drawing on the pool | Typical demand | Shares with ACLs? |
|---|---|---|
| Ingress ACL (security filtering) | One entry per rule, ×mask expansion | Yes — usually the same region |
| Egress ACL | One entry per rule, often a separate smaller region | Sometimes |
| QoS classification (DSCP, 802.1p, MAC) | One entry per class-map match | Yes |
| Policy-based routing | One entry per policy route | Yes |
| Control plane policing classes | 4–8 entries | Yes |
| MAC-based ACL / VLAN ACL | One entry per MAC or per VLAN pair | Yes, and MAC entries are wide |
| Multicast (IGMP snooping groups, if hardware-assisted) | Scales with group count | Separate region on some parts |
The counter-intuitive part is that exhaustion usually arrives from a feature nobody considered an ACL.
QoS on every port. A plant network with eight traffic classes, each matching on DSCP plus 802.1p, consumes a block of entries before a single security rule exists. Add per-port trust policies and the block grows.
Policy routing for a single subnet. One "send this subnet to the inspection appliance" rule can compile into dozens of entries once the destination set is expanded.
IPv6. An IPv6 five-tuple needs 128 bits of source and 128 of destination — 288 bits of match, doubled. IPv6 ACLs consume roughly 2.8 times the TCAM of the equivalent IPv4 rule. A switch sized for a full IPv4 ACL will not hold the same policy in IPv6.
Dual-stack during migration. Running both address families means both rulesets are installed simultaneously. This is the most common way a network that worked fine for years fails the week IPv6 is enabled.
Four symptoms, in the order they usually appear.
The rule is accepted but a test packet passes. The classic. Configure a deny for a test host, ping from that host, and the ping succeeds. No counter increments, because the entry was never installed.
Rules at the top of the list work; rules at the bottom do not. Compilers install in priority order until the region fills. The tail of the list is the casualty, and the tail is usually where the specific, important denies live.
A feature works after reboot and stops after a config change. Reboot re-installs in a different order; a later change pushes the total past the limit and the compiler silently drops the overflow.
CPU rises and nobody knows why. When hardware cannot match, some pipelines punt the packet to the CPU for software evaluation. The ACL "works" in the sense that packets are filtered, but at a few thousand packets per second instead of line rate — and the CPU becomes the bottleneck.
Warning: Never validate an ACL by reading the running configuration. Validate it by sending traffic that the rule should block and confirming the drop counter increments. That is the only proof the entry reached hardware.
Most managed switches expose the number, and almost nobody looks at it.
| What to check | Where it lives | What "healthy" looks like |
|---|---|---|
| TCAM/ACL entry usage per region | show command for hardware resource or ACL utilisation; sometimes only in a diagnostic shell | Below 70% after all features are configured |
| Per-feature entry counts | Feature-specific counters (QoS, PBR, CoPP) | Stable, and accounted for in your budget |
| Rule expansion factor | Compare configured rule lines with installed entries | Under 3× for typical rulesets |
| Drop counters on security rules | ACL hit counters | Non-zero on rules you expect to match |
| CPU punt rate after a policy change | CoPP or CPU statistics | No step change |
If your platform does not expose TCAM utilisation, infer it: add rules one at a time and test each with real traffic. The first rule that fails the traffic test is where the region ended. That experiment takes an hour in a lab and saves a week of arguing about why a firewall rule "doesn't work" on the switch.
Fitting is a design activity, not a purchase decision.
Order by importance, not by habit. Put the specific denies first. If the tail gets dropped, you want the tail to be the broad, low-value permits.
Collapse rules. Ten lines permitting ten adjacent /24s are one rule with a /20 summary — and one TCAM entry instead of ten. Summarisation is the cheapest TCAM you will ever buy.
Avoid port ranges where an exact port will do. Ranges expand; single ports do not.
Keep QoS classification coarse. Match on DSCP at the trust boundary rather than re-classifying on every port.
Budget for dual-stack from day one. If IPv6 is on the roadmap, size the policy for 2.8× the IPv4 entry count now, or plan to summarise before enabling it.
Prefer port-based and VLAN-based enforcement where it is sufficient. A private VLAN or port isolation solves a segmentation problem without consuming a single TCAM entry.
Tip: Ask the vendor for the TCAM entry budget per region, the expansion behaviour for port ranges, and whether IPv6 ACLs share the IPv4 region. A datasheet that lists only "4K ACLs" is telling you the total pool, not what your feature mix will leave you.
On a plant floor the constraint shows up in a specific pattern: a modest security policy, a QoS scheme for PROFINET or EtherNet/IP traffic classes, and a CoPP policy, all on the same access switch.
Individually each is small. Together they routinely consume the majority of a low-end switch's TCAM, and the failure is not a crash — it is a segmentation rule that stops working after the QoS configuration was expanded during a maintenance window. Nobody notices until an audit or an incident.
The practical rule for industrial deployments: decide the security policy first, size the QoS second, and leave at least 30% headroom. If the switch cannot hold both with headroom, the honest answer is a different switch, not a shorter policy. For an access-layer box such as Rayin's 8+4-port gigabit industrial switches, the relevant question in evaluation is not the switching capacity but how much filtered policy the hardware pipeline can hold while QoS is also active — and that has to be confirmed per platform and software release.
Does a switch warn you when the TCAM table is full?
Some do, with a syslog message or an error at commit time. Many do not. The common behaviour is to accept the command, install what fits, and drop the rest without a message. Treat "no error" as no evidence, and always verify with traffic.
Why does an ACL with 500 rules not fit a 2K-entry TCAM?
Because 500 configured rules is not 500 entries. Each rule is padded to the slice width, port ranges expand into multiple masked patterns, and the same ACL applied in two directions may be programmed twice. An expansion factor of two to four is normal, which turns 500 rules into 1000–2000 entries.
What is the difference between TCAM and CAM?
CAM matches exact values only and stores one bit per cell. TCAM stores a value and a mask per cell, so it matches 0, 1 or don't-care, at roughly six times the silicon area per bit. MAC tables can use CAM or hashed SRAM; ACLs and QoS classifiers need TCAM.
Do IPv6 ACLs use more TCAM than IPv4?
Substantially more. An IPv6 five-tuple carries 128-bit addresses against 32-bit in IPv4, so the match width roughly triples. Plan for about 2.8 times the IPv4 entry count when dual-stack is enabled, and summarise aggressively before turning IPv6 on.
How do I prove an ACL is actually enforced in hardware?
Send traffic the rule should block and check that the rule's hit counter increments while the packet is dropped. If the counter stays at zero and the packet still drops, the filtering is happening in software after a CPU punt — functional but not at line rate, and the first sign that the hardware table is exhausted.
Managed vs Unmanaged Network Switches: What Actually Sets Them Apart
QoS and Packet Buffer: Fixing Microburst Video Lag on Switches
About the author: Sara — Sara is a Customer Manager at Rayin with over 10 years of experience in the communications field. In her free time, she enjoys badminton and swimming.
About Rayin: Shenzhen Rayin Technology Co., Ltd. — Company Profile
