ACL best practices (one file with multiple entry or many files with single entry)

[eyeV]

Hi everybody.
I want to add two access profiles to VLAN. For example

First
entry block-in-abonvlan {
if match any {
ethernet-type 0x8863;
ethernet-type 0x8864;
}
then {
permit;
}
}

entry deny (
if {
}
then {
deny;
}
}

Second
entry BCAST {
if {
ethernet-destination-address ff:ff:ff:ff:ff:ff;
}
then {
count broadcast;
}
}

entry ACTION {
if {
count broadcast > 10000;
period 10 ;
}
then {
syslog "It's probably a broadcast storm... Rule $ruleName $ruleValue exceeds limit $ruleThreshold" WARN 120;
}
}

What is the best way to do this?

• Two .pol files and two conf access-list command.
• Join this .pol files to one file.

[eyeV]

Thank you!

[Sumit_Tokle]

Create one single policy and add all three rule in it.

These matching condition will be kept in different hardware slices even though you would create single policy file or multiple files.