In AW+ switches, poorly configured, unnecessary, or redundant Access Lists can over-extend a switch's silicone hardware resources. Hardware ACL's (type "hardware" or numbered 3000-3699 or 4000-4699) are applied at the switch silicon to physical ports, whereas standard and extended ACL's are applied in software at the CPU. Hardware ACL's, therefore, operate more efficiently by not using software-managed CPU resources. However, there are hardware limitations within the switch processor that caps the amount of this kind of hardware-based filtering that can be done.
If you notice that you cannot apply a configured hardware ACL to a switchport, and you see errors like...
% Failed to attach ACL {name or number} to port1.0.16
HSL: ERROR: Insufficient space in Field Processor to add ACL
DHCPSN[<pid>]: Insufficient space in the HW packet classifier table
...or configured ACL's are "disappearing" from switchport configurations after a reboot, then you've likely reached these hardware limits.
Enter the command:
sho platform classifier statistics utilization brief
You'll be able to see numerical values for used/available resources for classification of traffic in hardware.
TOP#sho platform classifier statistics utilization brief
Stack member 1:
[Instance 4]
Number of Entries:
Policy Type Group ID Used / Total
----------------------------------------------
ACL 1476395010 244 / 246 ( 99%)
DoS Inactive 0 / 0 ( 0%)
VLAN Counter
Group-Octet Inactive 0 / 0 ( 0%)
Group-Packet Inactive 0 / 0 ( 0%)
QoS 0 / 768 ( 0%)
Stack member 2:
[Instance 8]
Number of Entries:
Policy Type Group ID Used / Total
----------------------------------------------
ACL 1476395010 0 / 246 ( 0%)
DoS Inactive 0 / 0 ( 0%)
VLAN Counter
Group-Octet Inactive 0 / 0 ( 0%)
Group-Packet Inactive 0 / 0 ( 0%)
QoS 0 / 768 ( 0%)
TOP#
If you see something like what's highlighted above, the switch is out of silicon resources for that particular type of classifier. The numerical value does not necessarily represent a one-to-one relationship with the number of ACL's, or lines of configuration, etc.. The example above does not mean that there are 244 configured ACL's, or 244 lines of ACL-related configuration. Different ACL's will use differing volumes of hardware entries (resources) depending on how they are configured.
Verify that your ACL's are truly needed, and applied only to the necessary interfaces. One of the best ways to work around this type of issue is to use QoS "service-policy input" (policy maps) instead of hardware ACL's. Service policies are processed in software at the CPU, so will use no hardware resources.