A newly installed ACXK, upon committing L3 Interface config spat out error messages for Loopback 0 re-protect firewall rules.

The impact seen was firewall rule re-protect was no longer working. Please advise a solution; if and how TCAM table limit can be altered if possible.

EVO_PFEMAND_ASIC_PROGRAM_FAILED: Failed to program the hardware with an error - table is full

EVO_PFEMAND_DFW_PROCESSING_FAILED: Failed to process filterBind for the filterIdx xyz filterName re-protect-lo0.0-i bindType LO0 reason: TCAM Table Full

> If prefix-list is having "apply-path interfaces * unit *" then, an ip-address/prefix change would lead to filter modification, while adding any new l3 interface.

> We usually discourage 'destination-prefix-list' in lo0 filters, unless absolutely needed for fine tuning within the interface-ip’s.

> With the terms calling prefix list with apply path interfaces, lo0 itself will match all the interface-ip destined packets & so explicit dest-ip match explodes the TCAMs.

Prefix-list with apply-path interfaces:

  prefix-list router-ipv4 {

    apply-path "interfaces <*> unit <*> family inet address <*>";

  }

  prefix-list router-ipv6 {

    apply-path "interfaces <*> unit <*> family inet6 address <*>";

  }

Sample for destination-prefix-list:

    filter re-protect {

      term accept-bgp {

        from {

          destination-prefix-list {

            router-ipv4;

            router-ipv6;

          }

      }

The only way to reduce TCAM in ACX7K is to not use "apply-path "interfaces"" & destination-prefix-list in the filter.