Description

This article provides information how to calculate number of TCAM entries for loopback firewall filter

Symptoms

 The QFX3500 has total 256 IRACL TCAM entries, so we should should be able to determine the TCAM usage by loopback firewall filter

Solution

 

Please refer to KB article KB21074 [juniper.net] to calculate the TCAM entries for the QFX3500, for filter terms with multiple (ranges) match conditions, when filter is applied for physical interface.

When a firewall filter applies to a loopback filter, 3 TCAM entries are used where the same firewall filter uses 1 TCAM if it is applied to a physical interface

  • Loopback Firewall Filter - adding the following implicit matching conditions for each term is contributing to additional number of entries:
1. Dst IPv4 addr 224.0.0.0 mask 255.255.255.0
2. Loopback DST PORT modid 0x00000001 modid mask 0x000001FF
3. Loopback TTL 1 mask 0x000000FF
  • We needed these entries to handle different types of the host bound traffic. Without these matching conditions, there is no way to handle the traffic going to CPU using a single entry.  The explanation below is for each matching statements.
1. For the reserved multicast packets - DST IPV4 224.0.0.X – OSPF, etc. (they cannot be filtered using the regular method).
2. For the regular case - Dst Port 0 – most of the packets that are unicasted to the CPU
3. For the packets with TTL 0 or 1 (these are exception packets and cannot be handled in a regular case)