Description

Starting from 21.1 Port qualifier is supported on QFX5K series switches, an enhancement to TCAM programming. As a result, additional entries with L4SrcPort / L4DstPort is programmed in PFE from 21.1 onwards which consumes additional TCAM entries compared to earlier releases.

The port qualifier will install two entries in the packet forwarding engine. One with the source-port and second one with the destination-port. This is accurate and expected behavior to take more entries in HW

Example: 

For the below term which has 'port' match condition, there's no PFE entry for a port qualifier in earlier releases and the corresponding PFE entries for port qualifier is only supported from 21.1R1. With identical configuration the difference in TCAM utilization can be seen in this example

....
from {
    source-prefix-list {
        $prefix-list1;
        $prefix-list2;
    }
    protocol [ tcp udp ];
    port [ dns telnet http ftp tacacs ];
}
then {
    accept;
}
....
21.1:
    - Term    7: will expand to   320 terms: Name "$term7"
    - Term    7: needs   640 TCAM entries: Name "$term7"

19.1:
    - Term    7: will expand to    64 terms: Name "$term7"
    - Term    7: needs    64 TCAM entries: Name "$term7"


 

Symptoms

This enhancement in newer release will take up more TCAM entries in the HW and might cause TCAM exhaustion if not enough space to accommodate these additional entries 
fpc0 DFWE ERROR DFW: Cannot program filter "$lo0-fw" (type IRACL) - TCAM has 768 free entries and the filter requires 985 free entries


 

Solution

Customers upgrading to 21.1R1 and later releases from any earlier release should review the firewall filter configuration and might need to make changes to accommodate the additional entries to prevent any issues w.r.t TCAM exhaustion.

Modification History

06/29/2023 Initial Draft