When there are more than 2 types of firewall filter configured in EX4650, it is note that one type of filter is not able to program to TCAM.
For example below, L2 interface firewall filter cannot program to TCAM when all 3 types of filter below configured.
=============================================
-L3 Firewall filter
set interfaces lo0 unit 0 family inet filter input mgt-access
set firewall family inet filter mgt-access term telnet-allow from source-address 10.0.0.0/8
set firewall family inet filter mgt-access term telnet-allow from protocol tcp
set firewall family inet filter mgt-access term telnet-allow from destination-port telnet
set firewall family inet filter mgt-access term telnet-allow then accept
-L2 vlan-based Firewall filter
set interfaces ge-0/0/11 unit 0 family ethernet-switching
set vlans ge11-vlan interface ge-0/0/11.0
set vlans ge11-vlan forwarding-options filter input ge11-ff
set firewall family ethernet-switching filter ge11-ff term POLICE from interface ge-0/0/11.0
set firewall family ethernet-switching filter ge11-ff term POLICE then policer ge11
set firewall family ethernet-switching filter ge11-ff term other then accept
set firewall policer ge11 if-exceeding bandwidth-limit 100m
set firewall policer ge11 if-exceeding burst-size-limit 625k
set firewall policer ge11 then discard
-L2 Interface-bases Firewall filter
set interfaces ge-0/0/1 unit 0 family ethernet-switching filter input ge01-ff
set firewall family ethernet-switching filter ge01-ff interface-specific
set firewall family ethernet-switching filter ge01-ff term POLICE then policer ge01
set firewall policer ge01 if-exceeding bandwidt
Error appears upon committing config, L2 interface bases Filter not able to program to TCAM.
=========================
[email protected]>
Message from [email protected] at Jun 8 09:55:52 ...
ex4650-20.4R3 fpc0 DFWE ERROR DFW: Filter : "ge01-ff-ge-0/0/1.0-i" is NOT programmed in HW
ex4650-20.4R35 fpc0 DFWE ERROR DFW: Cannot program filter ge01-ff-ge-0/0/1.0-i (type IPACL) -TCAM has 0 free entries
This is system limitation in 20.4 that a maximum of 2 filter type is supported at the same time. This limitation is enhanced in 21.4 so 3 filter type can be used at the same time.
v1.0 20230619