We might get the below logs while applying while applying Protect-RE under loopback interface in QFX5120-48Y.
Message from syslogd
fpc0 DFWE ERROR DFW: Cannot program filter protect-re-in-new (type IRACL) -TCAM has 0 free entries
fpc0 DFWE ERROR DFW: Filter : "protect-re-in-new" is NOT programmed in HW
As per the above logs, TCAM memory is exceeding/ no free TCAM is available for the new firewall filter, even we have enough free TCAM entries.
On Juniper QFX devices, use the following command to display the PFE filter hardware summary:
show pfe filter hw summary
This command is used to inspect hardware filter information on the Packet Forwarding Engine (PFE).
Message from syslogd:
Delete and reconfigure the firewall filters. If issue persist try the below command
Set chassis-loopback-firewall-optimization
2024-01-11 : Article Created
2024-01-11 : Drafted.