Description

EX-series and QFX5100 series Firewall filters use TCAM resources. It is possible that the TCAM resources may be exhausted when firewalls are not optimized.
An example of error messages seen is as follow:

May  7 14:27:18 2024  LABTEST fpc0 DFWE DFW: Cannot program filter FILTER1 (type ERACL) - TCAM has 20 free entries and the filter requires 50 free entries
 

Symptoms

Message from syslogd:

labroot@LABTEST> show log messages | match TCAM
May 7 14:27:17 2024 LABTEST pfex: DFWE DFW: Cannot program filter FILTER1 (type ERACL) - TCAM has 20 free entries and the filter requires 50 free entries
May 7 14:27:18 2024 LABTEST fpc0 DFWE DFW: Cannot program filter FILTER1 (type ERACL) - TCAM has 20 free entries and the filter requires 50 free entries

If above errors are seen , it means the filter is not programmed properly and further displays bind errors and will show in logs as below,

May  7 14:27:18 2024  LABTEST pfex: DFWE DFW: No space available to program filter FILTER1 (type ERACL) group 4
May  7 14:27:18 2024  LABTEST pfex: ERROR (dfw): [-2] Could not bind dfw(FILTER1) type(ERACL)
May  7 14:27:18 2024  LABTEST pfex: ERROR (dfw): [1000] Fail to do bind dfw(FILTER1) type(ERACL)
May  7 14:27:18 2024  LABTEST pfex: ERROR (dfw): [1000] bind failed for filter FILTER1
 

Solution

As a first step, the filters can be optimized as described in KB30953 - [EX/QFX] How to calculate and to optimize TCAM usage in firewall filters  [juniper.net]. However, it is not always possible to optimize filters.

When the optimization does not work, the workaround is to decide which filter and type to delete to free up TCAM entries

Modification History

2024-05-22 : Article Created