Description

On ACX-EVO platforms, When Firewall filter is applied, below error appears when you run “show firewall” command
 

root@router# run show firewall filter router_protect-lo0.0-i     

 

Filter: router_protect-lo0.0-i                                

error: communication failure with /re0/fwstatsd/

   1. The producer app is either down or unresponsive

      Run "show system processes node <node> | grep <app>" to check if app is running

      Run "show system application app <app>" to check the state of the app

   2. If there is a change in mastership recently, please wait for the switchover to complete for the app to be online

      Run "request chassis routing-engine master switch check" to check the status of switchover

Symptoms

Delay in output for 15-20 mins when "show firewall" command is executed after Firewall filter config is deleted/added with larger TCAM scale, this delay subsidizes in 20 mins and output is displayed as expected

Solution

In lab testing it took around 15-20 mins for the command error to disappear once you delete/add the Firewall filter config; the delay in the output reduces after 20 mins approx, which means it takes evo-pfemabd around 15-20 mins to settle down after Firewall config is added. This is due to the high TCAM scale (scale limit varies for ACX platform)
 

On ACX7100 and ACX7509 The overall scale claim for lo0 filter is 2k and in the overall system, it is 16k (8k+8k) only, Evo-pfemand will take more time to settle down if there are more tcam entries ( in this case 15k+15k approx hence the delay)

This is an expected behavior till evo-pfemand settles down and will not cause any impact. This is discussed on PR1819625
 

 root@router:pfe> show evo-pfemand filter hw summary

 

 Active Filter Profile: profile-two

**To be deprecated..For latest, refer PFE Cli: 'show evo-pfemand filter profile-summary'

 

 

-------------------------------------------------------------------------------

DB                       DB  DB  DB  DB       DB  DB  TCAM Utilisation

Name                     Id  Prio Mode Stage    Unit Core   Used Free**

-------------------------------------------------------------------------------

IN-IFF-L2                38  24  320b IPMF2    0   0         0    512

IN-IFF-L2                38  24  320b IPMF2    0   1         0    512

IN-L2-CTRL               46  18  320b IPMF1    0   0        53   2380

IN-L2-CTRL               46  18  320b IPMF1    0   1        53   2380

IN-IFF-INET              39  22  320b IPMF2    0   0         0    512

IN-IFF-INET              39  22  320b IPMF2    0   1         0    512

IN-IFF-INET-Lo0          54  20  160b IPMF1    0   0     14975   2433

IN-IFF-INET-Lo0          54  20  160b IPMF1    0   1     14975   2433

IN-INET-CTRL             48  14  320b IPMF1    0   0        52   2380

IN-INET-CTRL             48  14  320b IPMF1    0   1        52   2380

IFF-IFF-INET6            40  23  320b IPMF2    0   0         0    512

IFF-IFF-INET6            40  23  320b IPMF2    0   1         0    512

IN-INET6-CTRL            47  15  320b IPMF1    0   0        75   2380

IN-INET6-CTRL            47  15  320b IPMF1    0   1        75   2380

IN-IFF-MPLS              41  17  320b IPMF2    0   0         0    512

IN-IFF-MPLS              41  17  320b IPMF2    0   1         0    512

IN-INET-URPF             51  29  160b IPMF3    0   0         1   3067

IN-INET-URPF             51  29  160b IPMF3    0   1         1   3067

IN-INET6-URPF            52  30  160b IPMF3    0   0         1   3067

IN-INET6-URPF            52  30  160b IPMF3    0   1         1   3067

IN-L2-CTRL-EXT           49  31  160b IPMF3    0   0         1   3067

IN-L2-CTRL-EXT           49  31  160b IPMF3    0   1         1   3067

 

Modification History

2024-08-08 : Article Created