ACX7K routers does not support filter-specific policers with different counter-names in the terms.
set firewall family inet filter PROTECT_RE term ACCEPT_SSH from source-prefix-list V4_MGMT_INT_AE_PFX
set firewall family inet filter PROTECT_RE term ACCEPT_SSH from protocol tcp
set firewall family inet filter PROTECT_RE term ACCEPT_SSH from port ssh
set firewall family inet filter PROTECT_RE term ACCEPT_SSH then policer MGMT_25MBPS
set firewall family inet filter PROTECT_RE term ACCEPT_SSH then count ACCEPT_SSH
set firewall family inet filter PROTECT_RE term ACCEPT_SSH then accept
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB from destination-prefix-list V4_MGMT_INT_FXP0_PFX
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB from destination-prefix-list V4_MGMT_INT_AE_PFX
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB from destination-prefix-list V4_LO0_0_PFX
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB from destination-prefix-list V4_THS_AGGREGATE_LO_PFX
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB from protocol tcp
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB from source-port ssh
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB from tcp-established
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB then policer MGMT_25MBPS
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB then count ACCEPT_TCP_SSH_ESTAB
set firewall family inet filter PROTECT_RE term ACCEPT_TCP_SSH_ESTAB then accept
//Policer
set firewall policer MGMT_25MBPS filter-specific
set firewall policer MGMT_25MBPS if-exceeding bandwidth-limit 25m
set firewall policer MGMT_25MBPS if-exceeding burst-size-limit 128k
set firewall policer MGMT_25MBPS then discard
The above FW terms uses same policer that is filter specific and configured with different counters.
The FW filter programming will be failed in the PFE. The following errors will be seen in the device.
Oct 4 15:42:23 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] Dfw: Term ACCEPT_SSH and ACCEPT_TCP_SSH_ESTAB has same filter-specific policer: MGMT_25MBPS but different counters or no counters. For per filter-spec policer, one unique counter across terms to be configured or no counters.
Oct 4 15:42:23 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwPfeFilter", msg = " func = validateTermActions, Term = ACCEPT_SSH, Term = ACCEPT_TCP_SSH_ESTAB, same filter-specific policer = MGMT_25MBPS, but different counters = or no counters, For per filter-spec policer, one unique counter = across terms to be configured or no counters"
Oct 4 15:42:23 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwPfeFilter", msg = " func = updateComplete, updateFilter/updateComplete in validateTermActions = failed, filtIdx = 2100, filtername = PROTECT_RE"
Oct 4 15:42:23 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] Dfw: modifyFilter:updateComplete failed PROTECT_RE
Oct 4 15:42:23 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] Dfw: Filter Modify failed for filter PROTECT_RE
Oct 4 15:42:57 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwHandler", msg = " func = preUnInstallRules, Failed to get bind-info for bindContext = 157"
Oct 4 15:42:57 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwHandler", msg = " func = unInstallDfwRules, preUnInstallRules = failed, bindContext = 157"
ct 4 15:43:23 jtac-acx7024-r2003 mgd[14528]: UI_COMMIT_PROGRESS: Commit operation in progress: signaling 'Layer 2 Control Protocol process', pid 10820, signal 1, status 0 with notification errors enabled
Oct 4 15:43:22 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwHandler", msg = " brcm_add_action_counter_policer = Stat-id and policer-id are not equal for StatAndPolicer, Stat-id = 161, policer-id = 160"
Oct 4 15:43:22 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] BrcmPlusPfe: Dfw: fp action add Counter failed , ret = Internal error
Oct 4 15:43:22 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] BrcmPlusPfe: hwInstallDfwRule failed., ret = Internal error
Oct 4 15:43:22 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] Dfw: Failed to install rules for term ACCEPT_TCP_SSH_ESTAB in hardware
Oct 4 15:43:22 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwFilterBind", msg = " func = installTerm, Install rules in hardware = failed, term = ACCEPT_TCP_SSH_ESTAB"
Oct 4 15:43:22 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwFilterBind", msg = " func = updateHw, Failed to install Term = ACCEPT_TCP_SSH_ESTAB"
Oct 4 15:43:23 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwFilterBind", msg = " func = install, Failed to install in hw for filter = PROTECT_RE"
Oct 4 15:43:23 jtac-acx7024-r2003 evo-pfemand[9924]: [t:9924] [Error] compName = "DFW", tpName = "DfwHandler", msg = " processBind = Failed to install filter bind"
This config is unsupported in ACX7k routers.