7506R交换机报acl掩码资源不足经验案例

一、   问题描述：

某客户在S7506R交换机的物理接口上下发acl是报资源不足，但后面的acl又下发成功，现象如下：

[jscoreswitch-qosb-GigabitEthernet2/0/1]packet-filter inbound ip-group 3010

 访问列表 3010 rule 1 已经下发!(GigabitEthernet2/0/1)

 访问列表 3010 rule 2 已经下发!(GigabitEthernet2/0/1)

……

 访问列表 3010 rule 70 已经下发!(GigabitEthernet2/0/1)

 下发 Acl 3010 rule 71 操作失败!  失败原因：表项资源不足!

 访问列表 3010 rule 72 已经下发!(GigabitEthernet2/0/1)

 ……

 访问列表 3010 rule 81 已经下发!(GigabitEthernet2/0/1)

 访问列表 3010 rule 82 已经下发!(GigabitEthernet2/0/1)

 下发 Acl 3010 rule 110 操作失败!  失败原因：表项资源不足!

 下发 Acl 3010 rule 112 操作失败!  失败原因：表项资源不足!

交换机版本为R3135版本，版本较老，因此客户怀疑故障现象与版本有关。

二、   过程分析：

    Acl占用的资源主要包括：规则资源、流量监管资源、流量统计资源、掩码资源等。从报资源不足又能下发成功的现象分析看，问题应掩码资源不足导致。

1、将客户配置导入交换机中，问题复现。

[Quidway S6506R-qosb-GigabitEthernet7/0/1]packet-filter  inbound  ip-group  3010

 Applying Acl 3010 rule 71 failed!  Reason: Resource unavailable!(GigabitEthernet7/0/1)

 Applying Acl 3010 rule 74 failed!  Reason: Resource unavailable!(GigabitEthernet7/0/1)

 Applying Acl 3010 rule 75 failed!  Reason: Resource unavailable!(GigabitEthernet7/0/1)

 Applying Acl 3010 rule 76 failed!  Reason: Resource unavailable!(GigabitEthernet7/0/1)

 Applying Acl 3010 rule 110 failed!  Reason: Resource unavailable!(GigabitEthernet7/0/1)

 Applying Acl 3010 rule 112 failed!  Reason: Resource unavailable!(GigabitEthernet7/0/1)

2、通过display acl  remaining  entry  slot  7命令查看acl资源发现：

[Quidway S6506R-qosb-GigabitEthernet7/0/1]dis acl  remaining  entry  slot  7

  Slot: 7

  Resource  Total   Reserved  Configured  Remaining   Start       End

    Type    Number   Number     Number      Number   Port Name  Port Name

--------------------------------------------------------------------------

    MASK      16       10          6           0       GE7/0/1    GE7/0/1

    RULE     128       16         67          45       GE7/0/1    GE7/0/1

   METER     128        9          0         119       GE7/0/1    GE7/0/1

 COUNTER     128       14          0         114       GE7/0/1    GE7/0/1

    MASK      16       10          0           6       GE7/0/2    GE7/0/2

    RULE     128       16          0         112       GE7/0/2    GE7/0/2

   METER     128        9          0         119       GE7/0/2    GE7/0/2

 COUNTER     128       14          0         114       GE7/0/2    GE7/0/2

显然，acl的掩码资源已用完。

3、通过查看所配置的acl掩码类型：

acl number 3010                          

 rule 1 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.3 0---------------------------源和目的ip地址反掩码分别为23位和32位

 rule 2 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.16 0

 rule 3 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.30 0

 rule 4 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.0.3 0

 rule 5 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.18 0

 rule 6 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.38 0

 rule 8 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.0.102 0

 rule 9 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.0.87 0

 rule 10 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.0.89 0

 rule 11 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.0.44 0

 rule 12 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.10 0

 rule 13 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.56 0

 rule 14 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.58 0

 rule 15 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.35 0

 rule 16 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.47 0

 rule 17 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.115 0

 rule 19 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.13 0

 rule 21 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.5.0 0.0.0.255------------------源和目的ip地址反掩码分别为23位和24位

rule 23 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.9.80 0

 rule 25 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.9.8 0

 rule 26 permit ip source 172.16.18.0 0.0.1.255 destination 172.15.9.251 0

 rule 27 permit ip source 172.16.18.0 0.0.0.255 destination 172.15.18.0 0.0.0.255--------------------源和目的ip地址反掩码分别为24位和24位rule 28 permit ip source 172.15.18.0 0.0.0.255 destination 172.16.18.0 0.0.0.255

 rule 29 permit ip source 172.16.18.5 0------------------------源ip地址反掩码为32位，过滤报文类型为ip报文

rule 30 permit ip source 172.16.18.10 0

 rule 31 permit ip source 172.16.18.25 0

 rule 32 permit ip source 172.16.18.26 0

 rule 33 permit ip source 172.16.18.27 0

 rule 34 permit ip source 172.16.18.22 0

 rule 35 permit ip source 172.16.18.21 0

 rule 36 permit ip source 172.16.18.20 0

 rule 37 permit ip source 172.16.18.4 0

 rule 39 permit ip source 172.16.18.9 0

 rule 41 permit ip source 172.16.18.241 0

 rule 43 permit ip source 172.16.18.242 0

 rule 45 permit ip source 172.16.18.243 0

 rule 46 permit ip source 172.16.18.244 0

 rule 47 permit ip source 172.16.18.245 0

 rule 49 permit ip source 172.16.18.246 0

 rule 50 permit ip source 172.16.18.247 0

 rule 51 permit ip source 172.16.18.248 0

 rule 52 permit ip source 172.16.18.249 0

 rule 54 permit icmp source 172.16.18.1 0----------源ip地址反掩码32位，过滤报文类型为icmp

rule 55 permit icmp source 172.16.19.1 0

 rule 56 permit ip source 172.16.18.0 0.0.0.255 destination 172.16.20.0 0.0.0.255

 rule 57 permit ip source 172.16.20.0 0.0.0.255 destination 172.16.18.0 0.0.0.255

 rule 58 permit ip source 172.16.19.0 0.0.0.255 destination 172.16.20.0 0.0.0.255

 rule 59 permit ip source 172.16.20.0 0.0.0.255 destination 172.16.19.0 0.0.0.255

 rule 60 permit ip source 172.16.18.0 0.0.0.255 destination 172.16.19.0 0.0.0.255

 rule 61 permit ip source 172.16.19.0 0.0.0.255 destination 172.16.18.0 0.0.0.255

 rule 62 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.9.0 0.0.0.255

 rule 63 permit ip source 172.16.18.0 0.0.0.255 destination 172.16.0.55 0-----------------------------源和目的ip地址反掩码分别为24位和32位

rule 64 permit ip source 172.16.19.0 0.0.0.255 destination 172.16.0.55 0

 rule 65 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.131 0

 rule 66 permit ip source 172.16.18.0 0.0.1.255 destination 172.16.0.132 0

 rule 67 permit ip source 172.16.21.0 0.0.0.255 destination 10.10.10.106 0

 rule 68 permit ip source 172.16.21.0 0.0.0.255 destination 10.10.10.115 0

 rule 69 permit ip source 172.16.18.0 0.0.0.255 destination 10.10.10.116 0

 rule 70 permit ip source 172.16.21.0 0.0.0.255 destination 192.168.1.185 0

 rule 71 deny ip source 172.16.21.0 0.0.0.255--------------源ip地址反掩码为24位，第七种掩码类型，报资源不足

rule 72 permit ip source 172.16.18.0 0.0.0.255 destination 172.16.0.86 0

 rule 73 permit ip source 172.16.19.0 0.0.0.255 destination 172.16.0.86 0

 rule 74 permit ip source 172.16.18.144 0 destination 172.16.0.17 0

三、   解决方法：

    告知客户，通过优化acl规则的mask，问题得到解决。