某局点 S12510-X 新增网段下发PBR后，业务丢包案例

设备及版本:S12510-X 1150

组网：不涉及

问题描述：在交换机上新增网断并下发PBR配置后，出现大规模断网、延迟大丢包的情况，重启设备后恢复。

查看日志发现底层有资源满的报错

Chassis02 slot00 2021/11/11 07:44:20:0063 [LINE:668-TASK:pbrd-FUNC:_bcm_dpp_field_tcam_entry_hardware_install]:_bcm_dpp_field_tcam_entry_hardware_install[668]_bcm_dpp_field_tcam_entry_hardware_install: unable to add unit 1 group 7 entry 5523 to hardware: -6 (Table full)

Chassis02 slot00 2021/11/11 07:44:20:0063 [LINE:17486-TASK:pbrd-FUNC:_bcm_dpp_am_template_trap_egress_free]:_bcm_dpp_am_template_trap_egress_free[17486]_bcm_dpp_am_template_trap_egress_free unit 1: Invalid parameter

Chassis02 slot00 2021/11/11 07:44:20:0063 [LINE:675-TASK:pbrd-FUNC:_bcm_dpp_field_tcam_entry_hardware_install]:_bcm_dpp_field_tcam_entry_hardware_install[675]_bcm_dpp_field_tcam_entry_hardware_install: Table full

Chassis02 slot00 2021/11/11 07:44:20:0064 [LINE:17939-TASK:pbrd-FUNC:Drv_Qacl_Acl_Single_Install_Unit_Arad]:Drv_Qacl_Soc_Acl_Add failed,uiUnit_Iter 1, uiGroupPri = 7, ulRet 1073807371

Chassis02 slot00 2021/11/11 07:44:20:0000 [LINE:18873-TASK:pbrd-FUNC:Drv_Qacl_Acl_Set_Arad]:Drv_Qacl_Acl_EntryList_Install failed ,AclType 111, Stage 2,Prio_Mjr 5,Prio_Sub 1,ulRet 1073807371

Chassis02 slot00 2021/11/11 07:44:21:0044 [LINE:3301-TASK:pbrd-FUNC:Drv_Qacl_Runtime_Update]:Drv_Qacl_Runtime_Update: beyond max item 30. time=0

查看日志发现故障时间有报ACL资源不足

*Nov 11 07:24:06:351 2021 JMU-YW-S12510 PBR4/6/PBR_TRACE: -Chassis=2-Slot=0; Not enough ACL resources are available to complete the operation, Policy: SDN_2500, Node: 100, Interface: Vlan-interface1541.

*Nov 11 07:24:07:302 2021 JMU-YW-S12510 PBR4/6/PBR_TRACE: -Chassis=1-Slot=0; Not enough ACL resources are available to complete the operation, Policy: SDN_2500, Node: 100, Interface: Vlan-interface1541.

*Nov 11 07:24:08:379 2021 JMU-YW-S12510 PBR4/6/PBR_TRACE: -Chassis=2-Slot=0; Not enough ACL resources are available to complete the operation, Policy: SDN_2500, Node: 100, Interface: Vlan-interface1528.

*Nov 11 07:24:09:716 2021 JMU-YW-S12510 PBR4/6/PBR_TRACE: -Chassis=1-Slot=0; Not enough ACL resources are available to complete the operation, Policy: SDN_2500, Node: 100, Interface: Vlan-interface1528.

查看底层现在的资源占用情况是5369条。总共6个BANK实际是6000条资源，因此还剩余600条左右的资源

  Pri 45, Group  6,usedEntries 5369,mode Double,

  ResDb  6, KeySize 160Bit, Bank 3/7/8/9/10/11/First-pass KeyB

  =========================================

    acl type                   usedEntries[5369]

  =========================================

    [111]Policy Based Routing V4        5369    

  ======================================

以SDN_2500这一PBR策略为例

interface Vlan-interface1511

ip binding vpn-instance niuedfeoc8vgpmt4smbs4m5up

ip address 10.9.6.1 255.255.255.128

ip policy-based-route SDN_2500

该策略应用在了70个接口上，应用了69条ACL RULE，即单纯这条policy，占用的资源为70×69=4830条。

当新增加一个 ACL RULE时，底层会先找到70×70=4900条资源进行下发，然后再把之前的4830条删除，这样做的目的是为了避免直接删除底层下发会导致流量中断。而此时空间不足，就会造成下发失败，因此出现此问题。

优化下发PBR的数量和ACL规则数量