某局点S7506E-NP 设备报ACL资源不足问题

/

/

现场设备偶尔会报资源不足，但是看前后日志没有添加acl相关配置。

报错前后有接口震荡：

%@14911845%Mar 28 15:44:19:607 2023 CORE_A IFNET/3/PHY_UPDOWN: Physical state on the interface GigabitEthernet2/0/40 changed to up. %@14911846%Mar 28 15:44:19:607 2023 CORE_A IFNET/5/LINK_UPDOWN: Line protocol state on the interface GigabitEthernet2/0/40 changed to up. %@14911847%Mar 28 15:44:20:251 2023 CORE_A IFNET/3/PHY_UPDOWN: Physical state on the interface GigabitEthernet2/0/40 changed to down. %@14911848%Mar 28 15:44:20:261 2023 CORE_A IFNET/5/LINK_UPDOWN: Line protocol state on the interface GigabitEthernet2/0/40 changed to down. %@14911856%Mar 28 15:47:49:443 2023 CORE_A PORTAL/4/RULE: -Slot=2; Not enough resources. %@14911857%Mar 28 15:48:22:496 2023 CORE_A PORTAL/4/RULE: -Slot=2; Not enough resources. %@14911858%Mar 28 15:49:59:589 2023 CORE_A PORTAL/4/RULE: -Slot=2; Not enough resources.

查看配置发现配置了portal，和大量的Free-rule，现场是在新增free-rule的时候报资源不足的： 

%Mar 28 14:00:58:385 2023 CORE_A SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=172.16.7.55-User=admin; Command is dis arp | inc 172.16.5.41

%Mar 28 14:00:58:420 2023 CORE_A SHELL/6/SHELL_CMD: -Line=vty1-IPAddr=172.16.7.125-User=admin; Command is portal free-rule 550 source ip 172.16.149.208 32

%Mar 28 14:00:58:707 2023 CORE_A SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=172.16.7.55-User=admin; Command is dis arp | inc 172.16.144.108

%Mar 28 14:00:58:995 2023 CORE_A SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=172.16.7.55-User=admin; Command is dis arp | inc 172.16.63.38

%Mar 28 14:00:59:338 2023 CORE_A SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=172.16.7.55-User=admin; Command is dis arp | inc 172.16.144.155

%Mar 28 14:01:00:125 2023 CORE_A PORTAL/4/RULE: -Slot=2; Not enough resources.

当端口updown的时候，涉及新的portal用户上线，也要下发acl，资源不足也会报的。

现场已经没有空闲的slice了，其它slice计算有空闲的acl因为类型不同也无法给portal使用。

  ====debug qacl show acl-resc slot 2 chip 0==== 

---------------Qacl Group UsedResc Info---------------

Acl Hw Resource: VFP, Pipe:0

------------------------------------------------------

  Pri  2, Group  3,usedEntries 18 ,mode Single, physlice 2/

  =========================================

    acl type                   usedEntries[18]

  =========================================

    [107]Pdt VFP FirstNh2Classid        18 

  ======================================

------------------------------------------------------

  Pri  3, Group  2,usedEntries 1  ,mode Single, physlice 3/

  =========================================

    acl type                   usedEntries[1]

  =========================================

    [91 ]STMVLAN_PERMIT              1  

  ======================================

------------------------------------------------------

Acl Hw Resource: EFP, Pipe:0

------------------------------------------------------

  Pri  2, Group  7,usedEntries 62 ,mode Double, physlice 2/3/

  =========================================

    acl type                   usedEntries[62]

  =========================================

    [100]PktFilter IP on VRF         62 

  ======================================

------------------------------------------------------

Acl Hw Resource: IFP, Pipe:0

------------------------------------------------------

  Pri  7, Group  6,usedEntries 10 ,mode Double, physlice 0/1/

  =========================================

    acl type                   usedEntries[10]

  =========================================

    [148]PDT LOW INITIAL             1  

    [23 ]RX Low                      7  

    [25 ]Super_RX Low                1  

    [27 ]TCP_RX_MISS_LOWEST          1  

  ======================================

------------------------------------------------------

  Pri  9, Group  8,usedEntries 1017,mode Double, physlice 2/3/4/5/6/7/8/9/

  =========================================

    acl type                   usedEntries[1017]

  =========================================

    [35 ]Portal Free                 439

    [36 ]Portal User                 527

    [37 ]Portal Redirect             34 

    [39 ]Portal Deny                 17 

  ======================================

------------------------------------------------------

  Pri 11, Group  5,usedEntries 48 ,mode Single, physlice 11/

  =========================================

    acl type                   usedEntries[48]

  =========================================

    [116]Policy Based Routing V4        48 

  ======================================

------------------------------------------------------

  Pri 12, Group  4,usedEntries 70 ,mode Double, physlice 12/13/

  =========================================

    acl type                   usedEntries[70]

  =========================================

    [101]PktFilter Eth_Mac on VRF        2  

    [100]PktFilter IP on VRF         68 

  ======================================

------------------------------------------------------

  Pri 14, Group  1,usedEntries 50 ,mode Double, physlice 14/15/

  =========================================

    acl type                   usedEntries[50]

  =========================================

    [147]PDT HIGH INITIAL            1  

    [91 ]STMVLAN_PERMIT              2  

    [92 ]STM_DENYALL                 1  

    [7  ]RX IPv4 Super High          2  

    [8  ]RX IPv4 High                11 

    [9  ]RX IPv4 Middle High         5  

    [10 ]RX IPv4 Middle              26 

    [14 ]RX IPv6 Middle_High         1  

    [64 ]Zero-Mac-Deny               1  

  ======================================

现场一个slice的长度是256，portal占用了8个，共有8*256=2048，现场有1017个entry，因为是double模式，所以使用了1017*2=2034条。所以已占用的slice已经只剩14条资源。 同时通过debug qacl show acl-resc slot 2 chip 0可以看到该单板0~15的slice全部都被使用了，没有空闲的slice腾出来给portal用。所以就资源不足了。 现场如果不去优化acl ，想要删除配置来腾出slice，可以看下这些能不能删除：

------------------------------------------------------

  Pri 12, Group  4,usedEntries 70 ,mode Double, physlice 12/13/

  =========================================

    acl type                   usedEntries[70]

  =========================================

    [101]PktFilter Eth_Mac on VRF        2  

    [100]PktFilter IP on VRF         68 

  ======================================

现场配置了portal，包过滤和pbr，其中portal占用了非常多的acl，其中portal中配置了较多的portal-free rule，建议精简到5条内优化解决。

同时也可以核对其它包过滤和pbr配置的必要性，如果不需要可以删除配置来释放acl，腾出acl资源。