某局点S7510X-G，ACL下发失败,客户现场在acl中增加新的一条rule355后提示设备资源不足

客户现场在acl中增加如下标红的新的规则rule355后提示设备资源不足

[SQ_SHH_BG_SW_01-probe]display acl name defencevirus

Advanced IPv4 ACL named defencevirus, 70 rules,

...

rule 325 deny udp source-port eq 2152

rule 330 deny udp destination-port eq 2123

rule 335 deny udp source-port eq 2123

rule 340 deny udp destination-port eq 3386

rule 345 deny udp source-port eq 3386

rule 350 deny tcp destination-port eq 3386

rule 355 deny tcp source-port eq 3386//增加这一条

1、probe视图查看当前板卡甚于资源是目前是占用了4588个资源剩余仅有20

[SQ_SHH_BG_SW_01-probe]display hardware internal qacl show acl-resc slot 7 chip 0

---------------Qacl Group UsedResc Info---------------

Acl Hw Block: IACL 2

======================================================

  GroupType: PFT L3

  ----------------------------------------------------

    acl type                   usedEntries

    [ 67]PktFilter IP on PORT        2294

Acl Hw Block: IACL 7

======================================================

  GroupType: PKTFLT

  ----------------------------------------------------

    acl type                   usedEntries

    [ 73]PktFilter IPV4 on RPORT        62  

|          | Type           Total     Reserved    Configured  Remaining     

|  IACL 2  |Entry           4608        0           4588        20          |

|          |Entry640        0           0           0           0           |

|          |Block Counter   2304        0           0           2304        |

|          @----------------------------------------------------------------@

|  IACL 7  |Entry           512         0           124         388         |

|          |Entry640        0           0           0           0           |

|          |Block Counter   256         0           0           256         

2、查看当前设备入方向的总资源总共是8192，其中分为IACL0、IACL1、IACL2、IACL7，IACL0和1是为系统资源保留的无法使用，包过滤能下发的就只有2和7。

[SQ_SHH_BG_SW_01-probe]display qos-acl resource

Interfaces: GE3/0/1 to GE3/0/48 (slot 3)

---------------------------------------------------------------------

 Type             Total      Reserved   Configured Remaining  Usage

---------------------------------------------------------------------

 IGS ACL          8192       1536       2396       4260       47%

 EGS ACL          1536       0          0          1536       0%

 IGS Counter      4096       768        1          3327       18%

 EGS Counter      768        0          0          768        0%

 IGS Meter        8191       100        3          8088       1%

 EGS Meter        2047       0          0          2047       0%

 IMeter Counter   3327       300        9          3018       9%

 EMeter Counter   3839       0          0          3839       0%

3、看底层的话配置的话packet-filter name defencevirus inbound下发在不同的接口（二层口或者三层口），每个接口都会在所在单板下一份即一条rule所占资源就是两条也就是说新增的rule仅能在10个接口下下发，但是现场不止这么多接口导致出现问题，后续减少接口下发。

   [ 73]PktFilter IPV4 on RPORT        62  

           [ 67]PktFilter IP on PORT        2294

换高规格板卡或减少rule下发