设备:S6800
版本:2612P02
S6800设备替换思科旧设备时,发现提示ACL资源不足:
PFILTER/3/PFILTER_IF_NO_RES,acl resource is insufficient.
查看现场返回的诊断信息,发现packet filter下发到底层为double模式,共占用了6个slice,这6个slice,根据TD2+芯片规格,理论上可以提供2048+1024+1024=4096个entry,而现场已经使用了3977个entry。查看思科配置发现,思科设备是把一条超长的ACL(里边有462的rule),在33个vlan interface inbound方向上进行包过滤 ,这个操作需要消耗462*33=15246条slice资源。超出了设备规格,导致下发失败,最后提示资源不足的问题。
通过命令行查看底层资源查用情况,
[h3c-probe]debug qacl show acl-resc slot 2 chip 0
Pri 7, Group 3,usedEntries 130,mode Single, physlice 3/
=========================================
acl type usedEntries[130]
=========================================
[111]Policy Based Routing V4 130
======================================
-------------------------------------------------------------------------
Pri 8, Group 2,usedEntries 3977,mode Double, physlice 0/1/4/5/6/7/
=========================================
acl type usedEntries[3977]
=========================================
[96 ]PktFilter IP on VRF 3977
======================================
TD2+ 芯片规格: 每个slice的entry :
{2048, ,}, /* 0*/
{2048, }, /* 1 */
{2048, }, /* 2 */
{2048, }, /* 3 */
{1024, }, /* 4 */
{1024, ,}, /* 5 */
{1024, ,}, /* 6 */
{1024, ,}, /* 7 */
{1024, ,}, /* 8 */
{1024, ,}, /* 9 */
{1024, }, /* 10 */
{1024, ,}, /* 11 */
1.
1.1
1.2
例如:
rule 35 permit udp source 10.97.31.11 0 destination 10.97.32.0 0.0.0.255 destination-port gt 16384 ------删除
2.
2.1
2.2
[TD3_Tor_9850]display packet-filter interface
Interface: Vlan-interface10
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface11
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface12
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface13
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface14
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface15
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface16
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface17
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface18
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface19
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface20
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface21
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface22
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface23
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface24
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface25
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface26
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface27
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface28
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface29
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface30
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface31
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface32
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface33
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface134
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface135
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface136
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface137
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface138
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface139
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface140
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface141
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
Interface: Vlan-interface142
Inbound policy:
IPv4 ACL AL-Input-Standard, Share-mode
[TD3_Tor_9850-tcl-probe]debug qacl show acl-resc sl 1 c 0
---------------Qacl Group UsedResc Info---------------
Acl Hw Resource: VFP, Pipe:0
-------------------------------------------------------------------------
Pri 3, Group 5,usedEntries 16 ,mode Single, physlice 0/
=========================================
acl type usedEntries[16]
=========================================
[109]Pdt VFP FirstNh2Classid 16
======================================
-------------------------------------------------------------------------
Acl Hw Resource: EFP, Pipe:0
-------------------------------------------------------------------------
Acl Hw Resource: IFP, Pipe:0
-------------------------------------------------------------------------
Pri 120, Group 3,usedEntries 46 ,mode Double, physlice 6/7/
=========================================
acl type usedEntries[46]
=========================================
[23 ]RX Low 9
[25 ]Super_RX Low 1
[92 ]DATAPROTECT 1
[114]IFP LOW 1
[129]MPLS Vpn High 1
[153]PDT LOW INITIAL 1
[307]UntrustPriority 32
======================================
-------------------------------------------------------------------------
Pri 122, Group 7,usedEntries 1 ,mode Single, physlice 8/
=========================================
acl type usedEntries[1]
=========================================
[120]Policy Based Routing V4 1
======================================
-------------------------------------------------------------------------
Pri 123, Group 9,usedEntries 462,mode Double, physlice 3/4/
=========================================
acl type usedEntries[462]
=========================================
[96 ]PktFilter IP on VRF 462
======================================
-------------------------------------------------------------------------
Pri 125, Group 1,usedEntries 59 ,mode Triple, physlice 9/10/11/
=========================================
acl type usedEntries[59]
=========================================
[8 ]RX IPv4 High 5
[10 ]RX IPv4 Middle 29
[13 ]RX IPv6 High 8
[14 ]RX IPv6 Middle_High 1
[15 ]RX IPv6 Middle 3
[70 ]RX Middle Low 2
[87 ]STMVLAN_PERMIT 9
[88 ]STM_DENYALL 1
[152]PDT HIGH INITIAL 1
======================================
-------------------------------------------------------------------------
Acl Hw Resource: IFP, Pipe:1
-------------------------------------------------------------------------
Pri 120, Group 4,usedEntries 71 ,mode Double, physlice 6/7/
=========================================
acl type usedEntries[71]
=========================================
[23 ]RX Low 9
[25 ]Super_RX Low 1
[92 ]DATAPROTECT 1
[114]IFP LOW 1
[129]MPLS Vpn High 1
[153]PDT LOW INITIAL 1
[307]UntrustPriority 57
======================================
-------------------------------------------------------------------------
Pri 122, Group 8,usedEntries 1 ,mode Single, physlice 8/
=========================================
acl type usedEntries[1]
=========================================
[120]Policy Based Routing V4 1
======================================
-------------------------------------------------------------------------
Pri 123, Group 10,usedEntries 462,mode Double, physlice 3/4/
=========================================
acl type usedEntries[462]
=========================================
[96 ]PktFilter IP on VRF 462
======================================
-------------------------------------------------------------------------
Pri 125, Group 2,usedEntries 49 ,mode Triple, physlice 9/10/11/
=========================================
acl type usedEntries[49]
=========================================
[8 ]RX IPv4 High 5
[10 ]RX IPv4 Middle 29
[13 ]RX IPv6 High 8
[14 ]RX IPv6 Middle_High 1
[15 ]RX IPv6 Middle 3
[70 ]RX Middle Low 2
[152]PDT HIGH INITIAL 1
======================================
-------------------------------------------------------------------------
Acl Hw Resource: EXTERNAL, Pipe:0
-------------------------------------------------------------------------
ACL ext mode: disable
Acl Group RollBack Info Begin
Acl Group RollBack Info : VFP, Pipe 0
=====================================
GID PRI MODE SliceBitmap
-------------------------------------
5 3 Single 0x0001
======================================
Acl Hw Resource: VFP, Pipe 0
======================================
entrynum counternum meternum
total : 1024 0 0
total-reserved : 256 0 0
used-reserved : 16 0 0
used-useracl : 0 0 0
free-useracl : 768 0 0
======================================
------------------------------------------------------
Acl Group RollBack Info : EFP, Pipe 0
=====================================
GID PRI MODE SliceBitmap
-------------------------------------
======================================
Acl Hw Resource: EFP, Pipe 0
======================================
entrynum counternum meternum
total : 2048 1024 1024
total-reserved : 0 0 0
used-reserved : 0 0 0
used-useracl : 0 0 0
free-useracl : 2048 1024 1024
======================================
------------------------------------------------------
Acl Group RollBack Info : IFP, Pipe 0
=====================================
GID PRI MODE SliceBitmap
-------------------------------------
3 122 Double 0x00c0
7 124 Single 0x0100
1 125 Triple 0x0e00
======================================
Acl Hw Resource: IFP, Pipe 0
======================================
entrynum counternum meternum
total : 18432 18432 3072
total-reserved : 7680 7680 768
used-reserved : 538 72 56
used-useracl : 1849 0 0
free-useracl : 8903 10752 2304
======================================
------------------------------------------------------
Acl Group RollBack Info : IFP, Pipe 1
=====================================
GID PRI MODE SliceBitmap
-------------------------------------
4 122 Double 0x00c0
8 124 Single 0x0100
2 125 Triple 0x0e00
======================================
Acl Hw Resource: IFP, Pipe 1
======================================
entrynum counternum meternum
total : 18432 18432 3072
total-reserved : 7680 7680 768
used-reserved : 578 62 56
used-useracl : 1849 0 0
free-useracl : 8903 10752 2304
======================================
------------------------------------------------------
Acl Group RollBack Info : EXTERNAL, Pipe 0
=====================================
GID PRI MODE SliceBitmap
-------------------------------------
======================================
Acl Hw Resource: EXTERNAL, Pipe 0
======================================
entrynum counternum meternum
total : 0 0 0
total-reserved : 0 0 0
used-reserved : 0 0 0
used-useracl : 0 0 0
free-useracl : 0 0 0
======================================
------------------------------------------------------
[TD3_Tor_9850-tcl-probe]
[TD3_Tor_9850]display qos-acl re sl 1
Interfaces: HGE1/1/1 to HGE1/1/4, XGE1/1/5:1 to XGE1/1/6:4
HGE1/1/7, XGE1/1/8:1 to XGE1/1/8:4
FGE1/3/1 to FGE1/3/16 (slot 1)
---------------------------------------------------------------------
Type Total Reserved Configured Remaining Usage
---------------------------------------------------------------------
VFP ACL 1024 256 0 768 25%
IFP ACL 18432 7680 1849 8903 51%
IFP Meter 3072 768 0 2304 25%
IFP Counter 18432 7680 0 10752 41%
EFP ACL 2048 0 0 2048 0%
EFP Meter 1024 0 0 1024 0%
EFP Counter 1024 0 0 1024 0%
Interfaces: GE1/0/1 to GE1/0/2, XGE1/2/1 to XGE1/2/24
FGE1/2/25 to FGE1/2/26, WGE1/4/1 to WGE1/4/24
HGE1/4/25, XGE1/4/26:1 to XGE1/4/26:4 (slot 1)
---------------------------------------------------------------------
Type Total Reserved Configured Remaining Usage
---------------------------------------------------------------------
VFP ACL 1024 256 0 768 25%
IFP ACL 18432 7680 1849 8903 51%
IFP Meter 3072 768 0 2304 25%
IFP Counter 18432 7680 0 10752 41%
EFP ACL 2048 0 0 2048 0%
EFP Meter 1024 0 0 1024 0%
EFP Counter 1024 0 0 1024 0%
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作