3

TCAM carving question for Cisco Nexus 9396PX I have Cisco Nexus 9396PX and configure for IPv4 with IPv4 RACL on SVI to block some basic traffic. Now i have configured IPv6 and trying to configure access-list but its saying you don't have TCAM space so i started looking around to see where i can borrow and this is what i have.

As per document i may need 512 slice for ipv6 doble-width.

Question:

can i combine two 256 to create 512?

what is IPV4 PACL (i don't know who is using it and how to find out if someone using it?)

I am using BFD on this switch ( does BFD using redirect tcam space?)

# show hardware access-list tcam region | exclude 0
                               IPV4 PACL [ifacl] size =  512
                             IPV4 Port QoS [qos] size =  256
                                IPV4 RACL [racl] size =  512
                       Egress IPV4 RACL [e-racl] size =  256
                                  Ingress System size =  256
                                   Egress System size =  256
                             Ingress COPP [copp] size =  256
                             Redirect [redirect] size =  512
                       NS IPV4 Port QoS [ns-qos] size =  256
                      NS IPV4 VLAN QoS [ns-vqos] size =  256
                       NS IPV4 L3 QoS [ns-l3qos] size =  256
 VPC Convergence/ES-Multi Home [vpc-convergence] size =  256
               Ingress ARP-Ether ACL [arp-ether] size =  256
                       ranger+ IPV4 QoS [rp-qos] size =  256
                  ranger+ IPV6 QoS [rp-ipv6-qos] size =  256
                    ranger+ MAC QoS [rp-mac-qos] size =  256
                               sFlow ACL [sflow] size =  256

IPv6 has zero allocation

# show hardware access-list tcam region | grep IPV6
                          IPV6 PACL [ipv6-ifacl] size =    0
                        IPV6 Port QoS [ipv6-qos] size =    0
                  FEX IPV6 PACL [fex-ipv6-ifacl] size =    0
                FEX IPV6 Port QoS [fex-ipv6-qos] size =    0
                           IPV6 VACL [ipv6-vacl] size =    0
                       IPV6 VLAN QoS [ipv6-vqos] size =    0
                           IPV6 RACL [ipv6-racl] size =    0
                    Egress IPV6 QoS [e-ipv6-qos] size =    0
                    Egress IPV6 VACL [ipv6-vacl] size =    0
                  Egress IPV6 RACL [e-ipv6-racl] size =    0
                        IPV6 L3 QoS [ipv6-l3qos] size =    0
                  NS IPV6 Port QoS [ns-ipv6-qos] size =    0
                 NS IPV6 VLAN QoS [ns-ipv6-vqos] size =    0
                  NS IPV6 L3 QoS [ns-ipv6-l3qos] size =    0
                  ranger+ IPV6 QoS [rp-ipv6-qos] size =  256

This is what my utilization tables looks (its saying PACL used 3 does that means i can't take that slice?)

        ACL Hardware Resource Utilization (Mod 1)
         ----------------------------------------------------------
                                        Used    Free    Percent
                                                        Utilization
-------------------------------------------------------------------
Ingress IPv4 PACL                       3       509     0.58
Ingress IPv4 Port QoS                   4       252     1.56
Ingress IPv4 RACL                       32      480     6.25
Egress IPv4 RACL                        3       253     1.17
SUP COPP                                214     42      83.59
SUP COPP Reason Code TCAM               8       120     6.25
Redirect                                7       505     1.36
Ingress Ether ACL                       15      241     5.85
VPC Convergence                         1       255     0.39
sFlow Northstar ACL                     0       256     0.00

LOU                                     2       22      8.33
Both LOU Operands                       2
Single LOU Operands                     0
LOU L4 src port:                        1
LOU L4 dst port:                        1
LOU L3 packet len:                      0
LOU IP tos:                             0
LOU IP dscp:                            0
LOU ip precedence:                      0
LOU ip TTL:                             0
TCP Flags                               0       16      0.00

Protocol CAM                            2       244     0.81
Mac Etype/Proto CAM                     0       14      0.00

L4 op labels, Tcam 0                    0       1023    0.00
L4 op labels, Tcam 2                    1       62      1.58
L4 op labels, Tcam 6                    0       2047    0.00
Improve this question
3
  • 1
    Have you read cisco.com/c/en/us/support/docs/switches/… ? – Zac67 Jan 15 at 17:07
  • Yes i did read that because in google search only that link show ip for any kind of tcam search :) – Satish Jan 15 at 17:16
  • 1
    TCAM allocation rules are very restrictive, not letting me use ifacl or qos slice for ipv6 or any other region. very limited options i have. I found middle ground for my solution so if it make sense then i will post in answer so it helps other folks. – Satish Jan 15 at 17:20
4

TCAM has lots of restriction regarding region. ifacl and qos can't be used for IP slice so that is out of picture. now i have only following option left

Redirect (512) - BFD, DHCPv4/v6 used this slice.

VACL (512) - If you are not using any VLAN acl then this is good slice to take it.

VPC (256) - If you are not using vPC then another good slice.

This is what i did for workaround or you can say tradoff. I reduce redirect from 512 to 256 so i have choice to use BFD/DHCP in future.

 hardware access-list tcam region vacl 0
 hardware access-list tcam region redirect 256
 hardware access-list tcam region vpc-convergence 0
 hardware access-list tcam region ipv6-racl 512

Reboot your switch otherwise it will not work.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.