Issue with HW limit exceeded when applying IPv6 ACLs

Question

Dear Community,  I have the weird issue with causing error 'Error encountered applying ACL to HW. HW limit may have been exceeded' during activation of IPv6 ACL for inbound direction on VLAN Interface .  I have single IPv4 ACL with 27 Permit ACE Records with allow rules for various UDP / TCP Traffic flows already activated on this VLAN Interface and in case I activate additionally IPv6 ACL on same VLAN Interface I encounted HW Limit warning: (config-if-vlanXXX)#ipv6 traffic-filter IPv6-VLANXXX inError encountered applying ACL to HW. HW limit may have been exceeded. Issue is happening even when IPv6-VLANXXX ACL contains single ACE Record inside (example below) 1000 permit udp XX:XX::XX:XX/64 XX:XX::XX:XX/64 eq XXX I did not exceed any limitations listed in N-series and ACL Hardware Limitation article and I do not use any ACE with log actions.  https://www.dell.com/support/article/de-de/sln294200/n-series-and-acl-hardware-limitation?lang=en Platform: N4000F using 6.3.3.10 with 4 Stack Members.  I did not found any commands in CLI guide how it is possible to utilization of slices in case I hit limitation from this side.  Any ideas? Maybe known bug in firmware 6.3.3.10?  Thank You in advance for assistance.

DELL-Josh Cr · Answer

Hi AiLv,

There have been a lot of fixes in the versions between what you are on and the current version, it would be recommended to update to the latest version and see if you are still having the issue. https://dell.to/3mHXVIH

AiLv · Answer

Dear DELL-Josh Cr,  Unfortunately I did not found any information about fixed ACL related issues on versions above my current. Would you advise to try new version anyway?   Is there way or tips and tricks to control / display slices utilization?  Best regards,  AiLv

DELL-Josh Cr · Answer

Yes, because if it is a bug we will need to be on the latest version prior to being able to escalate it. Does the rule work even with the error?

AiLv · Answer

I kindly apologize for delayed response. Unfortunately no, rules not working because ACL do not attach to interface entirely after error. in show ipv6 access-list there is same story, no evidence of applied ACL.

Dell-DylanJ · Answer

Hello,

If I'm understanding the thread correctly, it looks like you were going to update the switch to the latest revision to see if the error continues, or if it is corrected. Have you been able to update the switch and test, or does that still need to be done?

kizik12 · Answer

There are a number of tools available for configuring ACLs in Cumulus Linux: ... ebtable rules are put into either the IPv4 or IPv6 memory space depending on whether ... However, the rule is not synced to hardware when applied in this way and ...

AiLv · Answer

Dear kizik12, Do you mean that in general is not possible to run both IPv4 and IPv6 ACLa on Dell N-Series switches in parralel? Does anyone have success cases with running of IPv6 + IPv4 ACLs in forum? I would be very grateful for sharing of experience and examples.

AiLv · Answer

Dear Dell-DylanJ, Yes, you understand right, but I did not upgraded to latest version yet. I managed to test my ACLs set on similar environment, but with version 6.5.1.5 instead comrising from three switches in stack. Unfortunately result is pretty the same. Any ideas?

DELL-Josh Cr · Answer

There isn’t necessarily a hard limit.

Page 268 https://dell.to/2GGfcBH

The maximum number of ACLs and rules supported depends on the resources consumed by other processes and configured features running on the switch.

AiLv · Answer

I read this to be honest, therefore I asked initially is there commands existing to check actual limit based on the resources consumtion by other processes and enabled features running. This is not transparent for end user. To me as a consumer important to know how many access-lists I can implement at current point of time. In case I execute show ip access-list command it will show me 100 ACLs available, which I apparently not true, at least in my case.

DELL-Josh Cr · Answer

It would be a nice feature, I agree, I am not sure if it is something we are looking at adding.

Networking General

Was this post helpful?