topic Re: Qos. Policy-map qauntity limits in Network Security

Qos. Policy-map qauntity limits

Fireman — Sat, 07 Dec 2024 06:04:31 GMT

Good day for everyone!

We have a lot policy-maps for shaping traffic on our FTD and oneday we have received that no more than 128 policy maps could be defined:

[error]: ERROR: % No more that 128 policymaps can be defined

Unfortunately I didn't find any useful info about this in internet, maybe someone could tell me in here?:)

How much policymaps could be deployed on 1000/1200/3100/4200/9300 series?

What does the quantity of policymap depends on: software version, RAM, etc. ?

Re: Qos. Policy-map qauntity limits

balaji.bandi — Sat, 07 Dec 2024 07:16:13 GMT

What is the version of the code running? I only have a few policies tested. As per, I agree with you, but I am not aware of that limitation. Is this an error you are getting while creating new FDM or FMC policies?

Re: Qos. Policy-map qauntity limits

Fireman — Sat, 07 Dec 2024 07:59:27 GMT

Hi!

thanks for your reply!

I suppose the software can impact but how - thats the question:)

As I remember we have already some interfaces in zone and when I try to add the new sub.interface than quantity policy-maps increased and I have receive this error message. Its about FDM.
I dont understand clearly how many policy-maps could be implemented via zone(main interface).

maybe someone have data sheet about this?

Re: Qos. Policy-map qauntity limits

balaji.bandi — Sat, 07 Dec 2024 13:29:03 GMT

Again, I need to ask what the code is running here.

This may be a sub-interface issue. Do you have more than 128 sub-interfaces?

Re: Qos. Policy-map qauntity limits

Fireman — Mon, 09 Dec 2024 14:01:40 GMT

The software versions is 7.2.7, Yep! Now its about 150 sub interfaces, the policy-maps less than 120, the platform is 4145 and its single instance.

Re: Qos. Policy-map qauntity limits

Ramblin Tech — Mon, 09 Dec 2024 15:22:24 GMT

On platforms that compile policy-maps into TCAM entries, there will be pre-defined limits on how many different policy-maps can be applied to interfaces. This limit comes from the static "carving" of TCAM resources into different regions for different usages: FIB, ACL, QoS, etc. The different regions are not dynamically fungible in that, for example, unused FIB entries cannot be used for QoS purposes. Some systems support re-carving the TCAM to optimize for different use-cases by allowing particular resource "profiles" to be configured, but this usually requires a reboot to take effect.

Platforms that forward in software (ie, CPU-based forwarding) typically do not use TCAMs for FIB/ACL/QoS/etc lookups and so the number of class-maps & policy-maps need only be limited by RAM size. Platforms with ASIC/NPU forwarding often use TCAMs and have these hardware limits. It should be noted that even in ASIC/NPU platforms, usually class-maps and policy-maps occupy only RAM until they are actually applied to an interface with a service-policy command, and so the number of such maps should be limited only by RAM until then. It is at the time of interface application of the service policies that, typically, the QoS config is compiled into actual TCAM entries.

Re: Qos. Policy-map qauntity limits

Fireman — Tue, 10 Dec 2024 12:09:45 GMT

Hi! Thanks for your detailed answer.
As I understand you correctly for my 4145 I probably have limitation by RAM, but platform has 384-GB [omg]. Maybe you know how to check limitations before I receive an error? Do I need to check memory status before implement new service-policy/sub-interface? It would be very helpful, thanks in anyway.

Re: Qos. Policy-map qauntity limits

Ramblin Tech — Tue, 10 Dec 2024 19:46:26 GMT

Hi Fireman,

I am not really familiar with the 4100 series of firewalls, but given the throughput of the 4145 (up to 80Gbps) listed in its datasheet, it almost certainly forwards in hardware. My assumption is that the issue is with consumption of some specialized (ie, expensive) memory resource, either TCAM or static RAM, and not with exhaust of dynamic RAM (the 384GB). XE/XR/NXOS switches & routers usually do have commands to show TCAM resource consumption, but I do not know an equivalent command for the 4100.

Re: Qos. Policy-map qauntity limits

Fireman — Wed, 11 Dec 2024 13:07:18 GMT

Guys! What about FMC, when I will deploy from there can I fix this issue?

Why will happen with Qos policy limitations? thanks for any response!