I am in middle of deploying Spine-Leaf design using Cisco 9396PX switches for my leaf and when i am trying to configure arp-suppression for VNI i found this error.
Default vacl tcam size is 512 so i am freeing up all of that for arp-ether
hardware access-list tcam region vacl 0
Giving slice to arp-ether but its throwing error
hardware access-list tcam region arp-ether 256 double-wide ERROR: Aggregate TCAM region configuration exceeded the available Ingress TCAM slices. Please re-configure.
If i don't use "double-wide" then getting no error at all, why? and what is the best approche double-wide or no?
# hardware access-list tcam region arp-ether 256 Warning: Please save config and reload the system for the configuration to take effect
Hi operations123 ,
I hope this will be useful,
Thank you for reply,
I am new in EVPN+VxLAN design and we have very small datacenter only 6 VTEP and using Multicast with PIM, I have no idea what is IGMP Snooping.
Question on IGMP:
1. where do i use IGMP snooping? (we don't have any VMware or vMotion etc in our datacenter if it required IGMP)
2. If i am not using IGMP then can i like with arp-ether without double-wide ?
3. All i need arp-suppression to reduce my ARP flood for anycast gateway vni.
What do you suggest?
IGMP snooping over VXLAN is not supported on VLANs with FEX member ports.
IGMP snooping over VXLAN is supported with both IR and multicast underlay.
IGMP snooping over VXLAN is supported in BGP EVPN topologies, not flood and learn topologies.
Of Course you can. For the ACI leaf line card on Cisco Nexus 9300 Series switches, only the IPv6 TCAM regions consume double-wide entries. The rest of the TCAM regions consume single-wide entries.
It's enough to use this :
# hardware access-list tcam region arp-ether 256
I hope you find it helpful,
Thank you for detailed reply,
long story short, I am not using any IGMP snooping , IPv6 etc that means i don't need double-wide tcam for arp-ether. right?
I have following 3 counter question while we talking about arp-suppression.
1. I am trying to reduce one more 512 slice of tcam from RACL and i got following warning, I am not running any ACL or anything but its saying 1 entry is in tcam not sure what is that and how to verify if any one using any IPv4 ACL in tcam. Just wanted to make sure before i ignore this error
leaf-1-1(config)# hardware access-list tcam region racl 0 WARNING: On module 1, 1 entries are in use in the region IPV4 RACL [racl] on instance 0, but carving size is 0 [0*1]. Warning: Please save config and reload the system for the configuration to take effect
2. I have my leaf switches in Cisco vPC pair and when i am going to add or remove arp-suppression to one of my VNI and i am seeing it freezed traffic for 40sec and none of my host can ping in that VLAN (look like it bringing down whole NVE or vPC). This is what i am going, as soon as i added suppress-arp
leaf-1-1(config)# interface nve1 leaf-1-1(config-if-nve)# member vni 10100 leaf-1-1(config-if-nve-vni)# suppress-arp
My ping to host stopped and i am seeing following result on vPC (Per-vlan consistency status : failed)
leaf-1-1# show vpc Legend: (*) - local vPC is down, forwarding via vPC peer-link vPC domain id : 2 Peer status : peer adjacency formed ok vPC keep-alive status : peer is alive Configuration consistency status : success Per-vlan consistency status : failed
After 40 to 60s after my pings come back.. This is happening when i add suppress-arp or i remove in both condition my host stop pinging for some time until Per-vlan consistency status change to success. is this normal behavior ?
3. I have some VNI which doesn't have anycast-gatway SVI in that case if i enable suppress-arp does that work or not ? (These VNI default gateway is my Cisco ASA firewall)
The IPv6, QoS, MAC, CoPP, and system TCAM regions are double wide and consume double the physical TCAM entries. For example, a logical region size of 256 entries actually consumes 512 physical TCAM entries.
Leaf Node Configuration – L2 & L3 VNI for IPv6
I hope it will be helpful.