12-06-2024 10:04 PM
Good day for everyone!
We have a lot policy-maps for shaping traffic on our FTD and oneday we have received that no more than 128 policy maps could be defined:
[error]: ERROR: % No more that 128 policymaps can be defined
Unfortunately I didn't find any useful info about this in internet, maybe someone could tell me in here?:)
How much policymaps could be deployed on 1000/1200/3100/4200/9300 series?
What does the quantity of policymap depends on: software version, RAM, etc. ?
12-06-2024 11:16 PM
What is the version of the code running? I only have a few policies tested. As per, I agree with you, but I am not aware of that limitation. Is this an error you are getting while creating new FDM or FMC policies?
12-06-2024 11:59 PM
12-07-2024 05:29 AM
Again, I need to ask what the code is running here.
This may be a sub-interface issue. Do you have more than 128 sub-interfaces?
12-09-2024 06:01 AM
The software versions is 7.2.7, Yep! Now its about 150 sub interfaces, the policy-maps less than 120, the platform is 4145 and its single instance.
12-09-2024 07:22 AM
On platforms that compile policy-maps into TCAM entries, there will be pre-defined limits on how many different policy-maps can be applied to interfaces. This limit comes from the static "carving" of TCAM resources into different regions for different usages: FIB, ACL, QoS, etc. The different regions are not dynamically fungible in that, for example, unused FIB entries cannot be used for QoS purposes. Some systems support re-carving the TCAM to optimize for different use-cases by allowing particular resource "profiles" to be configured, but this usually requires a reboot to take effect.
Platforms that forward in software (ie, CPU-based forwarding) typically do not use TCAMs for FIB/ACL/QoS/etc lookups and so the number of class-maps & policy-maps need only be limited by RAM size. Platforms with ASIC/NPU forwarding often use TCAMs and have these hardware limits. It should be noted that even in ASIC/NPU platforms, usually class-maps and policy-maps occupy only RAM until they are actually applied to an interface with a service-policy command, and so the number of such maps should be limited only by RAM until then. It is at the time of interface application of the service policies that, typically, the QoS config is compiled into actual TCAM entries.
12-10-2024 04:09 AM
Hi! Thanks for your detailed answer.
As I understand you correctly for my 4145 I probably have limitation by RAM, but platform has 384-GB [omg]. Maybe you know how to check limitations before I receive an error? Do I need to check memory status before implement new service-policy/sub-interface? It would be very helpful, thanks in anyway.
12-10-2024 11:46 AM
Hi Fireman,
I am not really familiar with the 4100 series of firewalls, but given the throughput of the 4145 (up to 80Gbps) listed in its datasheet, it almost certainly forwards in hardware. My assumption is that the issue is with consumption of some specialized (ie, expensive) memory resource, either TCAM or static RAM, and not with exhaust of dynamic RAM (the 384GB). XE/XR/NXOS switches & routers usually do have commands to show TCAM resource consumption, but I do not know an equivalent command for the 4100.
12-11-2024 05:07 AM
Guys! What about FMC, when I will deploy from there can I fix this issue?
Why will happen with Qos policy limitations? thanks for any response!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide