topic Re: Limit TCAM ACL ICX 7850 in ICX Switches

Limit TCAM ACL ICX 7850

fabios — Fri, 13 Jun 2025 20:48:38 GMT

I am getting the following error 'Error:ACL filter add failed! (Insufficient Space in TCAM to accomodate this ACL. ' Would it be possible to increase this ACL filter TCAM space?

Re: Limit TCAM ACL ICX 7850

kayal — Wed, 18 Jun 2025 03:18:33 GMT

Hi Fabios,

Thank you for bringing this up.

You're seeing the error:
“Error: ACL filter add failed! (Insufficient Space in TCAM to accommodate this ACL)”,
which typically indicates that the switch’s TCAM used to store ACLs and other hardware-accelerated features — has reached its current configured or physical limit.

Check and Adjust TCAM Allocation (if applicable)

Some ICX models allow reallocation of TCAM resources using the system-max command.

To check the current and maximum values:

#show default values

If the current value of ip-filter-sys is below the max, you can increase it:

#configure terminal
#system-max ip-filter-sys <new_value>

Note: This change requires a switch reboot to take effect.

Refer to the following documentation for detailed guidance:

TCAM Space Configuration:

https://docs.commscope.com/bundle/fastiron-08095-l3guide/page/GUID-1BC06D4F-300D-40FD-B8D3-410990CB829D.html

Allocating TCAM Space:

https://docs.commscope.com/bundle/fastiron-08095-l3guide/page/GUID-ACC052DC-B1B7-4CCC-858C-F7AE13248119.html

Hardware Scale for each unit:

https://docs.commscope.com/bundle/fastiron-08095-securityguide/page/GUID-1E453227-4D71-49A2-9D95-46089A32FB56.html

Optimize Existing ACL Usage

If increasing ip-filter-sys isn’t an option, or if you've already reached the platform's hardware limit, try:

Consolidating or removing unused ACL entries.
Preferring VLAN-based ACLs over interface-based ones.
Avoiding duplication of ACLs across many interfaces.

Let us know your switch model and ACL use case if you'd like more specific suggestions.

Note: Please feel free to mark the post as ACCEPTED SOLUTIONS if its addressed your query.

Regards,

Kayalvizhi Kannadasan

Re: Limit TCAM ACL ICX 7850

fabios — Wed, 18 Jun 2025 12:43:18 GMT

Thanks for the feedback. I intend to increase the maximum capacity of L2 Ingress TCAM rules per PP device, is it possible?

Re: Limit TCAM ACL ICX 7850

kayal — Tue, 24 Jun 2025 00:57:12 GMT

Hi Fabios,

Good question!

On ICX switches, you can’t manually increase TCAM rules PP device. TCAM allocation is done globally using the system-max command, and the switch internally manages how it's distributed across all PPs.

If your switch model supports it, you can increase the global limit but only up to the maximum allowed by hardware. This requires a reboot to take effect.

Regards,

Kayal