Limit TCAM ACL ICX 7850

[fabios]

I am getting the following error 'Error:ACL filter add failed! (Insufficient Space in TCAM to accomodate this ACL. ' Would it be possible to increase this ACL filter TCAM space?

[kayal]

Hi Fabios,

Thank you for bringing this up.

You're seeing the error:
“Error: ACL filter add failed! (Insufficient Space in TCAM to accommodate this ACL)”,
which typically indicates that the switch’s TCAM used to store ACLs and other hardware-accelerated features — has reached its current configured or physical limit.

1. Check and Adjust TCAM Allocation (if applicable)

Some ICX models allow reallocation of TCAM resources using the system-max command.

To check the current and maximum values:

#show default values

If the current value of ip-filter-sys is below the max, you can increase it:

#configure terminal
#system-max ip-filter-sys <new_value>

Note: This change requires a switch reboot to take effect.

Refer to the following documentation for detailed guidance:

TCAM Space Configuration:

• https://docs.commscope.com/bundle/fastiron-08095-l3guide/page/GUID-1BC06D4F-300D-40FD-B8D3-410990CB8...

Allocating TCAM Space:

• https://docs.commscope.com/bundle/fastiron-08095-l3guide/page/GUID-ACC052DC-B1B7-4CCC-858C-F7AE13248...

Hardware Scale for each unit:

• https://docs.commscope.com/bundle/fastiron-08095-securityguide/page/GUID-1E453227-4D71-49A2-9D95-460...

1. Optimize Existing ACL Usage

If increasing ip-filter-sys isn’t an option, or if you've already reached the platform's hardware limit, try:

• Consolidating or removing unused ACL entries.
• Preferring VLAN-based ACLs over interface-based ones.
• Avoiding duplication of ACLs across many interfaces.

Let us know your switch model and ACL use case if you'd like more specific suggestions.

Note: Please feel free to mark the post as ACCEPTED SOLUTIONS if its addressed your query.

Regards,

Kayalvizhi Kannadasan

[fabios]

Thanks for the feedback. I intend to increase the maximum capacity of L2 Ingress TCAM rules per PP device, is it possible?

[kayal]

Hi Fabios,

Good question!

On ICX switches, you can’t manually increase TCAM rules PP device. TCAM allocation is done globally using the system-max command, and the switch internally manages how it's distributed across all PPs.

If your switch model supports it, you can increase the global limit but only up to the maximum allowed by hardware. This requires a reboot to take effect.

Regards,

Kayal