network: test ACLs on GRE tunnels

[ben-malbeclabs]

This is to track ACL support on GRE tunnels.

Arista recommended the following TOI:
https://www.arista.com/en/support/toi/eos-4-21-3f/14156-gre-tunnel-interface-acl

However, after testing on the following platforms, the profile hasn't been added. Opened email thread with Max at Arista.

DCS-7130LBR-48S6QD-R - 4.31.2F
DCS-7280CR3A-32S-R - 4.32.3M
DCS-7280CR3-32D4-R - 4.32.2F
DCS-7280SR2-48YC6-R - 4.32.2F

[armcconnell]

This works. Next step is to determine what TCAM slices were robbed from to make ACLs work.

TOI was missing a step about how to apply the new TCAM profile to the system.

[ben-malbeclabs]

Still investigating the impact of this on available TCAM. The profile updated to include ACLs on tunnels without any modification to any other feature. I am guessing that the profile update just enables the feature and that the total TCAM is now just available to share across more features.

I am trying to find out the best counters to track what is available and what is used, so far we have:

Generic summary:
chi-dn-dzd7#sho platform jericho2 tcam summary
Tcam Allocation (Fap0)
Bank Used By Reserved By

---

  0         dbIpTunnelIntfAcl              -
 12                  dbSystem              -
 12                 dbSystem6              -
 12              dbMplsSystem              -
 13               dbEgressOlp              -
 15               dbMacSystem              -
 15       dbTunnelTermination              -

By feature:
chi-dn-dzd7#sho platform jericho2 acl tcam sum
The total number of TCAM lines per Jericho2c bank is 2048

======================================================================
Fap0:

Bank Used Used % Used By
0 8 0 IP tunnel interface ACLs

[ben-malbeclabs]

I couldn't find any specific command or counter to check TCAM usage, I sent the following to Arista:

One follow-up question related to this. Looking at the difference between the default and the newly created tunnel-interface-acl profiles, from what I can tell the only difference is the addition of the acl tunnel feature. How can we think about TCAM availability/capacity overall? Specifically, by enabling this feature, did we lose anything other than reducing the amount of capacity for the other enabled features?

What might be the best way for us to monitor the available TCAM capacity we have on the 7130LBR/7280CR3A? Are there show commands or other metrics we can tap into?

Their response from Mitch:

Working with TCAM profiles can be a bit of a challenge. I typically start by searching for the TOI related to the feature Community Central to determine if it requires a TCAM profile modification on the platform I want to use it on.

Next, I'll refer to the repository of custom user-defined TCAM profiles and see if one is already available for the feature and platform that fits the use case.

If I need to create a custom TCAM profile, I'll leverage the User-Defined TCAM Profile TOI to understand which profile attributes fit my use case.

No method is available to check how much room is left to add features to a TCAM profile. It can be a bit of trial and error, and I'll typically grab a lab device to develop, apply, and test a TCAM profile before attempting to deploy it on a production node.