Cisco Nexus 9000 TCAM Carving and ACL Regions

On Cisco Nexus 9000 switches, ACL and QoS features are not limited by configuration lines but by fixed slices of ternary content-addressable memory. When a region runs out you get %ACLQOS-SLOTx out-of-resource messages, ACLs that refuse to install, or VACLs that silently stop matching. This article explains the region model, shows how to read current allocation with show hardware access-list tcam region, and covers the carving workflow - including the two facts engineers forget: carving changes need a reboot, and a region can never grow beyond the slices available.

How the TCAM is divided

The egress TCAM is 1K entries split into four 256-entry slices. The ingress TCAM is 4K entries split into eight 256-entry slices and four 512-entry slices. Each feature that needs hardware matching - port ACLs, VLAN ACLs, router ACLs, port QoS, VLAN QoS, L3 QoS, SPAN, CoPP, and the ingress system region - owns its own named region such as ifacl, vacl, racl, qos, vqos, l3qos, span and copp. Regions are sized in multiples of 256 entries, and a region configured to 0 entries means the feature is unavailable on that ASIC.

Symptoms of an exhausted region

• %ACLQOS-SLOT1-2-ACLQOS_OOTR: TCAM region is full style syslog messages naming the region.
• An ACL, VACL or CoPP policy that commits with an error instead of applying.
• A security policy that appears in show running-config but does not filter traffic.
• CoPP that stops policing control-plane traffic, so a CPU spike becomes an outage.

A common trap: a region that is 80% used may already block ACL edits on some platforms because the update needs headroom for the new entry before the old one is removed.

Reading the current allocation

switch# show hardware access-list tcam region
switch# show hardware access-list tcam usage
switch# show running-config | include tcam
switch# show module

The output lists each region with its configured size (in entries) and, on the usage variant, how many are consumed. For CoPP specifically, use show policy-map interface control-plane to see per-class match counts and confirm traffic is actually hitting the policy.

Carving a region

Carving is done from global configuration with the region name and the desired size, then the configuration must be saved and the switch reloaded:

switch(config)# hardware access-list tcam region racl 1024
switch(config)# hardware access-list tcam region ifacl 512
switch(config)# hardware access-list tcam region copp 256
switch# copy running-config startup-config
switch# reload

Notes that matter in production:

• Every carving change requires a reload - there is no hitless path.
• Total slices are finite. Freeing one region (setting it to 0) is often the only way to grow another.
• Carving resets the affected regions, so ACLs and policies must reinstall after boot - verify with the show commands above.
• Some platforms offer predefined templates rather than per-region carving; check whether your model accepts raw region configuration first.

Planning before you change

Do the arithmetic on paper: list every feature you rely on, find its current consumption from show hardware access-list tcam usage, and add margin. If the sum exceeds the ingress or egress total, the design - not the carving - is wrong: move policy to a different layer (routing instead of ACLs), use shared object groups to collapse entries, or split the policy across line cards so usage is per-ASIC rather than chassis-wide.

Related: Nexus 9000 troubleshooting tools cheat sheet, Nexus NX-OS VLAN and trunk configuration, and vPC orphan port and peer-gateway guide.

原文链接：https://www.cisco.com/c/en/us/support/docs/switches/nexus-9000-series-switches/119032-nexus9k-tcam-00.html