In the previous article, we discussed the ACLs on NCS5500 BVI interfaces. We covered the ACL implementation and support for IPv4 and IPv6 ACLs in both ingress and egress directions. We also discussed the enhancements w.r.t IPv6 Egress ACLs. In this article we discuss the overall implementation of IPv6 Egress ACLs across NCS5500 product family based on J/J+ and see how it differs with the platforms based on J2.
Let us start with the understanding the PMF block. It is one of the blocks in the ingress and egress pipeline aka Programmable Mapping and Filtering. It is the most programmable and the last programmable block in the pipeline. It has all the history of the packet from other blocks (incoming port, lookup results, etc). We can override here every decision taken along the pipeline. Here we do ACL, QoS, LPTS classification and set actions (counters, policers, Traffic Class). Egress PMF is capable of doing internal TCAM lookup for egress ACLs
In order to support the match criteria that is needed for egress IPv6 ACL, resources in the Ingress PMF block will be used. Therefore, this requires us to recycle the IPv6 packets so that the ACL can be performed by the Ingress PMF. Sometimes it might happen that certain features will not be processed in a single pass. They will require a second pass in the pipeline for further processing. The recycle interface offers the capability to “re-inject” the packet from the end of the egress pipeline into the ingress pipeline for a “second pass” and may be for a third or fourth if needed. There are 2 types of recycling cases. One is ingress recycle and second is egress recycle. Egress IPv6 ACL is the case of egress recycling.
Understanding the Two Pass Approach
Egress IPv6 ACL requires two passes of each IPv6 packet that is subject to ACL. The recycling of the IPv6 packets are controlled by entries in the Egress PMF. Each packet will go through the following stages:
- 1st pass ingress
- 1st pass egress (recycle packet)
- 2nd pass ingress
- 2nd pass egress
1st Pass Ingress
During the first pass the normal ingress processing will be performed. This includes ingress PMF, QoS, and any other configured features. The forwarding decision, is determined based on the Destination System Port (DSP). Each DSP in the system has a corresponding set of VoQs. Since a FEC (Forwarding Equivalence Class) is pointing to the DSP, packets are sent to destination port on the destination NPU. The header contains DSP as system port. The packets will be put in the DSP’s VoQ and will be scheduled by the DSP’s End-to-End (E2E) scheduler
1st Pass Egress
When an IPv6 ACL is attached to an egress interface, a set of egress PMF entries will created to redirect the IPv6 packet out the recycle port. Based the recycle port configuration, a new program will be selected which will take care of internal processing. At high level it will ensure a fixed packet offset after recycling. It will also build a dummy Ethernet header with Ethertype=IPv6 to prepare for 2nd pass ingress parsing
2nd Pass Ingress
After the IPv6 packet has been recycled, it will be received on the same NPU/Core as the egress DSP. A field group in PMF will retrieve DSP, Traffic class and drop precedence from the recycled packet’s system header. DSP is retrieved so that the recycled packet will go out the same Egress port. We don’t want to go through forwarding again and possibly choose a different egress port. The Traffic Class might have been set by QoS in the 1st pass Ingress processing. We want to preserve this TC. The Drop Precedence might have been set by QoS in the 1st pass ingress processing. We want to preserve this Drop Precedence. Ingress PMF will now perform the ACL. If matches on a Deny ACE, the normal processing will occur and the packet will be dropped or forwarded to the Control Plane for ICMPv6 handling. If matches on a Permit ACE, the configured action will occur plus the additional actions to strip the recycled system header. Forwarding will use the retrieved DSP from the recycled system header. The packets will be put in the DSP’s VoQ and will be scheduled by the DSP’s end to end scheduler a second time.
2nd Pass Egress
The original system headers will be used for normal egress processing
Egress IPv6 ACL has 2 databases:
Because the packets are recycled, the EGRESS_ACL_IPV6 database has entries that will facilitate the recycling mechanism. The actual match entries are added at RCY_ACL_L3_IPV6. Let us verify the same on the routers. We will use 2 different Line cards as below
RP/0/RP0/CPU0:5508-2-74142I-C#show platform Node Type State Config state -------------------------------------------------------------------------------- 0/3/CPU0 NC57-18DD-SE IOS XR RUN NSHUT 0/3/NPU0 Slice UP 0/3/NPU1 Slice UP 0/4/CPU0 NC55-36X100G-A-SE IOS XR RUN NSHUT 0/4/NPU0 Slice UP 0/4/NPU1 Slice UP 0/4/NPU2 Slice UP 0/4/NPU3 Slice UP
Note: Output is truncated
We will consider 3 Line cards.
|Line Card||No of NPU’s|
Below ACL is applied on the interface in the egress direction in slot 4.
ipv6 access-list ipv6_1 10 permit tcp 2001:1:2::/64 any eq 1024 20 permit tcp 2002:1:2::/64 any eq 1024 30 permit tcp 2003:1:2::/64 any eq 1024 40 permit tcp 2004:1:2::/64 any eq 1024 50 deny udp 2001:4:5::/64 any lt 1000 60 permit ipv6 any any
RP/0/RP0/CPU0:5508-2-741Cs#show running-config interface hundredGigE 0/4/0/2 Wed Sep 29 22:51:52.131 PDT interface HundredGigE0/4/0/2 description Local H0/4/0/2 to H0/4/0/10 ipv6 access-group ipv6_1 egress
As pointed out earlier, we can see 2 databases are created.
RP/0/RP0/CPU0:5508-2-741Cs#show controllers npu internaltcam location 0/4/CPU0 Internal TCAM Resource Information ============================================================= NPU Bank Entry Owner Free Per-DB DB DB Id Size Entries Entry ID Name ============================================================= 0 0 160b egress_acl 2026 5 31 EGRESS_ACL_IPV6 0 6\7 320b pmf-0 2034 14 93 RCY_ACL_L3_IPV6 RP/0/RP0/CPU0:5508-2-741Cs#
Note: Output is truncated
Let us understand the entries in details:
For database EGRESS_ACL_IPV6 we have:
- 1 static entry per NPU per core for the recycle-channel
- 3 entries for setting up the different kinds of TPIDs supported (IPv6 (0x86dd), VLAN (0x8100), or MPLS (0x8847))
- We can see 5 entries in the database. (default internal entry + the ones explained above)
For database RCY_ACL_L3_IPV6 we have:
- The match entries computed from the ACL.
- We can see 14 entries (default entries plus ACEs configured)
Let us increase the number of ACEs and see how the database entries are changed
ipv6 access-list ipv6_1 10 permit tcp 2001:1:2::/64 any eq 1024 20 permit tcp 2002:1:2::/64 any eq 1024 30 permit tcp 2003:1:2::/64 any eq 1024 40 permit tcp 2004:1:2::/64 any eq 1024 50 deny udp 2001:4:5::/64 any lt 1000 60 permit tcp 2005:1:2::/64 any eq 1024 70 permit tcp 2006:1:2::/64 any eq 1024 80 permit tcp 2007:1:2::/64 any eq 1024 90 permit tcp 2008:1:2::/64 any eq 1024 100 permit ipv6 any any
RP/0/RP0/CPU0:5508-2-741Cs#show controllers npu internaltcam location 0/4/CPU0 Wed Sep 29 23:12:18.921 PDT Internal TCAM Resource Information ============================================================= NPU Bank Entry Owner Free Per-DB DB DB Id Size Entries Entry ID Name ============================================================= 0 0 160b egress_acl 2026 5 31 EGRESS_ACL_IPV6 0 6\7 320b pmf-0 2030 18 93 RCY_ACL_L3_IPV6 RP/0/RP0/CPU0:5508-2-741Cs#
We can see for database EGRESS_ACL_IPV6 the entries are not increasing. The entries are only increasing for the database RCY_ACL_L3_IPV6. This is because actual match entries are added only at RCY_ACL_L3_IPV6. This is very important to understand during debugging or verifying the outputs. Other thing to remember is, if the same ACL is applied to multiple egress interfaces, match entries and different kinds of TPIDs will increase as per number of interfaces. While the entries for the recycle channel will only increase when the interfaces are in different NPUs.
NCS5500 based on J2 ASICs do not face the issue of packet recycling when it comes to IPv6 Egress ACLs. They can be processed in single pass like IPv4 Egress ACLs. This is possible because of the presence of more resources in the Egress PMF. Let us verify the same on the Line card based on J2.
interface FourHundredGigE0/3/0/21 description 5508-2 FH0/3/0/21 to 5508-1 FH0/7/0/21 cdp ipv6 access-group ipv6_1 egress
RP/0/RP0/CPU0:5508-2-741Cs#show controllers npu internaltcam location 0/3/CPU0 Wed Sep 29 23:42:35.179 PDT Internal TCAM Resource Information ============================================================= NPU Bank Entry Owner Free Per-DB DB DB Id Size Entries Entry ID Name ============================================================= 1 6\7 320b EPMF 2013 26 44 EGRESS_ACL_IPV6 RP/0/RP0/CPU0:5508-2-741Cs#
RP/0/RP0/CPU0:5508-2-741Cs#show controllers npu internaltcam location 0/3/CPU0 | in RCY_ACL_L3_IPV6 RP/0/RP0/CPU0:5508-2-741Cs#
From the above outputs, its clearly seen that we no more create a database for recycle port RCY_ACL_L3_IPV6. We can also see that owner of the database is EPMF which is Egress PMF. The Egress PMF is having enough resources to take care of the ACL processing.
Hope this article was helpful in understanding the IPv6 Egress ACL implementation on NCS5500 and the enhancement on the newer generation platforms. In the next article we will understand the various modes of ACLs and see how to use specific profile to increase the ACL scale. Stay tuned !!!