Multilayer Switch Operation
Catalyst switches, such as the 3550 (with the appropriate Cisco IOS Software image), 4500, and 6500, can also forward frames based on Layer 3 and 4 information contained in packets. This is known as multilayer switching (MLS). Naturally, Layer 2 switching is performed at the same time, because even the higher layer encapsulations are still contained in Ethernet frames.
Types of Multilayer Switching
Catalyst switches have supported two basic generations or types of MLS—route caching (first generation MLS) and topology-based (second generation MLS). This section presents an overview of both, although only the second generation is supported in the Cisco IOS Software-based Catalyst 3550, 4500, and 6500 switch families. You should understand the two types, as well as the differences between them:
-
Route caching—The first generation of MLS, requiring a route processor (RP) and a switch engine (SE). The RP must process a traffic flow's first packet to determine the destination. The SE listens to the first packet and to the resulting destination, and sets up a "shortcut" entry in its MLS cache. The SE forwards subsequent packets in the same traffic flow based on shortcut entries in its cache.
Topology-based—The second generation of MLS, utilizing specialized hardware. Layer 3 routing information builds and prepopulates a single database of the entire network topology. This database, an efficient table lookup in hardware, is consulted so that packets can be forwarded at high rates. The longest match found in the database is used as the correct Layer 3 destination. As the routing topology changes over time, the database contained in the hardware can be updated dynamically with no performance penalty.
This type of MLS is also known by the names Netflow LAN switching, flow-based or demand-based switching, and "route once, switch many." Even if this isn't used to forward packets in IOS-based Catalyst switches, the technique still generates traffic flow information and statistics.
This type of MLS is known as Cisco Express Forwarding (CEF), where a routing process running on the switch downloads the current routing table database into the Forwarding Information Base (FIB) area of hardware. CEF is discussed in greater detail in Chapter 13, "Multilayer Switching."
Follow That Packet!
The path that a Layer 3 packet follows through a multilayer switch is similar to that of a Layer 2 switch. Obviously, some means of making a Layer 3 forwarding decision must be added. Beyond that, several sometimes-unexpected things can happen to packets as they are forwarded.
Figure 3-4 shows a typical multilayer switch and the decision processes that must occur. Packets arriving on a switch port are placed in the appropriate ingress queue, just as in a Layer 2 switch.
Each packet is pulled off an ingress queue and inspected for both Layer 2 and Layer 3 destination addresses. Now, the decision where to forward the packet is based on two address tables, whereas the decision how to forward the packet is still based on access list results. Like Layer 2 switching, all these multilayer decisions are performed simultaneously in hardware:
L2 Forwarding Table—The destination MAC address is used as an index to the CAM table. If the frame contains a Layer 3 packet to be forwarded, the destination MAC address is that of a Layer 3 port on the switch. In this case, the CAM table results are used only to decide that the frame should be processed at Layer 3.
L3 Forwarding Table—The FIB table is consulted, using the destination IP address as an index. The longest match in the table is found (both address and mask), and the resulting next-hop Layer 3 address is obtained. The FIB also contains each next-hop entry's Layer 2 MAC address and the egress switch port (and VLAN ID), so that further table lookups are not necessary.
Security ACLs—Inbound and outbound access lists are compiled into TCAM entries so that decisions whether to forward a packet can be determined as a single table lookup.
QoS ACLs—Packet classification, policing, and marking can all be performed as single table lookups in the QoS TCAM.
)
Figure
3-4 Operations Within a MultiLayer Catalyst Switch
As with Layer 2 switching, the packet must be finally placed in the appropriate egress queue on the appropriate egress switch port.
However, recall that during the multilayer switching process, the next-hop destination was obtained from the FIB table—just as a router would do. The Layer 3 address identified the next hop and found its Layer 2 address. Only the Layer 2 address would be used so that the Layer 2 frames could be sent on.
The next-hop Layer 2 address must be put into the frame in place of the original destination address (the multilayer switch). The frame's Layer 2 source address must also become that of the multilayer switch before it is sent on to the next hop. As any good router must do, the Time-To-Live (TTL) value in the Layer 3 packet must be decremented by one.
Because the contents of the Layer 3 packet (the TTL value) have changed, the Layer 3 header checksum must be recalculated. And because both Layer 2 and 3 contents have changed, the Layer 2 checksum must be recalculated. In other words, the entire Ethernet frame must be rewritten before it goes into the egress queue. This is also accomplished efficiently in hardware.
Multilayer Switching Exceptions
To forward packets using the simultaneous decision processes described in the preceding section, the packet must be "MLS-ready" and require no additional decisions. For example, CEF can directly forward most IP packets between hosts. This occurs when the source and destination addresses (both MAC and IP) are already known, and no other IP parameters must be manipulated.
Other packets cannot be directly forwarded by CEF and must be handled in more detail. This is done by a quick inspection during the forwarding decisions. If a packet meets criteria such as the following, it is flagged for further processing and sent to the switch CPU for process switching:
ARP requests and replies
IP packets requiring a response from a router (TTL has expired, MTU is exceeded, fragmentation is needed, and so on)
IP broadcasts that will be relayed as unicast (DHCP requests, IP helper-address functions)
Routing protocol updates
Cisco Discovery Protocol packets
IPX routing protocol and service advertisements
Packets needing encryption
Packets triggering Network Address Translation (NAT)
Other non-IP and non-IPX protocol packets (AppleTalk, DECnet, and so on)
NOTE
On the Catalyst 6500, both IP and IPX packets are CEF switched in hardware. All other protocols are handled by process switching on the MSFC module (the routing CPU). On the Catalyst 4500, only IP packets are CEF switched. All other routable protocols, including IPX, are flagged for process switching by the switch CPU.
With the Catalyst 3550, only IP is CEF switched in hardware. Other non-IP protocols are not routed at all. Instead, they are flagged for fallback bridging, where they are treated as transparently bridged (Layer 2 switched) packets. An external router or multilayer switch must handle any routing that is still needed during fallback bridging.