{"id":960,"date":"2011-09-07T22:42:00","date_gmt":"2011-09-07T14:42:00","guid":{"rendered":"http:\/\/note.systw.net\/note\/?p=960"},"modified":"2023-11-07T22:46:17","modified_gmt":"2023-11-07T14:46:17","slug":"cisco-cef","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/960","title":{"rendered":"Cisco CEF"},"content":{"rendered":"\n

CEF(Cisco Express Forwarding)<\/strong>
offering high performance packet forwarding through the use of dynamic lookup tables
CEF runs by default, taking advantage of the specialized hardware.
ps:
The following platforms all perform CEF in hardware:
Catalyst 6500 Supervisor 720 (with an integrated MSFC3)
Catalyst 6500 Supervisor 2\/MSFC2 combination
Catalyst 4500 Supervisor III, IV, V, and 6-E
Fixed-configuration switches, ex:Catalyst 3750, 3560, 3550, and 295
ps:
Traditional MLS<\/strong>(NetFlow switching \/route cache switching)
the SE(switch enginer) must know the identity of each RP(router process).
The SE then can listen in to the first packet going to the router and also going away from the router.
If the SE can switch the packet in both directions,
it can learn a “shortcut path” so that subsequent packets of the same flow can be switched directly to the destination port without passing through the RP.
ps:
Traditionally, NetFlow switching was performed on Cisco hardware
Basically,the hardware consisted of an independent RP component and a NetFlow-capable SE component.<\/p>\n\n\n\n

ps:
CEF also can be optimized through the use of specialized forwarding hardware
aCEF(Accelerated CEF)<\/strong>
CEF is distributed across multiple Layer 3 forwarding engines, typically located on Catalyst 6500 line cards.
These engines do not have the capability to store and use the entire FIB, so only a portion of the FIB is downloaded to them at any time
This functions as an FIB “cache,” containing entries that are likely to be used again
dCEF(Distributed CEF)<\/strong>
CEF can be distributed completely among multiple Layer 3 forwarding engines for even greater performance. 
Because the FIB is self-contained for complete Layer 3 forwarding, it can be replicated across any number of independent Layer 3 forwarding engines<\/p>\n\n\n\n

disable CEF
on the Catalyst 3750
(config-if)# no ip route-cache cef<\/strong>
on the Catalyst 4500
(config-if)#no ip cef<\/strong>
ps:
CEF is enabled on all CEF-capable Catalyst switches by default<\/p>\n\n\n\n

……………………………………<\/p>\n\n\n\n

A CEF-based multilayer switch consists of two basic functional blocks
Layer 3 engine<\/strong>:is involved in building routing information
Layer 3 forwarding engine<\/strong>:can use to switch packets in hardware by Layer 3 engine information
ps:
CEF operation depends on the correct routing information being generated and downloaded to the Layer 3 forwarding engine hardware . This information is contained in the FIB and is maintained dynamically.<\/p>\n\n\n\n

The Layer 3 engine<\/strong> (essentially a router)
1. maintains routing information(from static routes or dynamic routing protocols)
2. the routing table is reformatted into FIB<\/strong><\/p>\n\n\n\n

Layer 3 Forwarding Engine<\/strong>
1. After the FIB is built , packets can be forwarded along the “Layer3 Forwarding Engine”
2. This follows the hardware switching process, in which no expensive or time-consuming<\/strong> operations are needed
3. \u5c01\u5305\u9032\u5165layer3 forwarding engine\u4f5c\u696d
ingress packet-> ( FIB -> Adjacency Table -> rewrite engine)->egress packet<\/p>\n\n\n\n


…………………………………………………………………………………………………………
…………………………………………………………………………………………………………<\/p>\n\n\n\n

FIB(Forwarding Information Base):<\/strong>
1. an ordered list with the most specific route first, for each IP destination subnet in the table
2. contains routing or forwarding information that the network prefix can reference
ex:
a route to 10.1.0.0\/16 might be contained in the FIB along with routes to 10.1.1.0\/24 and 10.1.1.128\/25, if those exist.
Notice that these examples are increasingly more specific subnets, as designated by the longer subnet masks.
3. When the switch receives a packet, it easily can examine the destination address and find the “longest-match destination” route entry in the FIB.
ps:
FIB\u6b04\u4f4d\u5305\u62ec\u4ee5\u4e0b
\u3000IP Address
\u3000Next-Hop IP Addr
\u3000Next-Hop MAC Addr
\u3000Egress Port<\/p>\n\n\n\n

FIB is dynamic<\/strong>
the FIB must reflect the same change if:
1. a next-hop address is changed
2. aged out of the ARP table
ps:
route\u548cFIB\u7684\u4e92\u52d5
1. Anytime the routing table receives a change to a route prefix or the next-hop address, the FIB receives the same change
2. When the Layer 3 engine sees a change in the routing topology, it sends an update to the FIB<\/p>\n\n\n\n

…<\/p>\n\n\n\n

CEF punt<\/strong>
if a packet cannot be switched in hardware according to the FIB
Packets then:
\u30001 are marked as “CEF punt”
\u30002 immediately are sent to the Layer 3 engine for further processing<\/p>\n\n\n\n

\u6703\u5c0e\u81f4 “CEF punt” \u5c01\u5305\u7684\u60c5\u6cc1\u5982\u4e0b
An entry cannot be located in the FIB.
The FIB table is full.
The IP TTL has expired.
The MTU is exceeded, and the packet must be fragmented.
An ICMP redirect is involved.
The encapsulation type is not supported.
Packets are tunneled, requiring a compression or encryption operation.
An access list with the log option is triggered.
A NAT operation must be performed (except on the Catalyst 6500 Supervisor 720, which can handle NAT in hardware).<\/p>\n\n\n\n


…<\/p>\n\n\n\n

display FIB table
Switch# show ip cef [option][detail]<\/strong>
\u5e38\u7528option\u6709\u4ee5\u4e0b\u5169\u7a2e
[interface | vlan < vlan-id>]<\/strong>
related to a specific interface or VLAN
[ prefix-ip prefix-mask] [longer-prefixes]<\/strong>
by specifying an IP prefix address and mask
only an exact match of the IP prefix and mask will be displayed if it exists in the CEF table<\/p>\n\n\n\n

ps:
Switch# show ip cef \u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
Prefix\u3000\u3000\u3000\u3000\u3000\u3000Next Hop\u3000Interface
0.0.0.0\/32\u3000\u3000\u3000\u3000receive
192.168.199.0\/24\u3000attached\u3000Vlan1
192.168.199.0\/32\u3000receive
192.168.199.1\/32\u3000receive
192.168.199.2\/32\u3000192.168.199.2\u3000Vlan1
192.168.199.255\/32\u3000receive
\u8aaa\u660e\u5982\u4e0b
Next Hop=”receive”:packets will be sent to the Layer 3 engine for further processing.
Next Hop=”attached” :it is connected directly to an SVI or VLAN
Next Hop=same IP address, denoting that an adjacency is available.
0.0.0.0\/32;An FIB entry has been reserved for the default route. No next hop is defined
192.168.199.0\/24:The subnet assigned to the VLAN 1 interface is given its own entry.
192.168.199.0\/32:An FIB entry has been reserved
192.168.199.1\/32:An entry has been reserved
192.168.199.2\/32:This is an entry for a neighboring multilayer switch, found on VLAN 1 interface.
168.199.255\/32:The route processor (Layer 3 engine) handles all directed broadcasts<\/p>\n\n\n\n

ps:
Switch# show ip cef vlan 101 \u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
Prefix\u3000\u3000\u3000\u3000Next Hop\u3000\u3000Interface
10.1.1.0\/24\u3000\u3000attached\u3000\u3000Vlan101
10.1.1.2\/32\u3000\u300010.1.1.2\u3000\u3000Vlan101
10.1.1.3\/32\u3000\u300010.1.1.3\u3000\u3000Vlan101
ps:
Switch# show ip cef vlan 1003 \u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
Prefix Next Hop Interface
0.0.0.0\/0 172.20.52.1 FastEthernet3\/3
0.0.0.0\/32 receive
10.7.0.0\/16 172.20.52.1 FastEthernet3\/3
10.16.18.0\/23 172.20.52.1 FastEthernet3\/3
ps:
Switch# show ip cef vlan 1003 detail\u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
IP Distributed CEF with switching (Table Version 2364), flags=0x0
1383 routes, 0 reresolve, 0 unresolved (0 old, 0 new)
1383 leaves, 201 nodes, 380532 bytes, 2372 inserts, 989 invalidations
0 load sharing elements, 0 bytes, 0 references
universal per-destination load sharing algorithm, id 9B6C9823
3 CEF resets, 0 revisions of existing leaves
refcounts: 54276 leaf, 51712 node
Adjacency Table has 5 adjacencies<\/p>\n\n\n\n


ps:
Switch# show ip cef 10.1.0.0 255.255.0.0 longer-prefixes \u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
Prefix\u3000\u3000\u3000\u3000Next Hop\u3000\u3000Interface
10.1.1.0\/24\u3000\u3000attached\u3000\u3000Vlan101
10.1.1.2\/32\u3000\u300010.1.1.2\u3000\u3000Vlan101
10.1.1.3\/32\u3000\u300010.1.1.3\u3000\u3000Vlan101
10.1.2.0\/24\u3000\u3000attached\u3000\u3000Vlan102
10.1.3.0\/26\u3000\u3000192.168.1.2\u3000\u3000Vlan99
\u3000\u3000\u3000\u3000\u3000\u3000\u3000192.168.1.3\u3000\u3000Vlan99
10.1.3.64\/26\u3000\u3000192.168.1.2\u3000\u3000Vlan99
\u3000\u3000\u3000\u3000\u3000\u3000\u3000192.168.1.3\u3000\u3000Vlan99
10.1.3.128\/26\u3000\u3000192.168.1.4\u3000\u3000Vlan99
\u3000\u3000\u3000\u3000\u3000\u3000\u3000192.168.1.3\u3000\u3000Vlan99<\/p>\n\n\n\n

ps:
Switch# show ip cef 192.168.5.0 detail \u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
192.168.5.0\/24, version 21, cached adjacency to POS7\/2
0 packets, 0 bytes, traffic_index 4
via 10.14.1.1, 0 dependencies, recursive
next hop 10.14.1.1, POS7\/2 via 10.14.1.0\/30
valid cached adjacency
\u8aaa\u660e:
There is a valid CEF entry for the destination network 192.168.5.0
Packets can be CEF-switched to the destination host<\/p>\n\n\n\n

ps:
Switch# show ip cef 10.1.3.0 255.255.255.192 detail \u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
10.1.3.0\/26, version 270, epoch 0, per-destination sharing 0 packets, 0 bytes
via 192.168.1.2, Vlan99, 0 dependencies
\u3000traffic share 1
\u3000next hop 192.168.1.2, Vlan99
\u3000valid adjacency
via 192.168.1.3, Vlan99, 0 dependencies
\u3000traffic share 1
\u3000next hop 192.168.1.3, Vlan99
\u3000valid adjacency
0 packets, 0 bytes switched through the prefix
tmstats: external 0 packets, 0 bytes\u3000internal 0 packets, 0 bytes
\u76f8\u95dc\u8aaa\u660e\u5982\u4e0b
1. version: describes the number of times the CEF entry has been updated since the table was generated
2. epoch:denotes the number of times the CEF table has been flushed and regenerated as a whole
3. The 10.1.3.0\/26 subnet has two next-hop router addresses(192.168.1.2 , 192.168.1.3), so the local switch is using per-destination load sharing between the two routers.<\/p>\n\n\n\n


…………………………………………………………………………………………………………….<\/p>\n\n\n\n

Adjacency table<\/strong>
1. This portion of the FIB<\/strong>
ps:To streamline packet forwarding even more, the FIB has corresponding Layer 2 information for every next-hop entry
2. The adjacency table information is built from the ARP table<\/strong>
the table consisting of the MAC addresses of nodes that can be reached in a single Layer 2 hop
ps:As a next-hop address receives a valid ARP entry, the adjacency table is updated<\/p>\n\n\n\n

…<\/p>\n\n\n\n

CEF glean state<\/strong>
1. the FIB entry is marked as “CEF glean” If an ARP entry does not exist
This means that the Layer 3 forwarding engine can’t forward the packet in hardware because of the missing Layer 2 next-hop address
2. after marked “CEF glean”
The packet is sent to the “Layer 3 engine” so that it can generate an ARP request and receive an ARP reply for glean the next-hop destination’s MAC address.<\/p>\n\n\n\n

ARP throttling\/throttling adjacency<\/strong>
1. During the time that an FIB entry is in the CEF glean state waiting for the ARP resolution,
subsequent packets to that host are immediately dropped<\/strong> so that the “input queues” do not fill and the “Layer 3 engine” does not become too busy worrying about the need for dupliate ARP requests
2. If
an ARP reply is not received in 2 seconds<\/strong>:
the throttling is released so that another ARP request can be triggered.
after an ARP reply is received:<\/strong>
the throttling is released, the FIB entry can be completed, and packets can be forwarded completely in hardware<\/p>\n\n\n\n

\u986f\u793aglean\u72c0\u614b
Switch# show ip cef adjacency glean<\/strong>
\u756b\u9762\u5927\u81f4\u5982\u4e0b
Prefix Next Hop Interface
10.1.1.2\/32 attached Vlan101
127.0.0.0\/8 attached EOBC0\/0
[output omitted]
\u8aaa\u660e:10.1.1.2\u56e0arp\u5df1age out\u800c\u9032\u5165glean state
ps:
Switch# show ip cef 10.1.1.2 255.255.255.255 detail
10.1.1.2\/32, version 688, epoch 0, attached, connected
0 packets, 0 bytes
\u3000via Vlan101, 0 dependencies
\u3000\u3000valid glean adjacency
\u8aaa\u660e:10.1.1.2\u56e0arp\u5df1age out\u800c\u9032\u5165glean state
\u57f7\u884cshow ip arp 10.1.1.2 \u4e0d\u6703\u6709\u8cc7\u6599 ,\u56e010.1.1.2\u7684arp\u5df1age out<\/p>\n\n\n\n


…<\/p>\n\n\n\n

The adjacency table also can contain other types of entries so that packets can be handled efficiently, types as follows<\/p>\n\n\n\n


Null adjacency<\/strong>
it represents a logical interface that silently absorbs packets without actually forwarding them.<\/p>\n\n\n\n


Discard adjacency<\/strong>
when packets must be discarded because of an access list or other policy action.<\/p>\n\n\n\n

…<\/p>\n\n\n\n

Drop adjacency<\/strong>
to switch packets that can’t be forwarded normally
ex:
an encapsulation failure, an unresolved address, an unsupported protocol,no valid route present, no valid adjacency, or a checksum error<\/p>\n\n\n\n

gauge drop adjacency
# show cef drop<\/strong>
ps:\u756b\u9762\u5927\u81f4\u5982\u4e0b
CEF\u3000Drop\u3000Statistics
Slot\u3000Encap_fail\u3000Unresolved\u3000Unsupported\u3000No_route\u3000No_adj\u3000ChkSum_Err
RP 8799327 1 45827 5089667 32 0<\/p>\n\n\n\n

…<\/p>\n\n\n\n

Punt adjacency<\/strong>
when packets must be sent to the Layer 3 engine for further processing
various punt adjacency reasons as follows
\u3000No_adj<\/strong>:-An incomplete adjacency
\u3000No_encap<\/strong>:An incomplete ARP resolution
\u3000Unsupp’ted<\/strong>:Unsupported packet features
\u3000Redirect<\/strong>:ICMP redirect
\u3000Receive<\/strong>:Layer 3 engine interfaces;
\u3000\u3000 includes packets destined for IP addresses that are assigned to interfaces on the:
\u3000\u3000\u3000 Layer 3 engine,
\u3000\u3000\u3000 IP network addresses,
\u3000\u3000\u3000 IP broadcast addresses
\u3000Options<\/strong>:IP options present
\u3000Access<\/strong>:Access list evaluation failure
\u3000Frag<\/strong>:Fragmentation failure<\/p>\n\n\n\n

gauge punt adjacency
# show cef not-cef-switched<\/strong>
gauge the CEF punt activity by looking at the various punt adjacency reasons
ps:
\u756b\u9762\u5927\u81f4\u5982\u4e0b
CEF Packets passed on to next switching layer
Slot No_adj No_encap Unsupp’ted Redirect Receive Options Access Frag
RP 3579706 0 0 0 41258564 0 0 0<\/p>\n\n\n\n

…<\/p>\n\n\n\n

display the adjacency table<\/strong>
Switch# show adjacency [ interface | vlan < vlan-id> ] [summary | detail]
ps
\u4ee5#show adjacency summary\u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
Adjacency Table has 106 adjacencies
Table epoch: 0 (106 entries at this epoch)
Interface Adjacency Count
Vlan99 21
Vlan101 3
Vlan102 1
Vlan103 47
Vlan104 7
Vlan105 27
\u8aaa\u660e:
display the total number of adjacencies known on each physical or VLAN interface
Adjacencies are kept for 1)each next-hop router and 2)each host that is connected directly to the local switch
ps:
\u4ee5Switch# show adjacency vlan 99 detail\u70ba\u4f8b,\u756b\u9762\u5927\u81f4\u5982\u4e0b
Protocol Interface Address
IP Vlan99 192.168.1.2<\/strong>(5) \/\/indicates that there is an adjacency for the next-hop IP(192.168.1.2)
\u30000 packets, 0 bytes
\u3000000A5E45B145<\/strong>000E387D51000800 <\/strong>\/\/The destination MAC(000A5E45B145) is the MAC in the ARP table
\u3000ARP 01:52:50<\/strong>
\u3000Epoch: 0
IP Vlan99 192.168.1.3<\/strong>(5)
\u30001 packets, 104 bytes
\u3000000CF1C909A0<\/strong>000E387D51000800<\/strong>
\u3000ARP 04:02:11
\u3000Epoch: 0
[output omitted]
\u8aaa\u660e:
the format of the long string of hex digits<\/strong>
\u30001. MAC address: the first six octets , ex:000A5E45B145
\u30002. MAC address of the Layer 3 engine’s interface:six octets , ex:000E387D5100
\u30003. the EtherType value:two octets , ex:0800
ARP<\/strong>:shows adjacency with the age of its ARP entry
0 packets, 0 bytes<\/strong>:are almost always 0<\/p>\n\n\n\n

……………………………………………………………………………………………………………..<\/p>\n\n\n\n

packet rewrite engine<\/strong>
When a multilayer switch finds valid entries in the FIB and adjacency tables, a packet is almost ready to be forwarded.
One step remains: The packet header information must be rewritten.<\/strong>
ps:
The switch has an additional functional block that performs a packet rewrite in real time
ps:
multilayer switch can do this very efficiently with dedicated packet-rewrite hardware and address information obtained from table lookups.<\/p>\n\n\n\n

The packet rewrite engine makes the following changes to the packet just before forwarding
Layer 2 destination address<\/strong>:Changed to the next-hop device’s MAC address
Layer 2 source address<\/strong>:Changed to the outbound Layer 3 switch interface’s MAC address
Layer 3 IP TTL<\/strong>:Decremented by one because one router hop has just occurred
Layer 3 IP checksum<\/strong>:Recalculated to include changes to the IP header
Layer 2 frame checksum<\/strong>:Recalculated to include changes to the Layer 2 and Layer 3 headers
ps:
A traditional router normally would make the same changes to each packet.
The multilayer switch must act as if a traditional router were being used, making identical changes.<\/p>\n\n\n\n

…………………………………………………………………………………………………………..<\/p>\n","protected":false},"excerpt":{"rendered":"

CEF(Cisco Express Forwarding)o …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[34],"tags":[],"class_list":["post-960","post","type-post","status-publish","format-standard","hentry","category-cisco-layer2"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=960"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/960\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}