Content

| 5.3 |  | MLS and CEF Configuration Tasks |
| 5.3.3 |  | Configuring MLS optional parameters |

In addition to the MLS-RP and MLS-SE commands discussed up to this point, there are a few optional MLS parameters available. Two of these parameters are as the ability to configure MLS aging time and minimum flow mask. These values can be adjusted to tune MLS efficiency.

MLS Aging Time
The IP MLS aging time determines the time before an MLS entry is aged out. The default is 256 seconds. The aging time can be configured for a value in the range of 8 to 2032 seconds, in 8-second increments. Any aging-time value that is not a multiple of 8 seconds is adjusted to the closest one. For example, a value of 65 is adjusted to 64, and a value of 127 is adjusted to 128. Other events might cause MLS entries to be purged, such as routing changes or a change in link state (MLS-SE link down).

To specify the IP MLS aging time, use the command set mls agingtime [agingtime] in privileged mode.

Another useful MLS cache aging parameter is the fast aging time. Cisco recommends that keeping the number of MLS entries in the MLS cache below 32,000 entries. If the number of MLS entries amounts to more than 32,000, some flows are sent to the router.

To help keep the MLS cache size below 32,000, enable the IP MLS fast aging time. The IP MLS fast aging time applies to MLS entries that have no more than pkt_threshold packets switched within fastagingtime seconds after it is created. A typical cache entry that is removed is the entry for flows to and from a Domain Name Server or TFTP server; the entry might never be used again after it is created. Detecting and aging out these entries saves space in the MLS cache for other data traffic.

The default fastagingtime value is 0 (no fast aging). The fastagingtime value can be set to 32, 64, 96, or 128 seconds. Any fastagingtime value that is not configured exactly as the indicated values is adjusted to the closest one. The pkt_threshold value can be set to 0, 1, 3, 7, 15, 31, or 63 packets.

If IP MLS fast aging time needs to be enabled, initially set the value to 128 seconds. If the size of the MLS cache continues to grow over 32 KB, decrease the setting until the cache size stays below 32 KB. If the cache continues to grow over 32 KB, decrease the normal IP MLS aging time.

Typical values for fastagingtime and pkt_threshold are 32 seconds and 0 packets (no packets switched within 32 seconds after the entry is created).

To specify the IP MLS fast aging time and packet threshold, use the command set mls agingtime fast [fastagingtime] [pkt_threshold] in privileged mode.

Minimum IP MLS Flow Mask
The minimum granularity of the flow mask for the MLS cache is configured on the MLS-SE. The actual flow mask used consists of a granularity specified by this command. If a more-specific flow mask is configured, the number of active flow entries increases. To limit the number of active flow entries, the MLS aging time might need to be decreased.

If ACLs are not configured on any MLS-RP, the IP MLS flow mask on the MLS-SE is destination-ip by default (as discussed in the earlier section “MLS Flows”). However, an administrator can force the MLS-SE to use a particular flow mask granularity by setting the minimum IP MLS flow mask using the set mls flow {destination | destination-source | full} command in privileged mode. Depending on the MLS-RP configuration, the actual flow mask used might be more specific than the specified minimum flow mask. For example, if the minimum flow mask of destination-source is configured, but an MLS-RP interface is configured with IP extended ACLs, the actual flow mask used is full (ip-flow).

The set mls flow command purges all existing MLS cache entries and affects the number of active entries on the MLS-SE, so use this command carefully when applying it to a production environment.