Content

| 5.1 |  | Multilayer Switching |
| 5.1.4 |  | MLS flows |

An MLS-SE maintains a Layer 3 switching table (the Layer 3 MLS cache) for Layer 3 switched flows. After the MLS cache is created, packets identified as belonging to an existing flow can be switched based on the cached information. The MLS cache maintains flow information for all active flows. The maximum size of the MLS cache is 128,000 entries. The larger the active cache, the greater the likelihood that a flow will not be switched by the MLS-SE and will get forwarded to the router.

An MLS cache entry is created for the initial packet of each flow. Upon receipt of a packet that does not match any flow currently in the MLS cache, a new IP MLS entry is created. This first packet has special significance and is detailed more in the next section.

The state and identity of a flow are maintained while packet traffic is active. When traffic for a flow ceases, the entry ages out. The aging time for MLS entries kept in the MLS cache is configurable. If an entry is not used for the specified period of time, the entry ages out.

The MLS-SE uses flow masks to determine how MLS entries are created. The flow Mask is a set of criteria, based on a combination of source IP address, destination IP address, protocol, and protocol ports that describes the characteristics of the flow. The MLS-SE learns the flow mask through Multilayer Switching Protocol (MLSP) messages from each MLS-RP for which the MLS-SE is performing Layer 3 switching. MLSP is the protocol used to communicate MLS information between the MLS-SE and MLS-RP. In particular, the MLS-SE populates its Layer 2 Content-Addressable Memory (CAM) table with updates received from MLSP packets. When the MLS-SE flow mask changes, the entire MLS cache is purged.

The three flow masks are as follows:

- destination-ip – The least specific flow mask. The MLS-SE maintains one MLS entry for each destination IP address. All flows to a given destination IP address use this MLS entry. This mode is used if no access control lists (ACLs) are configured on any of the MLS-RP interfaces.
- source-destination-ip – The MLS-SE maintains one MLS entry for each source and destination IP address pair. All flows between a given source and destination use this MLS entry, regardless of the IP protocol ports. This mode is used if any of the MLS-RP interfaces has a standard ACL.
- ip-flow – The most-specific flow mask. The MLS-SE creates and maintains a separate MLS cache entry for every IP flow. An ip-flow entry includes the source IP address, destination IP address, protocol, and protocol ports. This mode is used if any of the MLS-RP interfaces has an extended ACL.

When a packet is Layer 3 switched from a source host to a destination host, the MLS-SE performs a packet rewrite based on information learned from the MLS-RP and stored in the MLS cache.

If Host A and Host B are on different VLANs, and Host A sends a packet to the MLS-RP to be routed to Host B, the MLS-SE recognizes that the packet was sent to the MAC address of the MLS-RP. The MLS-SE checks the MLS cache and finds the entry matching the flow in question.

When the MLS-SE receives the packet, it is formatted as shown in Figure .

The MLS-SE rewrites the Layer 2 frame header, changing the destination MAC address to the MAC address of Host B and the source MAC address to the MAC address of the MLS-RP. These MAC addresses are stored in the MLS cache entry for this flow. The Layer 3 IP addresses remain the same, but the IP header Time To Live (TTL) is decremented, and the IP checksum is recomputed. The MLS-SE rewrites the switched Layer 3 packets so that they appear to have been routed by a router. The MLS-SE forwards the rewritten packet to the VLAN of Host B, the destination VLAN is stored in the MLS cache entry, and Host B receives the packet.

After the MLS-SE performs the packet rewrite, the packet is formatted as shown in Figure .

An IP MLS network topology is shown in Figure . In this example, Host A is on Sales VLAN 1 (IP subnet 192.168.1.0), Host B is on Marketing VLAN 2 (IP subnet 192.168.2.0), and Host C is on Engineering VLAN 3 (IP subnet 192.168.3.0).
When Host A initiates an FTP file transfer to Host B, an MLS entry for this flow is created as shown. The MLS-SE stores the MAC addresses of the MLS-RP and Host B in the MLS entry when the MLS-RP forwards the first packet from Host A through the switch to Host B. The MLS-SE uses this information to rewrite subsequent packets from Host A to Host B.
Similarly, a separate MLS entry is created in the MLS cache for the HTTP traffic from Host A to Host C and for the HTTP traffic from Host C to Host A. The destination VLAN is stored as part of each MLS entry so that the correct VLAN identifier is used when encapsulating traffic on trunk links.

MLS creates flows based on ACLs configured on the MLS-RP. IP MLS allows the network administrator to enforce ACLs on every packet of the flow without compromising IP MLS performance. When IP MLS is enabled, the MLS-SE handles standard and extended ACL permit traffic at wire speed. Traffic that is denied by an ACL is always handled by the MLS-RP, not the MLS-SE. Route topology changes and the addition or modification of ACLs are reflected in the IP MLS switching path automatically on the MLS-SE.

For example, when Host A wants to communicate with Host B, it sends the first packet to the MLS-RP. If an ACL is configured on the MLS-RP to deny access from Host A to Host B, the MLS-RP receives the packet, checks the ACL to see if the packet flow is permitted, and discards the packet based on the ACL. Because the first packet for this flow does not return from the MLS-RP, an MLS cache entry is not established by the MLS-SE.

If a flow is already being Layer 3 switched by the MLS-SE, and the ACL is created on the MLS-RP, the MLS-SE learns of the change through MLSP and immediately enforces security for the affected flow by purging it from the MLS cache. New flows are created based on the restrictions imposed by the ACL.

Similarly, when the MLS-RP detects a routing topology change, the appropriate MLS cache entries are deleted in the MLS-SE. New flows are created based on the new topology.