Content

| 5.3 |  | MLS and CEF Configuration Tasks |
| 5.3.4 |  | MLS configuration example |

This example details the configuration of IP MLS for the topology displayed in Figure .

A Cisco 7505 router serves as the MLS-RP, and a Catalyst 5509 with a Supervisor Engine III and an NFFC serves as the MLS-SE. An IEEE 802.1Q trunk connects the two devices participating in MLS.

The IP MLS network topology shown in Figure includes two Catalyst 5505 switches connecting via 802.1Q trunks to the MLS-SE. The 5505s do not play a role in MLS. The network is configured as follows.

There are four VLANs (IP subnetworks):

- VLAN 1 (the management VLAN), subnet 10.1.1.0/24
- VLAN 10, subnet 10.1.10.0/24
- VLAN 20, subnet 10.1.20.0/24
- VLAN 30, subnet 10.1.30.0/24

The MLS-RP is a Cisco 7505 router with a Fast Ethernet interface (interface FastEthernet 2/0)

The subinterfaces on the router interface have these IP addresses:

- FastEthernet 2/0.1 – 10.1.1.1 255.255.255.0
- FastEthernet 2/0.10 – 10.1.10.1 255.255.255.0
- FastEthernet 2/0.20 – 10.1.20.1 255.255.255.0
- FastEthernet 2/0.30 – 10.1.30.1 255.255.255.0

A standard output ACL is configured on subinterface FastEthernet 2/0.20 (the interface in VLAN 20) on the MLS-RP. The ACL denies all traffic from VLAN 30.

Switch A, the MLS-SE, is a Catalyst 5509 switch with Supervisor Engine III and the NFFC.

Switch B and Switch C are Catalyst 5505 switches.

Switch A is the VTP server in domain “Corporate".

Switch B and Switch C are VTP clients.

Next, we detail the inter-VLAN switching path both before and after IP MLS operation.

Operation Before IP MLS
Before IP MLS is implemented, when the source host S1 (on VLAN 10) transmits traffic destined for server D1 (on VLAN 30), Switch B forwards the traffic (based on the Layer 2 forwarding table) to Switch A over the 802.1Q trunk link. Switch A forwards the packet to the router over the 802.1Q trunk. The router receives the packet on the VLAN 10 subinterface, checks the destination IP address, and routes the packet to the VLAN 30 subinterface. Switch A receives the routed packet and forwards it to Switch C. Switch C receives the packet and forwards it to destination server D1. This process is repeated for each packet in the flow between source host S1 and destination server D1.

When source host S2 sends traffic to destination server D2, Switch C forwards the packets over the 802.1Q trunk to Switch A. Switch A forwards the packet to the MLS-RP, which receives it on the VLAN 30 subinterface. Because the standard ACL configured on the outgoing VLAN 20 subinterface denies all traffic from VLAN 30, the router drops the traffic to Destination D2 from Source S2. Any subsequent traffic from Source S2 for Destination D2 also reaches the router and is dropped.

Operation After IP MLS
After IP MLS is implemented, when the source host S1 transmits traffic destined for destination server D1, Switch B forwards the traffic (based on the Layer 2 forwarding table) to Switch A (the MLS-SE) over the 802.1Q trunk link. When the first packet enters Switch A, a candidate flow entry is established in the MLS cache. Switch A forwards the packet to the MLS-RP over the 802.1Q trunk. The MLS-RP receives the packet on the VLAN 10 subinterface, checks the destination IP address, and routes the packet to the VLAN 30 subinterface. Switch A receives the routed packet (the enable packet) and completes the flow entry in the MLS cache for destination IP address 10.1.30.100. Switch A forwards the packet to Switch C, where it is forwarded to destination server D1.

Subsequent packets destined for IP address 10.1.30.100 are multilayer-switched by the MLS-SE based on the flow entry in the MLS cache. For example, subsequent packets in the flow from source host S1 are forwarded by Switch B to Switch A (the MLS-SE). The MLS-SE determines that the packets are part of the established flow, rewrites the packet headers, and switches the packets directly to Switch C, bypassing the router.

Because a standard ACL is applied on subinterface FastEthernet 2/0.20, the MLS-SE must use the source-destination-ip flow mask for all MLS cache entries. When source host S2 sends traffic to destination server D2, Switch C forwards the packets over the 802.1Q trunk to Switch A. Switch A forwards the candidate packet to the MLS-RP, which receives it on the VLAN 30 subinterface. Because the standard ACL configured on the outgoing VLAN 20 subinterface denies all traffic from VLAN 30, the router drops the traffic to Destination D2 from Source S2. Switch A never receives the enable packet for the flow on VLAN 20, and no MLS cache entry is completed for the flow. Any subsequent traffic from Source S2 for Destination D2 also reaches the router and is dropped.

MLS-RP Configuration
The MLS-RP configuration is shown in Figure .

Switch A Configuration
In some Cisco IOS Software releases, traffic on the IEEE 802.1Q native VLAN is not routed. The default native VLAN on Catalyst switches is VLAN 1. If the Cisco IOS Software release being used does not route traffic on the native VLAN and an administrator wants to route traffic on VLAN 1, then the administrator must change the native VLAN on the switch-to-router trunk link to an unused VLAN. In the Switch A, Switch B, and Switch C configuration examples, the native VLAN on all the 802.1Q trunk links is set to an unused VLAN, VLAN 5.

The configuration for Switch A is shown in Figure .

The configuration for Switch B is shown in Figure .

The configuration for Switch C is shown in Figure .