VSC7440 datasheet(164/444 Pages) MICROSEMI

164 / 444 page

Functional Descriptions

VMDS-10492 VSC7440 Datasheet Revision 4.2

147

•

The result is a routed copy to ports 10 and 11 with replaced SMAC and VID from VMID = 2 and TTL

decremented.

3.19.2.6 SIP RPF Check

As a security measure, the device can be configured to only L3 forward frames if the SIP belongs to a

known subnet and is received by one (or more) specific router legs, for example, the router leg through

which the subnet is reached. This configuration can be used to filter IP address spoofing attempts.

To support SIP RPF check, each route in VCAP LPM is assigned a Route Group ID (RGID); that is, any

route in the VCAP LPM belongs to exactly one Route Group. Eight RGID values are supported.

In the VMID table the set of acceptable RGIDs for each router leg is configured using RGID_MASK.

Each router leg can be configured to operate in the following SIP RPF modes.

•

Disabled. No SIP RPF check is performed.

•

RGID mode. Frames are only L3 forwarded if the SIP’s RGID is enabled in the router leg’s

RGID_MASK. If the ARP information is encoded directly in the VCAP action and SIP RPF mode is

set to RGID mode, then an Rleg mode check is performed instead, because an ARP entry encoded

in the VCAP Action contains to RGID.

•

Rleg mode. Frames are only L3 forwarded if the VMID of the ARP table entry resulting from SIP LPM

lookup is identical to the ingress VMID. For example, the router leg, which the frame was received

on, is also the router leg used for forwarding frames to the SIP.

Rleg mode cannot be used for ECMP LPM entries, because each route is only accepted by one

router leg. In Rleg mode, no SIP RPF check is performed if SIP is reachable using an ECMP path.

•

Combined mode. This is a combination of RGID mode and Rleg mode. If the SIP LPM lookup results

in an LPM entry with ECMP_CNT = 0, an Rleg mode check is performed, otherwise a RGID Mode

check is performed.

RFC3704 defines a number of different SIP RPF modes, which can be supported by the device as

follows:

•

Strict RPF. Use Rleg mode or Combined mode to also support ECMP.

•

Loose RPF. Use RGID mode and configure RGID_MASK to all-ones. For example, any RGID value

is acceptable.

•

Loose RPF ignoring default routes. Use RGID mode and configure a separate RGID value for the

default route. Exclude this value in router leg’s RGID_MASK.

•

Feasible RPF. Use RGID mode, group LPM entries using RGID and enable only the accepted

groups in the router leg’s RGID_MASK.

Note that SIP RPF is unrelated to the L3MC RPF check enabled in L3MC:L3MC_CTRL.RPF_CHK_ENA,

which validates that a given IP multicast flow (identified by (S,G) or (*,G) was received by the expected

router leg.

Frames that are not routed due to SIP RPF check can optionally be redirected to CPU by configuring

COMMON:ROUTING_CFG.RLEG_IP4_SIP_RPF_REDIR_ENA and

COMMON:ROUTING_CFG.RLEG_IP6_SIP_RPF_REDIR_ENA.

3.19.2.7 CPU Redirection of Filtered Frames

The following table provides an overview of the available CPU queues used when copying/redirecting

frames to CPU.

Table 90 •

CPU Queue Overview

CPU Queue

Description

COMMON:CPU_QU_CFG.CPU_RLEG_QU

Non-IP unicast frames matching an ingress router leg.

For example, ARP PDUs.

CPU queue for IP frames with L2 broadcast DMAC,

received by router leg.

COMMON:CPU_QU_CFG.CPU_RLEG_IP_OPT_QU

IPv4 frames with options and IPv6 frames with hop-by-

hop option.

VSC7440 датащи(PDF) 164 Page - Microsemi Corporation

VSC7440 датащи(HTML) 164 Page - Microsemi Corporation

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

датащи скачать

ссылки URL