Catalyst 6500 Series Software Configuration Guide, 8.7
Configuring CEF for PFC2/PFC3

Table Of Contents

Configuring CEF for PFC2 and PFC3A

Understanding How Layer 3 Switching Works

Layer 3 Switching Overview

Understanding Layer 3-Switched Packet Rewrite

Understanding IP Unicast Rewrite

Understanding IPX Unicast Rewrite

Understanding IP Multicast Rewrite

Understanding CEF for PFC2/PFC3A

CEF for PFC2/PFC3A Overview

Understanding the Forwarding Decisions

Understanding the FIB

Understanding the Adjacency Table

Partially and Completely Switched Multicast Flows

CEF for PFC2/PFC3A Examples

Understanding the NetFlow Statistics

NetFlow Statistics Overview

NetFlow Table Entry Aging

Flow Masks

Default CEF for PFC2/PFC3A Configuration

CEF for PFC2/PFC3A Configuration Guidelines and Restrictions

Configuring CEF for PFC2/PFC3A on the Switch

Displaying the Layer 3-Switching Entries on the Supervisor Engine

Configuring CEF on MSFC2/MSFC3

Specifying CEF Maximum Routes

Configuring IP Multicast on MSFC2/MSFC3

Enabling IP Multicast Routing Globally

Enabling IP PIM on an MSFC2/MSFC3 Interface

Configuring the IP MMLS Global Threshold

Enabling IP MMLS on MSFC2/MSFC3 Interfaces

Displaying IP Multicast Information

Displaying IP Multicast Information on MSFC2/MSFC3

Displaying the IP Multicast Information on the Supervisor Engine

Configuring the NetFlow Statistics on the Switch

Specifying NetFlow Table Entry Creation on a Per-Interface Basis

Specifying the NetFlow Table Entry Aging-Time Value

Specifying the NetFlow Table IP Entry Fast Aging Time and Packet Threshold Values

Setting the Minimum Statistics Flow Mask

Excluding the IP Protocol Entries from the NetFlow Table

Displaying the NetFlow Statistics

Clearing the NetFlow IP and IPX Statistics

Clearing All the NetFlow Statistics

Clearing the NetFlow IP Statistics

Clearing the NetFlow IPX Statistics

Clearing the NetFlow Statistics Totals

Displaying the NetFlow Statistics Debug Information

Configuring the MLS IP-Directed Broadcasts on the Switch


Configuring CEF for PFC2 and PFC3A


This chapter describes how to configure Cisco Express Forwarding (CEF) for Policy Feature Card 2 (PFC2) and PFC3A on the Catalyst 6500 series switches.

CEF for PFC2 provides IP and Internetwork Packet Exchange (IPX) unicast Layer 3 switching and IP multicast Layer 3 switching for Supervisor Engine 2, PFC2, and Multilayer Switch Feature Card 2 (MSFC2).

CEF for PFC3A provides IP unicast Layer 3 switching and IP multicast Layer 3 switching for Supervisor Engine 720, PFC3A, and Multilayer Switch Feature Card 3 (MSFC3).


Note With Supervisor Engine 720 (MSFC3), IPX routing is done through the software.



Note For complete information on the syntax and usage information for the supervisor engine commands that are used in this chapter, refer to the Catalyst 6500 Series Switch Command Reference publication.


This chapter consists of these sections:

Understanding How Layer 3 Switching Works

Default CEF for PFC2/PFC3A Configuration

CEF for PFC2/PFC3A Configuration Guidelines and Restrictions

Configuring CEF for PFC2/PFC3A on the Switch

Configuring the NetFlow Statistics on the Switch

Configuring the MLS IP-Directed Broadcasts on the Switch


Note Supervisor Engine 1 with PFC1 and MSFC or MSFC2 provide Layer 3 switching with Multilayer Switching (MLS). See Chapter 14, "Configuring MLS," for more information.



Note To configure MSFC2 to support MLS on a Catalyst 5000 family switch, refer to the Layer 3 Switching Software Configuration Guide at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_5_2/layer3/index.htm.


Understanding How Layer 3 Switching Works

These sections describe Layer 3 switching with PFC2:

Layer 3 Switching Overview

Understanding Layer 3-Switched Packet Rewrite

Understanding CEF for PFC2/PFC3A

Understanding the NetFlow Statistics

Layer 3 Switching Overview


Note With Supervisor Engine 720 (MSFC3), IPX routing is done through the software.


Layer 3 switching allows a switch, instead of a router, to forward the IP and IPX unicast traffic and the IP multicast traffic between the VLANs. Layer 3 switching is implemented in the hardware and provides wire-speed interVLAN forwarding on the switch, rather than on MSFC2/MSFC3. Layer 3 switching requires minimal support from MSFC2/MSFC3. MSFC2/MSFC3 routes any traffic that cannot be Layer 3 switched.


Note Layer 3 switching supports the routing protocols that are configured on MSFC2/MSFC3. Layer 3 switching does not replace the routing protocols that are configured on MSFC2/MSFC3. Layer 3 switching uses Protocol Independent Multicast (PIM) for multicast route determination.


Layer 3 switching on Catalyst 6500 series switches provides flow statistics that you can use to identify the traffic characteristics for administration, planning, and troubleshooting. Layer 3 switching uses NetFlow Data Export (NDE) to export the flow statistics. See Chapter 16, "Configuring NDE" for more information about NDE.


Note Traffic is Layer 3 switched after being processed by the VLAN access control list (VACL) feature and the quality of service (QoS) feature.


Understanding Layer 3-Switched Packet Rewrite


Note With Supervisor Engine 720 (MSFC3), IPX routing is done through the software.


When a packet is Layer 3 switched from a source in one VLAN to a destination in another VLAN, the switch performs a packet rewrite at the egress port that is based on information learned from MSFC2/MSFC3 so that the packets appear to have been routed by MSFC2/MSFC3.


Note Rather than just forwarding IP multicast packets, the PFC2/PFC3A replicates them as necessary on the appropriate VLANs.


The packet rewrite alters these five fields:

Layer 2 (MAC) destination address

Layer 2 (MAC) source address

Layer 3 IP Time to Live (TTL) or IPX Transport Control

Layer 3 checksum

Layer 2 (MAC) checksum (also called the frame checksum or FCS)


Note Packets are rewritten with the encapsulation that is appropriate for the next-hop subnet.


If Source A and Destination B are on different VLANs and Source A sends a packet to MSFC2/MSFC3 to be routed to Destination B, the switch recognizes that the packet was sent to the Layer 2 (MAC) address of MSFC2/MSFC3.

To perform Layer 3 switching, the switch rewrites the Layer 2 frame header, changing the Layer 2 destination address to the Layer 2 address of Destination B and the Layer 2 source address to the Layer 2 address of MSFC2/MSFC3. The Layer 3 addresses remain the same.

In IP unicast and IP multicast traffic, the switch decrements the Layer 3 TTL value by 1 and recomputes the Layer 3 packet checksum. In IPX traffic, the switch increments the Layer 3 Transport Control value by 1 and recomputes the Layer 3 packet checksum. The switch recomputes the Layer 2 frame checksum and forwards (or for multicast packets, replicates as necessary) the rewritten packet to Destination B's VLAN.

These sections describe how the packets are rewritten:

Understanding IP Unicast Rewrite

Understanding IPX Unicast Rewrite

Understanding IP Multicast Rewrite

Understanding IP Unicast Rewrite

Received IP unicast packets are (conceptually) formatted as follows:

Layer 2 Frame Header
Layer 3 IP Header
Data
FCS

Destination

Source

Destination

Source

TTL

Checksum

   

MSFC2/MSFC3 MAC

Source A MAC

Destination B IP

Source A IP

n

calculation1


After the switch rewrites an IP unicast packet, it is (conceptually) formatted as follows:

Layer 2 Frame Header
Layer 3 IP Header
Data
FCS

Destination

Source

Destination

Source

TTL

Checksum

   

Destination B MAC

MSFC2/MSFC3 MAC

Destination B IP

Source A IP

n-1

calculation2


Understanding IPX Unicast Rewrite

Received IPX packets are (conceptually) formatted as follows:

Layer 2 Frame Header
Layer 3 IPX Header
Data
FCS

Destination

Source

Checksum/
IPX Length/
Transport Control

Destination Net/
Node/
Socket

Source Net/
Node/
Socket

   

MSFC2 MAC

Source A MAC

n

Destination B IPX

Source A IPX


After the switch rewrites an IPX packet, it is (conceptually) formatted as follows:

Layer 2 Frame Header
Layer 3 IPX Header
Data
FCS

Destination

Source

Checksum/
IPX Length/
Transport Control

Destination Net/
Node/
Socket

Source Net/
Node/
Socket

   

Destination B
MAC

MSFC2 MAC

n+1

Destination B IPX

Source A IPX


Understanding IP Multicast Rewrite

Received IP multicast packets are (conceptually) formatted as follows:

Layer 2 Frame Header
Layer 3 IP Header
Data
FCS

Destination

Source

Destination

Source

TTL

Checksum

   

Group G1 MAC1

Source A MAC

Group G1 IP

Source A IP

n

calculation1

1 In this example, Destination B is a member of Group G1.


After the switch rewrites an IP multicast packet, it is (conceptually) formatted as follows:

Frame Header
IP Header
Data
FCS

Destination

Source

Destination

Source

TTL

Checksum

   

Group G1 MAC

MSFC2/MSFC3 MAC

Group G1 IP

Source A IP

n-1

calculation2


Understanding CEF for PFC2/PFC3A


Note With Supervisor Engine 720 (MSFC3), IPX routing is done through the software.


These sections describe CEF for PFC2:

CEF for PFC2/PFC3A Overview

Understanding the Forwarding Decisions

Understanding the FIB

Understanding the Adjacency Table

Partially and Completely Switched Multicast Flows

CEF for PFC2/PFC3A Examples

CEF for PFC2/PFC3A Overview

Supervisor Engine 2, PFC2, and MSFC2 provide Layer 3 switching with CEF for PFC2. CEF for PFC2 is permanently enabled on Supervisor Engine 2. Cisco IOS CEF is permanently enabled on MSFC2 in support of CEF for PFC2.

Supervisor Engine 720, PFC3A, and MSFC3 provide Layer 3 switching with CEF for PFC3A. CEF for PFC3A is permanently enabled on Supervisor Engine 720. Cisco IOS CEF is permanently enabled on MSFC3 in support of CEF for PFC3A.

CEF for PFC2/PFC3A works with CEF (for unicast traffic) and PIM (for multicast traffic) on MSFC2/MSFC3 to support IP, IP multicast, and IPX traffic. CEF and PIM on MSFC2/MSFC3 are enhanced to support CEF for PFC2/PFC3A. CEF for PFC2/PFC3A generates flow statistics for Layer 3-switched traffic that can be displayed at the CLI or used for NDE.

CEF for PFC2/PFC3A provides Layer 3 switching for all packets that match a complete forwarding information base (FIB) entry (see the "Understanding the FIB" section). CEF for PFC2/PFC3A sends all packets that match an incomplete FIB entry (one where the MAC address has not been resolved) to MSFC2/MSFC3 to be routed until MSFC2/MSFC3 resolves the MAC address.


Note CEF for PFC2/PFC3A sends bridge traffic that is addressed at Layer 2 to MSFC2/MSFC3 to be processed.



Note Access control lists (ACLs) and policy-based routing can cause CEF for PFC2/PFC3A to ignore the FIB when making a forwarding decision (see the "Understanding the Forwarding Decisions" section).


Understanding the Forwarding Decisions

CEF for PFC2/PFC3A provides Layer 3 switching that is based on the following:

Entries in the ACL ternary content addressable memory (TCAM) for policy-based routing decisions

Entries in the NetFlow table for TCP intercept and reflexive ACL forwarding decisions (see the "Understanding the NetFlow Statistics" section)

Entries in the FIB and adjacency table for all other forwarding decisions

Enter the show mls entry command to display information about the entries that are used to make forwarding decisions. CEF for PFC2/PFC3A makes a forwarding decision for each packet and sends the rewrite information for each packet to the egress port, where the rewrite occurs when the packet is transmitted from the switch.

Understanding the FIB

The FIB resides in a separate TCAM. The adjacency table is stored separately in DRAM. The NetFlow table is stored separately in DRAM. The FIB, the adjacency table, and the NetFlow table do not compete with any other features for storage space.

The FIB is conceptually similar to a routing table. It maintains a mirror image of the forwarding information that is contained in the unicast and multicast routing tables on MSFC2/MSFC3. When routing or topology changes occur in the network, the unicast and multicast routing tables on MSFC2/MSFC3 are updated and those changes are reflected in the FIB. The FIB maintains next-hop address information that is based on the information in the routing tables on MSFC2/MSFC3. The FIB supports 256,000 entries, which includes 16,000 IP multicast entries (128,000 IP multicast entries on MSFC3). With reverse path forwarding (RPF) check enabled, the number of IP entries doubles (with Supervisor Engine 720, the number of IP entries remain the same).

FIB lookup uses the following criteria:

Destination IP address for IP unicast

Destination IPX network for IPX unicast

Source and destination IP address for IP unicast with RPF check

Source and destination IP address for IP multicast with RPF check


Note Because the FIB mirrors the unicast and multicast routing tables on MSFC2/MSFC3, any commands on MSFC2/MSFC3 that change the unicast or multicast routing tables affect the FIB. Forwarding entries cannot be cleared from the Supervisor Engine 2 or Supervisor Engine 720 command-line interface (CLI).


In switches with redundant supervisor engines and MSFC2s/MSFC3s, the designated MSFC2/MSFC3 supports the FIB on the active Supervisor Engine 2 or Supervisor Engine 720. The routing protocols on the nondesignated MSFC2/MSFC3 send information to the routing protocols on the designated MSFC2/MSFC3.

Enter the show mls entry cef command to display the following:

Module number of the MSFC that is supporting the FIB

FIB entry type (receive, connected, resolved, drop, wildcard, or default)

Destination address (IP address or IPX network)

Destination mask

Next-hop address (IP address or IPX network)

Next-hop mask

Next-hop load-sharing weight

Console> (enable) show mls entry cef
Mod FIB-Type  Destination-IP  Destination-Mask NextHop-IP      Weight
--- --------- --------------- ---------------- --------------- ------
 15 receive   0.0.0.0         255.255.255.255 
 15 receive   255.255.255.255 255.255.255.255 
 15 receive   127.0.0.0       255.255.255.255 
 15 receive   127.0.0.52      255.255.255.255 
 15 receive   127.255.255.255 255.255.255.255 
 15 receive   10.1.1.2        255.255.255.255 
 15 receive   10.1.1.0        255.255.255.255 
 15 receive   10.1.1.255      255.255.255.255 
 15 receive   10.10.1.1       255.255.255.255 
 15 receive   10.10.0.0       255.255.255.255 
.
.
.
Console> (enable)

Enter the show mls command to display a Layer 3 switching summary:

Console> (enable) show mls
Total packets switched = 35254
Total bytes switched = 2256256
Total routes = 120569
Total number of Netflow entries = 120000 

IP statistics flows aging time = 50 seconds
Long-duration flows aging time = 320 seconds
IP statistics flows fast aging time = 0 seconds, packet threshold = 0

IP Current flow mask is Full-Vlan flow
Netflow Data Export version: 7
Netflow Data Export disabled
Netflow Data Export port/host is not configured.
Total packets exported = 0
Destination Ifindex export is enabled
Source Ifindex export is enabled
Rate limiting is turned off, packets are bridged to router
Load balancing hash is based on source and destination IP addresses and universc
Per-prefix Stats for ALL FIB entries is Enabled
Console> (enable) 

Understanding the Adjacency Table

For each FIB entry, CEF for PFC2/PFC3A stores Layer 2 information from the designated MSFC2/MSFC3 for adjacent nodes in the adjacency table. Adjacent nodes are nodes that are directly connected at Layer 2. To forward traffic, CEF for PFC2/PFC3A selects a route from a FIB entry, which points to an adjacency entry, and uses the Layer 2 header for the adjacent node in the adjacency table entry to rewrite the packet during Layer 3 switching. CEF for PFC2 supports 256,000 adjacency table entries. CEF for PFC3A supports 1,000,000 adjacency table entries. Only half of the adjacency table entries provide statistics.

Table 13-1 lists the adjacency types.

Table 13-1 Adjacency Types 

Adjacency Type
Description

connect

Entry type that contains complete rewrite information

punt

Entry to send traffic to MSFC2/MSFC3

no r/w

Entry to send traffic to MSFC2/MSFC3 when rewrite information is incomplete

frc drp

Entry that is used to drop packets due to ARP throttling

drop, null, loopbk

Entries that are used to drop packets


Enter the show mls entry cef adjacency command to display the following:

FIB information (see the "Understanding the FIB" section)

Adjacency type (connect, drop, null, loopbk, frc drp, punt, no r/w)

Next-hop MAC address

Next-hop VLAN

Next-hop encapsulation

Number of packets that are transmitted to this adjacency from the associated FIB entry

Number of bytes that are transmitted to this adjacency from the associated FIB entry

Console> (enable) show mls entry cef adjacency 
Mod:                 15
Destination-IP:      140.140.1.5        Destination-Mask:   255.255.255.255 
FIB-Type:            resolved  

AdjType  NextHop-IP      NextHop-Mac       Vlan Encp Tx-Packets   Tx-Octets
-------- --------------- ----------------- ---- ---- ------------ -------------
connect  140.140.1.5     00-00-d0-00-00-05  140 ARPA            0             0

Mod:                 15
Destination-IP:      150.150.1.5        Destination-Mask:   255.255.255.255 
FIB-Type:            resolved  

AdjType  NextHop-IP      NextHop-Mac       Vlan Encp Tx-Packets   Tx-Octets
-------- --------------- ----------------- ---- ---- ------------ -------------
connect  150.150.1.5     00-00-e0-00-00-05  150 ARPA            0             0

Mod:                 15
Destination-IP:      153.153.1.5        Destination-Mask:   255.255.255.255 
FIB-Type:            resolved  

AdjType  NextHop-IP      NextHop-Mac       Vlan Encp Tx-Packets   Tx-Octets
-------- --------------- ----------------- ---- ---- ------------ -------------
connect  153.153.1.5     00-00-e3-00-00-05  153 ARPA            0             0
.
.
.
Console> (enable) 

Enter the clear mls entry cef adjacency command to clear the CEF adjacency information:

Console> (enable) clear mls entry cef adjacency 
Adjacency statistics has been cleared.
Console> (enable) 

Partially and Completely Switched Multicast Flows

Some flows might be partially Layer 3 switched instead of completely Layer 3 switched in these situations:

MSFC2/MSFC3 is configured as a member of the IP multicast group (using the ip igmp join-group command) on the RPF interface of the multicast source.

MSFC2/MSFC3 is the first-hop router to the source in PIM sparse mode (in this case, MSFC2/MSFC3 must send PIM-register messages to the rendezvous point).

The multicast TTL threshold is configured on an egress interface for the flow.

The multicast helper is configured on the RPF interface for the flow, and multicast to broadcast translation is required.

Multicast tag switching is configured on an egress interface.

Network Address Translation (NAT) is configured on an interface, and source address translation is required for the outgoing interface.


Note CEF for PFC2/PFC3A provides Layer 3 switching when the extended access list deny condition on the RPF interface specifies something other than the Layer 3 source, Layer 3 destination, or IP protocol (an example is the Layer 4 port numbers).


For partially switched flows, all multicast traffic belonging to the flow reaches MSFC2/MSFC3 and is software switched for any interface that is not Layer 3 switched.


Note All (*,G) flows are always partially Layer 3 switched.


PFC2/PFC3A prevents multicast traffic in flows that are completely Layer 3 switched from reaching MSFC2/MSFC3, reducing the load on MSFC2/MSFC3. The show ip mroute and show mls ip multicast commands identify completely Layer 3-switched flows with the text string "RPF-MFD." Multicast Fast Drop (MFD) indicates that from the perspective of MSFC2/MSFC3, the multicast packet is dropped, because it is switched by the PFC2/PFC3A.

For all completely Layer 3-switched flows, PFC2/PFC3A periodically sends multicast packet and byte count statistics to MSFC2/MSFC3, because MSFC2/MSFC3 cannot record multicast statistics for completely switched flows, which it never sees. MSFC2/MSFC3 uses the statistics to update the corresponding multicast routing table entries and reset the appropriate expiration timers.

CEF for PFC2/PFC3A Examples

Figure 13-1 shows a simple IP CEF network topology. In this example, Host A is on the Sales VLAN (IP subnet 171.59.1.0), Host B is on the Marketing VLAN (IP subnet 171.59.3.0), and Host C is on the Engineering VLAN (IP subnet 171.59.2.0).

When Host A initiates an HTTP file transfer to Host C, PFC2/PFC3A uses the information in the FIB and adjacency table to forward packets from Host A to Host C.

Figure 13-1 IP CEF Example Topology

Figure 13-2 shows a simple IPX CEF network topology. In this example, Host A is on the Sales VLAN (IPX address 01.Aa), Host B is on the Marketing VLAN (IPX address 03.Bb), and Host C is on the Engineering VLAN (IPX address 02.Cc).

When Host A initiates a file transfer to Host C, PFC2 uses the information in the FIB and adjacency table to forward packets from Host A to Host C.

Figure 13-2 IPX CEF Example Topology

Understanding the NetFlow Statistics


Note With Supervisor Engine 720 (MSFC3), IPX routing is done through the software.


These sections describe NetFlow statistics:

NetFlow Statistics Overview

NetFlow Table Entry Aging

Flow Masks

NetFlow Statistics Overview

CEF for PFC2/PFC3A generates flow statistics for Layer 3-switched traffic, which are stored in the NetFlow table. NetFlow statistics can be displayed with show commands and are also available to NetFlow Data Export (NDE).


Note A NetFlow table with more than 32,000 entries increases the probability that there will be insufficient room to store statistics. To reduce the number of entries in the NetFlow table, you can exclude specified IP protocols from the statistics or use the least granular flow mask (see the "Excluding the IP Protocol Entries from the NetFlow Table" section).


NetFlow statistics support unicast and multicast flows as follows:

A unicast flow can be any of the following:

Destination only: All traffic to a particular IP destination

Destination-source: All traffic from a particular IP source to a particular IP destination

Full-flow: All traffic from a particular IP source to a particular IP destination that shares the same protocol and transport-layer information

A multicast flow is all traffic with the same protocol and transport-layer information from a particular source to the members of a particular destination multicast group.

NetFlow Table Entry Aging

The state and identity of flows are maintained while packet traffic is active; when traffic for a flow ceases, the entry ages out. You can configure the aging time for the NetFlow table entries that are kept in the NetFlow table. If an entry is not used for the specified period of time, the entry ages out and statistics for that flow can be exported to a flow collector application.

Flow Masks

Flow masks determine how the NetFlow table entries are created. CEF for PFC2 supports only one flow mask (the most specific one) for all statistics. If NetFlow for PFC2 detects different flow masks from different MSFCs for which it is performing Layer 3 switching, it changes its flow mask to the most specific flow mask detected (this applies to the PFC2/MSFC2 only).

When the flow mask changes, the entire NetFlow table is purged. When CEF for PFC2/PFC3A exports cached entries, flow records are created based on the current flow mask. Depending on the current flow mask, some fields in the flow record might not have values. Unsupported fields are filled with a zero (0).

The statistics flow masks are as follows:

destination-ip—The least-specific flow mask for IP

destination-ipx—The only flow mask for IPX

source-destination-ip—For IP

source-destination-vlan—For IP multicast

full flow—The most-specific flow mask

full vlan—The same fields as in full flow plus the source VLAN

Enter the show mls statistics entry command to display the contents of the NetFlow table and the current flow mask. Use the keyword options to display information for specific traffic (refer to the Catalyst 6500 Series Switch Command Reference publication for more information).

Default CEF for PFC2/PFC3A Configuration

Table 13-2 shows the default CEF for PFC2/PFC3A configuration.

Table 13-2 Default CEF for PFC2/PFC3A Configuration 

Feature
Default Value

CEF for PFC2 enable state

Enabled (cannot be disabled)

CEF enable state on MSFC2/MSFC3

Enabled (cannot be disabled)

Multicast services (IGMP snooping)

Enabled

Multicast services (GMRP)

Disabled

Multicast routing on MSFC2/MSFC3

Disabled globally

PIM routing on MSFC2/MSFC3

Disabled on all interfaces

IP MMLS Threshold

Unconfigured—no default value

IP MMLS

Enabled when multicast routing is enabled and IGMP snooping is enabled


CEF for PFC2/PFC3A Configuration Guidelines and Restrictions


Note With Supervisor Engine 720 (MSFC3), IPX routing is done through the software.


This section describes the guidelines and restrictions for configuring CEF for PFC2/PFC3A:

PFC2 supports a maximum of 16 unique Hot Standby Router Protocol (HSRP) group numbers. You can use the same HSRP group numbers in different VLANs. If you configure more than 16 HSRP groups, this restriction prevents use of the VLAN number as the HSRP group number.


Note Identically numbered HSRP groups use the same virtual MAC address, which might cause errors if you configure bridging on the MSFC.


Because of the restriction to 16 unique HSRP group numbers, CEF for PFC2 cannot support the standby use-bia HSRP command.

PFC3A supports 256 HSRP groups.

CEF for PFC2 supports the following ingress and egress encapsulations:


Note CEF for PFC3A supports Ethernet V2.0 (ARPA) only.


For IP unicast:
Ethernet V2.0 (ARPA)
802.3 with 802.2 with 1 byte control (SAP1)
802.3 with 802.2 and SNAP

For IPX:
Ethernet V2.0 (ARPA)
802.3 (raw)
802.2 with 1 byte control (SAP1)
SNAP


Note When the ingress encapsulation for IPX traffic is SAP1, CEF for PFC2 provides Layer 3 switching only when the egress encapsulation is also SAP1. MSFC2 routes IPX SAP1 traffic that requires an encapsulation change.


For IP multicast—Ethernet V2.0 (ARPA)

CEF for PFC2/PFC3A does not provide Layer 3 switching for an IP multicast flow in the following cases:

For IP multicast groups that fall into the range 224.0.0.* (where * is in the range 0-255), which is used by routing protocols. CEF for PFC2/PFC3A supports 225.0.0.* through 239.0.0.* and 224.128.0.* through 239.128.0.*.


Note Groups in the 224.0.0.* range are reserved for routing control packets and must be flooded to all forwarding ports of the VLAN. These addresses map to the multicast MAC address range 01-00-5E-00-00-xx, where xx is in the range 0-0xFF.


For PIM auto-RP multicast groups (IP multicast group addresses 224.0.1.39 and 224.0.1.40).


Note In systems with redundant MSFC2s/MSFC3s, the PIM interface configuration must be the same on both the active and the redundant MSFC2/MSFC3.


If the shortest-path tree (SPT) bit for the flow is cleared when running PIM sparse mode for the interface or group.

For fragmented IP packets and packets with IP options. However, packets in the flow that are not fragmented or that do not specify IP options are multilayer switched.

For source traffic that is received on tunnel interfaces (such as MBONE traffic).

For any RPF interface with multicast tag switching enabled.

Configuring CEF for PFC2/PFC3A on the Switch

These sections describe how to configure CEF for PFC2/PFC3A:

Displaying the Layer 3-Switching Entries on the Supervisor Engine

Configuring CEF on MSFC2/MSFC3

Specifying CEF Maximum Routes

Configuring IP Multicast on MSFC2/MSFC3

Displaying IP Multicast Information


Note For information on configuring routing on MSFC2/MSFC3, see Chapter 12, "Configuring InterVLAN Routing."


Displaying the Layer 3-Switching Entries on the Supervisor Engine

CEF for PFC2/PFC3A is permanently enabled on Supervisor Engine 2 with PFC2 and MSFC2 and on Supervisor Engine 720 with PFC3A and MSFC3. No configuration is required.

To display all the Layer 3-switching entries on the supervisor engine, perform this task:

Task
Command

Display Layer 3-switching information.

show mls entry [pbr-route] [cef] | [netflow-route] [qos]


This example shows how to display the Layer 3-switching entries:

Console> (enable) show mls entry 
Mod FIB-Type  Destination-IP  Destination-Mask NextHop-IP      Weight
--- --------- --------------- ---------------- --------------- ------
 15 receive   0.0.0.0         255.255.255.255
 15 receive   255.255.255.255 255.255.255.255
 15 receive   127.0.0.12      255.255.255.255
 16 receive   127.0.0.0       255.255.255.255
 16 receive   127.255.255.255 255.255.255.255
 15 resolved  127.0.0.11      255.255.255.255  127.0.0.11           1
 15 receive   21.2.0.4        255.255.255.255
 16 receive   21.0.0.0        255.255.255.255
 16 receive   21.255.255.255  255.255.255.255
 15 receive   44.0.0.1        255.255.255.255
 16 receive   44.0.0.0        255.255.255.255
 16 receive   44.255.255.255  255.255.255.255
 15 receive   42.0.0.1        255.255.255.255
 16 receive   42.0.0.0        255.255.255.255
 16 receive   42.255.255.255  255.255.255.255
 15 receive   43.0.0.99       255.255.255.255
 15 receive   43.0.0.0        255.255.255.255
 15 receive   43.255.255.255  255.255.255.255
 15 receive   192.20.20.20    255.255.255.255
 16 receive   21.2.0.5        255.255.255.255
 16 receive   42.0.0.20       255.255.255.255
 15 connected 43.0.0.0        255.0.0.0
 15 drop      224.0.0.0       240.0.0.0
 15 wildcard  0.0.0.0         0.0.0.0

Mod FIB-Type  Dest-IPX-net NextHop-IPX               Weight
--- --------- ------------ ------------------------- ------
 15 connected 21
 15 connected 44
 15 connected 42
 15 resolved  450          42.0050.3EA9.ABFD              1
 15 resolved  480          42.0050.3EA9.ABFD              1
 15 wildcard  0

Destination-IP  Source-IP       Prot  DstPrt SrcPrt Destination-Mac   Vlan EDst Stat-Pkts  
Stat-Bytes  Uptime   Age      TcpDltSeq TcpDltAck
--------------- --------------- ----- ------ ------ ----------------- ---- ---- ---------- 
----------- -------- -------- --------- ---------
0.0.0.5         0.0.0.5         5     204    104    cc-cc-cc-cc-cc-cc 5    ARPA 0          
0           01:03:18 01:00:51 cccccccc  cccccccc
0.0.0.2         0.0.0.2         2     201    101    cc-cc-cc-cc-cc-cc 2    ARPA 0          
0           01:03:21 01:00:51 cccccccc  cccccccc
0.0.0.4         0.0.0.4         4     203    X      cc-cc-cc-cc-cc-cc 4    ARPA 0          
0           01:03:19 01:00:51 cccccccc  cccccccc
0.0.0.1         0.0.0.1         ICMP  200    100    cc-cc-cc-cc-cc-cc 1    ARPA 0          
0           01:03:25 01:00:52 cccccccc  cccccccc
0.0.0.3         0.0.0.3         3     202    102    cc-cc-cc-cc-cc-cc 3    ARPA 0          
0           01:03:20 01:00:52 cccccccc  cccccccc
0.0.0.6         0.0.0.6         TCP   205    105    cc-cc-cc-cc-cc-cc 6    ARPA 0          
0           01:03:18 01:00:52 cccccccc  cccccccc
Console> (enable)

Enter the show mls entry cef command to display only the FIB entries. Enter the show mls entry netflow-route command to display only the entries from the TCP intercept feature and reflexive access control lists (ACLs). Enter the show mls entry pbr-route command to display only the PBR entries. Enter the show mls entry qos command to display only the QoS entries.

Configuring CEF on MSFC2/MSFC3

CEF is permanently enabled on MSFC2/MSFC3. No configuration is required to support CEF for PFC2/PFC3A.


Note The ip load-sharing per-packet, ip cef accounting per-prefix, and ip cef accounting non-recursive Cisco IOS CEF commands on MSFC2/MSFC3 apply only to traffic that is switched by CEF on MSFC/MSFC3. The commands do not affect traffic that is switched by CEF for PFC2/PFC3A on the supervisor engine.


Specifying CEF Maximum Routes


Note This feature is only available with Supervisor Engine 720.


To specify the maximum number of routes that can be programmed in the FIB TCAM for a protocol, use the set mls cef maximum-routes {ip | ip-multicast} routes command. The syntax is as follows:

ip—Specifies IP MLS.

ip-multicast—Specifies IP multicasting MLS.

routes—Specifies the number of routes that can be programmed in the FIB TCAM.

Follow these guidelines when specifying the maximum number of routes that can be programmed in the FIB TCAM:

Routes that exceed the specified number of routes are not installed in the hardware. Packets that take those routes are switched by the MSFC. The routes argument is a unit of 1,000 entries. Setting the routes argument to 0 returns the system to a system-determined default value.

When no protocols are set, an initial default value is assigned for each protocol. When at least one protocol is set, the default value for other unassigned protocols might change as the system tries to assign the remaining space to the unassigned protocols.

This command has the following characteristics:

Changing the setting takes effect only after rebooting the active supervisor engine. The change does not take effect after a switchover.

The setting on the standby supervisor engine is synchronized with the active supervisor engine. If the standby supervisor engine is inserted, both the bootup setting and new setting, if existing, on the active supervisor engine are synchronized with the standby supervisor engine. The standby supervisor engine uses the bootup setting to configure the FIB TCAM. The standby supervisor engine might need to be reset if its original bootup setting is different from the bootup setting of the active supervisor engine. An informational message (FIB_MAXROUTES_RESET) is printed on the active supervisor engine console if this situation occurs.

To maximize the TCAM utilization, we recommend that you set the maximum routes for IP unicast as a multiple of 16,000 and set the maximum routes for IP multicast as a multiple of 8,000. The internal allocation scheme uses 16,000 as the allocation unit for unicast and 8,000 as the allocation unit for multicast. For example, if IP unicast is set to 1,000, 16,000 entries are reserved, but only 1,000 is allowed.

When the maximum routes are exceeded or the allocated TCAM space for a protocol is full, a system message (FIB_ALLOC_TCAM_FULL) displays. Because of the internal software allocation scheme, the allocated TCAM space might be full before the maximum routes are exceeded.


Note The sum of the number of maximum routes for all protocols cannot exceed 256,000.



Note If the routes values for all protocols are set to 0, the bootup default is used. When you set the routes value for one protocol to a non-zero value, the default value for the other protocol changes to the remaining size.



Note If the maximum number of routes is not set for an MLS protocol, a system-determined default value is shown. The default value for a protocol might not be fixed, as the system tries to assign the remaining space to the unassigned protocols. If the maximum-routes configuration is changed after bootup, the show mls cef maximum-routes command displays two kinds of information: one for the current (bootup) configuration and the other for the new configuration that takes effect after reboot.


To specify the maximum number of routes that can be programmed in the FIB TCAM for a protocol, perform these tasks in privileged mode:

Task
Command

Specify the maximum number of routes that can be programmed in the FIB TCAM for a protocol.

set mls cef maximum-routes {ip | ip-multicast} routes

Display the maximum number of routes that are configured for each MLS protocol.

show mls cef maximum-routes


This example shows how to specify the maximum number of routes for IP unicast:

Console> (enable) set mls cef maximum-routes ip 220
Configuration change will take effect after next reboot.
Console> (enable) show mls cef maximum-routes
Current:
    IPv4           :192k (default)
    IPv4 multicast : 32k (default)
User configured:(effective after reboot)
    IPv4           :220k
    IPv4 multicast : 16k (adjusted default)
Console> (enable)

Configuring IP Multicast on MSFC2/MSFC3

These sections describe how to configure MSFC2/MSFC3 for IP multicast:

Enabling IP Multicast Routing Globally

Enabling IP PIM on an MSFC2/MSFC3 Interface

Configuring the IP MMLS Global Threshold

Enabling IP MMLS on MSFC2/MSFC3 Interfaces


Note This section describes how to enable IP multicast routing on MSFC2/MSFC3. For more detailed IP multicast configuration information, refer to the "IP Multicast" section of the Cisco IOS IP and IP Routing Configuration Guide at this URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/ip_c/ipcprt3/index.htm


Enabling IP Multicast Routing Globally

You must enable IP multicast routing globally on MSFC2/MSFC3 before you can enable PIM on MSFC2/MSFC3 interfaces.

To enable IP multicast routing globally on MSFC2/MSFC3, perform this task in global configuration mode:

Task
Command

Enable IP multicast routing globally.

Router(config)# ip multicast-routing


This example shows how to enable IP multicast routing globally:

Router(config)# ip multicast-routing
Router(config)# 

Enabling IP PIM on an MSFC2/MSFC3 Interface

You must enable PIM on MSFC2/MSFC3 interfaces before IP multicast will function on those interfaces.

To enable IP PIM on an MSFC2/MSFC3 interface, perform this task in interface configuration mode:

Task
Command

Enable IP PIM on an MSFC2/MSFC3 interface.

Router(config-if)# ip pim {dense-mode | sparse-mode | sparse-dense-mode}


This example shows how to enable PIM on an MSFC2/MSFC3 interface using the default mode (sparse-dense-mode):

Router(config-if)# ip pim
Router(config-if)# 

This example shows how to enable PIM sparse mode on an MSFC2/MSFC3 interface:

Router(config-if)# ip pim sparse-mode
Router(config-if)# 

Configuring the IP MMLS Global Threshold

You can configure a global multicast rate threshold, specified in packets per second, below which all multicast traffic is routed by MSFC2/MSFC3. This prevents creation of MLS entries for short-lived multicast flows, such as join requests.


Note This command does not affect flows that are already being routed. To apply the threshold to existing routes, clear the route and let it reestablish.


To configure the IP MMLS threshold, perform this task:

Task
Command

Configure the IP MMLS threshold.

Router(config)# [no] mls ip multicast threshold ppsec


This example shows how to configure the IP MMLS threshold to 10 packets per second:

Router(config)# mls ip multicast threshold 10 
Router(config)# 

Use the no keyword to deconfigure the threshold.

Enabling IP MMLS on MSFC2/MSFC3 Interfaces

IP MMLS is enabled by default on the MSFC2/MSFC3 interface when you enable IP PIM on the interface. Perform this task only if you disabled IP MMLS on the interface and you want to reenable it.


Note You must enable IP PIM on all participating MSFC2/MSFC3 interfaces before IP MMLS will function. For information on configuring IP PIM on MSFC2/MSFC3 interfaces, see the "Enabling IP PIM on an MSFC2