Cisco Catalyst 6500 Supervisor 2T Architecture - Ipland

White PaperLayer 3 - Layer 2 + Layer 3 + Layer 4 ACLPFC3x provided support for Layer 2 or Layer 3/4 ACLs, but not both at the same time. With this new ACL type, PFC4allows both Layer 2, 3 and 4 information to be inspected at the same time. Especially useful in wireless networkswhere mobility can often change the user’s source IP address, the ACL could be built to inspect the source MACaddress along with other higher layer information (such as Layer 4 port information) to apply a Security policy.Layer 3 - Classification EnhancementsThe PFC4 engine offers several extensions to classification ACLs. As well as being able to match on the traditionalclassification options such as IP address, TCP/UDP ports, and others, the PFC4 also offers match on packet length,Time to Live (TTL), IP options, and IPv6 Extended Header. Some worms and other forms of attack sometimesrequire matching on these fields to make a positive ID.Layer 3 - Per Protocol Drop (IPv4, IPv6, MPLS)PFC4 adds support for the ability to only forward protocol traffic if enabled on the interface. The protocols that can bedefined at an interface level are IPv4, IPv6, and MPLS. Traffic not matching the defined protocol will be dropped.Layer 3 - Increase in ACL Label SupportAn ACL label is used to group access control entries (ACEs) that are associated with the same access control list.An access control list entry that starts with “access-list 101....” uses the label “101” to indicate which ACL group thisentry belongs to. Previously, the PFC3B/XL and PFC3C/XL supported a maximum of 4096 ACL labels. PFC4increases support for the number of ACL labels to 16 K.Layer 3 - Increase in ACL TCAM CapacityThe PFC4 forwarding engine implements two banks of TCAMs for classification purposes, providing a total of 256 Kaccess control entries for DFC4XL and 64 K for DFC4. These ACEs can be shared between the Security and QoSfor both ingress and egress lookups. There is also a corresponding increase in the mask to entry ratio. Thiscapability is discussed in more detail later in the paper. In summary, this allows for more efficient use of the TCAMspace when defining Security policies.Layer 3 - Source MAC + IP BindingA binding of IP address, VLAN, and MAC address can be made to facilitate the decision-making process forforwarding packets. This enforcement is performed by the PFC4 in hardware, and is especially useful in protectingagainst address spoofing. The IP source guard is an example of one feature that makes use of this capability.Layer 3 - Drop on Source MAC MissThis feature is another hardware enhancement that is used to further enhance the port Security feature. PortSecurity can be used to bind MAC addresses to a given port, ensuring that only packets with the defined MACaddress are forwarded.Layer 3 - RPF Check InterfacesThe Reverse Path Forwarding (RPF) check is used to help determine if a packet has been spoofed. It uses a reverselookup, whereby the source address is used to initiate the lookup. If the packet arrives on an interface where itssource address is not seen as existing out that interface, it is deemed a spoofed packet and will be dropped. With anRPF check, multiple paths can be incorporated into the lookup. Previous PFC3x engines supported 2 paths in theRPF lookup. PFC4 increases the number of paths included in the lookup to 16.Layer 3 - RPF Checks for IP Multicast PacketsRPF checks for IP Multicast packets were previously performed in software, and the correct RPF interface was thenprogrammed into the hardware forwarding entries. PFC4 allows full hardware-based RPF checks for IP Multicast.This capability also allows for dual RPF check, to support PIM sparse-mode shortest path tree (SPT) switchover tooccur in hardware.© 2011-2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Partner Confidential Information. Page 24 of 46