Cisco Catalyst Multilayer Switching – Protecting the Route Processor

As stated earlier in this chapter, when using CEF, the majority of packets are forwarded by the PFC, referencing the entries contained in the FIB, which is populated by the MSFC. However, there are certain exception packets, such as packets with IP options, that must be punted to the Route Processor (MSFC) for further processing.

While the PFC can forward up to 30 million packets per second (pps), the MSFC is typically capable of forwarding only up to 500,000 pps. This significant difference in the forwarding capabilities means that it is possible for the MSFC to be oversubscribed or overutilized if the PFC punts a large number of packets to it. This may result in the following:

• Routing protocols getting out of sync with the rest of the network. This may result in network flaps and major network-wide transitions;
• The console on the switch may lock up. This results in the switch becoming unreachable and unmanageable, leaving administrators no avenues to troubleshoot; or
• Other Route Processor (RP)-based processes may cease operation altogether. This may result in the switch running with unpredictable results, or crashing.

To prevent such situations, IOS software allows administrators to configure MLS rate limiters. Rate limiters throttle the pps rate of certain packets that are punted to the MSFC by the PFC, which effectively ensures that the MSFC is never overwhelmed by the much faster PFC, allowing the switch to continue normal operations. Because the rate limiting functionality is performed in hardware, MLS rate limiters are typically referred to as hardware rate limiters (HWRLs) in various texts. These terms are interchangeable. Cisco Catalyst 6500 series switches support the following two types of CEF rate limiters:

1. CEF Receive
2. CEF Glean

CEF Receive is used for interfaces that belong to the switch. CEF Receive rate limiters are used to limit packets destined to the RP for interfaces that belong to the switch itself. CEF Glean occurs when a directly connected host does not have an entry in the ARP table and the RP has to ARP for the next hop MAC. CEF Glean rate limiters are used to limit these types of packets.

Configuring CEF Rate Limiters

The Glean and Receive CEF rate limiters are configured using the mls rate-limit unicast cef global configuration command. The following output illustrates the two options available with this global configuration command:

In addition to CEF rate limiters, the Catalyst 6500 series PFC 3 also supports the following HWRLs:

• Ingress-Egress ACL Bridged Packets (Unicast Only)
• uRPF Check Failure
• TTL Failure
• ICMP Unreachable (Unicast Only)
• Layer 3 Security Features (Unicast Only)
• ICMP Redirect (Unicast Only)
• VACL Log (Unicast Only)
• MTU Failure
• Layer 2 PDU
• Layer 2 Protocol Tunneling
• IP Errors
• Layer 2 Multicast IGMP Snooping
• IPv4 Multicast
• IPv6 Multicast

The following output illustrates how to rate limit ICMP unreachable and redirect packets:

The following output illustrates how to configure rate limiters for ACLs on the switch:

The following output illustrates how to rate limit IP packets, IP features, and RPF failure checks:

NOTE: You are not expected to perform any MLS rate-limiting configuration; however, you should be familiar with the capability to rate limit various types of traffic when using MLS.