8-1. Multilayer Switching

Multilayer switching (MLS) performs Layer 3 switching by combining separate routing and switching functions on different switch modules.
MLS is supported on the Catalyst 6000 by the MSFC (route processor) and the PFC (Layer 3 switching engine). On the Catalyst 4000 and 5000 platforms, the route processor can be an external router.
MLS can perform Layer 3 switching for IP, IP multicast (also known as IP Multicast MLS or MMLS), and IPX traffic.
MLS operation consists of these steps:
- The route processor (RP) routs the first packet in a traffic flow.
- The switching engine (SE) sets up an MLS cache entry for the flow based on the first packet (a "candidate" packet).
- When the SE sees the return packet from the RP, the MLS cache entry is completed with source and destination information. For the duration of the traffic flow, subsequent packets are switched at the SE.
- When the SE switches flow packets, the SE also rewrites the source and destination MAC addresses, the IP time-to-live (TTL), and both Layer 2 and Layer 3 checksum values. This is done in hardware, as if a traditional router had forwarded the packets.
- The MLS cache entry for a flow is deleted when the connection is closed or after an aging timer expires.
MLS builds its flow cache based on the following:
- IP Destination address, source and destination addresses, or source and destination address and port numbers ("full flow")
- IP multicast Source address, source VLAN number, and destination multicast group
- IPX Destination address
MLS can report on traffic flow statistics through the use of NDE. Refer to section "8-3: NetFlow Data Export" for more information.
-2. Cisco Express Forwarding
Cisco Express Forwarding (CEF) handles all packet forwarding in hardware, for all packets in a flow.
CEF is implemented on the Catalyst 2948G-L3, 4908G-L3, 4000 Supervisor III, and 3550 series switches. It is also implemented on the Catalyst 6000 as a cooperation between the PFC2 Layer 3 switching engine and the MSFC2 route processor module.
A route processor runs routing protocols and populates the following tables:
- The normal routing table A table of routes and next-hop destinations as determined by the routing protocols, administrative distances, metrics, and so on.
- The Forwarding Information Base (FIB) Every known route is represented in the FIB as a hierarchical tree structure. Longest-match routes can then be quickly looked up in hardware, pointing to the next-hop entry in the adjacency table.
- The adjacency table Every next-hop router address and Address Resolution Protocol (ARP) reply that is discovered is entered into the adjacency table, giving an efficient Layer 3-to-Layer 2 forwarding lookup.
CEF supports high-performance switching of IP, IP multicast, and IPX traffic.
CEF can switch packets over up to six equal-cost paths to a common destination.
CEF can use Reverse Path Forwarding (RPF) to make sure packets arrive on interfaces that are the best return paths to the source. This can be used to detect forged or spoofed addresses in received packets, in the case of some malicious activity.
IP multicast traffic is switched by CEF only for multicast groups within 225.0.0.* through 239.0.0.* and 224.128.0.* through 239.128.0.*. CEF will not switch anything in 224.0.0.* because those addresses are reserved for routing protocols and must be flooded to all ports that are forwarding in a VLAN.
When the route processor creates the FIB, the FIB information is downloaded and used by the switching engine hardware. On a Catalyst 6000, the FIB is downloaded from the MSFC2 to the PFC2 module, as well as any distributed forwarding cards (DFCs) that are present.
In addition to the CEF tables, a NetFlow forwarding table (identical to that of MLS) is independently generated just to provide flow-based accounting information. This information can be exported to external applications. See section "8-3: NetFlow Data Export" for more information