Access Control Lists (ACL) on network devices can be implemented both in hardware and software, or more commonly referred to as hardware-based and software-based ACLs. While software-based ACLs are rules stored and processed in RAM (i.e., on the Control Plane), with all the associated limitations, we will explore how hardware-based ACLs are implemented and function in this article. As an example, we will use the ExtremeSwitching switches from Extreme Networks.
Since we are specifically interested in hardware-based ACLs, the internal implementation of the Data Plane, or the chipsets (ASICs) used, is of primary importance to us. All series of switches from Extreme Networks are built on Broadcom ASICs, and therefore most of the information provided below will also apply to other switches available on the market that utilize similar ASICs.
As seen in the diagram above, the operation of the ACL within the chipset is managed by the 'Content-Aware Engine', separately for 'ingress' and 'egress'. Architecturally, they are the same, with 'egress' being less scalable and functional. Physically, both 'Content-Aware Engines' comprise TCAM memory plus associated logic, and each user or system ACL rule is a simple bit mask recorded in this memory. This is why the chipset processes traffic packet-by-packet without performance degradation.
Physically, the same Ingress/Egress TCAM is logically divided into several segments (depending on the amount of memory and the platform), known as 'ACL slices'. For example, the same occurs with a physically single HDD on your laptop when you create multiple logical drives – C: and D:. Each ACL slice consists of memory cells in the form of 'rows' where the 'rules' (rules/bit masks) are recorded.
The division of TCAM into ACL slices has a specific logic behind it. Each separate ACL slice can only contain 'rules' that are compatible with each other. If a 'rule' is incompatible with the previous one, it will be written into the next ACL slice, regardless of how many free rows for 'rules' are left in the previous one.
Where does this compatibility or incompatibility of ACL rules come from? The fact is that one “line” of the TCAM, where “rules” are written, is 232 bits long and is divided into several fields – Fixed, Field1, Field2, Field3. 232 bits or 29 bytes of TCAM memory is quite sufficient to record a bit-mask of a specific MAC or IP address but is significantly less than the full Ethernet packet header. In each individual ACL slice, the ASIC performs an independent lookup based on the established bit-mask in F1-F3. Overall, this lookup can be performed on the first 128 bytes of the Ethernet header. In fact, it’s due to the ability to search through 128 bytes while only 29 bytes can be recorded that a proper lookup requires an offset relative to the start of the packet. The offset for each ACL slice is set when the first rule is written to it, and if a subsequent rule is written that requires a different offset, that rule is deemed incompatible with the first and is written into the next ACL slice.
The table below outlines the compatibility of conditions specified in ACL. Each individual row contains compatible items among themselves and incompatible items with other rows forming a bit-mask.
Each individual packet processed by the ASIC initiates a parallel lookup in each ACL slice. The check is performed until the first match is found in the ACL slice, but multiple matches for the same packet in different ACL slices are allowed. Each individual “rule” has a corresponding action that needs to be performed in case of a condition match (bit-mask). If a match occurs in several ACL slices, the decision on which action to perform is made in the “Action Conflict Resolution” block based on the priority of the ACL slice. If both “action” (permit/deny) and “action-modifier” (count/QoS/log/…) are specified in the ACL, then in case of multiple matches, only the higher-priority “action” will be executed, while all “action-modifiers” will be executed as well. The example below shows that both counters will be increased and the higher-priority “deny” will be executed.
with more detailed information on ACL operations available publicly on the website . Any questions that arise or remain can always be directed to our office staff – .
Source: habr.com
