Allied Telesis x900-24 series manuale d’uso

C613-16058-00 REV C www .alliedtelesis.com AlliedW ar e TM OS How T o | Intr oduction The A T -9900, x900-48, and x 900-24 series switches supp or t a po werful har dware based pack et-filtering facility . These switches can filter on a range of La yer 2, La y er 3 , and La y er 4 pac k et attributes, and perform a variety of differ ent actions on [...]

Page 2 | AlliedW are™ OS How T o Note: Har dware Filters Intr oduction What information will y ou find in this document? This document contains the following: Intr oduction .......... .............................................................................. .......................... ............................ 1 Which pr oducts and softwar[...]

Page 3 | AlliedW are™ OS How T o Note: Hardwar e Filters Cre ating dedicated har dware filte rs Cr eating dedicated hardwar e filters Befor e we get into the details of the filter creation, w e need to lo ok at the underlying pack et classification process. Configuring pack et classification Dedicated hardwar e filters and QoS use th e same packe[...]

Page 4 | AlliedW are™ OS How T o Note: Hardwar e Filters Cre ating dedicated har dware filte rs Configuring La y er 4 sour ce and destination por t number masks A common filtering re qui r ement is the ability to filter on a range of TCP or UDP port numbers. For example, we often want to be able to allow thr ough all packets with a TCP destinatio[...]

Page 5 | AlliedW are™ OS How T o Note: Hardwar e Filters Cre ating dedicated har dware filte rs z When pack ets arrive at a customer port of a nested VLAN, the “i nner” parameters will match the attributes of the first tag in the packets. This is because when the pack et is forwar ded from the cor e por t, that first tag wi ll ha v e become t[...]

Page 6 | AlliedW are™ OS How T o Note: Hardwar e Filters Cre ating dedicated har dware filte rs The logic of the operation of the hardwar e filters The operation of the filters follows the standar d A CL log ic: if a pack et matches an filter , the comparison pr ocess stops and the action attached to the filter is performed. If a pack et fails to[...]

Page 7 | AlliedW are™ OS How T o Note: Hardwar e Filters Combining har dware filters and QoS Combining har dware filters and QoS The switch compar es the pack et with ev er y hard ware filter befor e it compares the pack et with any QoS flow group . If the pa ck et matches a hardware filter , the switch takes the action specified by that hardwar [...]

Page 8 | AlliedW are™ OS How T o Note: Hardwar e Filters Ho w many filters can you cr eate? Extra rules used when combin ing QoS and hardwar e filters In fact, QoS can cause the limit o n t he n u m be r o f ha r d wa r e f i l t e rs t o b e re d uc e d r a th e r m o re radically than might be initially evident. T o see wh y this is, we ha ve t[...]

Page 9 | AlliedW are™ OS How T o Note: Hardwar e Filters Ho w many filters can you cr eate? The following figur e shows the copies of these rules. When a QoS policy has been applied to ports 4 and 5, all the hardw are filter rules h av e to be r eplicated fur ther down in the rule table, and the QoS-specific rules added to the table belo w this c[...]

Page 10 | AlliedW are™ OS How T o Note: Hardwar e Filters Ho w many filters can you cr eate? Pr oto col type—2 b ytes Ethernet format—2 bytes VLAN ID—2 bytes IP pr otocol type (TCP , UDP , etc)— 1 byte sour ce IP address—4 bytes destination IP address—4 bytes TCP por t numbe r—2 by tes UDP por t numb er—2 by tes DSCP— 1 byte For[...]

Page 11 | AlliedW are™ OS How T o Note: Hardwar e Filters Ho w many filters can you cr eate? Oka y length For example, this set of filters would w ork: sour ce MAC ad dress source UDP port destination IP addr ess + destination TCP por t The total number of b ytes for the swit ch to check in a pack et would be: sour ce MA C address + IP pr otocol [...]

Page 12 | AlliedW are™ OS How T o Note: Hardwar e Filters Ho w many filters can you cr eate? How to see the cur rent filter r esource usage on the s witch The sho w switch command outp uts a number of counters that display the cur rent usage of filtering r esources. A typical output fr om th is command, and a discussion of each of the values it o[...]

Page 13 | AlliedW are™ OS How T o Note: Hardwar e Filters Appendix A: How to use the la yer 4 mask in classifiers Appendix A: How to use the la y er 4 mask in classifiers This section describes the use of L4 mask in classifiers and gives some examples on L4 masks. The wa y that L4 masks work is simila r to IP subnet masks. Y ou need to be familia[...]

Page 14 | AlliedW are™ OS How T o Note: Hardwar e Filters Appendix A: How to use the la yer 4 mask in classifiers Example 1 : por ts 2000-2003 Let’ s say w e want to ha ve a UDP port range of 2000-2003, then the mask we need to h av e is: The changed bits from 2000-2003 ar e bolded. W e must now write a L4 mask which will meet these requir emen[...]

Page 15 | AlliedW are™ OS How T o Note: Hardwar e Filters Appendix A: How to use the la yer 4 mask in classifiers Example 2: por ts 5004-5008 In some more complex situations, w e ma y need more than one classifier to cov er all the range w e want to . Let’ s tak e UDP destination ports between 5004 -5008 According to the bolded bits, w e ma y t[...]

Page 16 | AlliedW are™ OS How T o Note: Hardwar e Filters Appendix A: How to use the la yer 4 mask in classifiers So our bi ggest block fi ts into the range 5 1 2-767. The next second biggest block is 1 28 in our example … it should fit into 384-5 11 . With these 2 bloc ks, w e cover fr om 38 4-767. If w e k eep repeating the same pr ocedure fo[...]

Page 17 | AlliedW are™ OS How T o Note: Hardwar e Filters Appendix A: How to use the la yer 4 mask in classifiers The following table sho ws the por t ranges for the largest blocks. L4 mask: FC00 F800 F000 E000 C000 8000 0000 num ber o f por ts : 1 024 2048 4096 8 1 92 1 6384 32768 65536 0000000 1 024 2048 4096 8 1 92 1 6384 32768 65536 2048 4096[...]

USA Headq u ar ters | 19800 Nor th Cr eek Parkwa y | S u ite 200 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895 E u r opea n Headq u ar ters | Via Motta 24 | 6830 Chiasso | Switzerla n d | T : +41 91 69769.00 | F: +41 91 69769.11 Asia-Paci f ic Headq u ar ters | 11 T ai Se ng Li n k | Si ng apor e | 534182 | T: +65 6383 3832 |[...]