Posted on May 17, 2021 3:37 am
 |  Asked by Waleed Alsaeed
 |  165 views
0
0
Print Friendly, PDF & Email

Greetings,

I’m using 7504R switch as tap aggregation mode, and want to steer/filter the traffic from tap ports to a tool ports based on source and destination IP addresses.

As the list has more than 400+ subnets (example below), steering or filtering the traffic using policy-map or class-map within a policy-map, requires applying 20,000+ rule:
1- source: 10.10.10.0/24, destination: 172.10.20.0/24 or 172.20.20.0/24 or 172.30.20.0/24 or 172.110.20.0/24
2- source: 10.20.10.0/24, destination: 172.10.20.0/24 or 172.20.20.0/24 or 172.30.20.0/24 or 172.110.20.0/24
3- source: 10.30.10.0/24, destination: 172.10.20.0/24 or 172.20.20.0/24 or 172.30.20.0/24 or 172.110.20.0/24
4- source: 172.10.20.0/24, destination: 10.10.10.0/24 or 10.20.10.0/24 or 10.30.10.0/24
5- source: 172.20.20.0/24, destination: 10.10.10.0/24 or 10.20.10.0/24 or 10.30.10.0/24
6- source: 172.30.20.0/24, destination: 10.10.10.0/24 or 10.20.10.0/24 or 10.30.10.0/24
7- source: 172.110.20.0/24, destination: 10.10.10.0/24 or 10.20.10.0/24 or 10.30.10.0/24

As egress ACL is not compatible with 7504R switches in tap aggregation mode, I’m wondering if is there a way to steer the traffic on the tap interface then filter it in the tool interface or have a two layer of steering and filtering in the same policy-map.

Note: I was able to do it in 7150 switch, by apply steering rules in policy-map on the tap port then the ACL in the tool port.

Thanks in advance,
Waleed

0
Posted by Alexis Dacquay
Answered on October 18, 2021 7:04 pm

Waleed,
The R-series does support egress ACL since 4.22. What version are you running currently?

Meanwhile...
Is it possible to narrow down to the most interesting, or is 20,000 combinations really the MINORITY you find the most interesting?
What I mean is that generally the "interesting traffic" is a small portion of the traffic, and the rest goes to a default group.

You can play with the ACL mask to combine multiple addresses in a single entry.
For example 10.10.10.0/24 and 10.10.11.0/24 can be summarized as 10.10.10.0/23
If the subnets are discontinuous, I am afraid to say the addressing was designed without consideration for how the hardware works (TCAM).

Are you interested in everything "IP" from these subnets, or some specific ports that could help you narrow down?

How much throughput does all these 20,000 combinations represent? 10Gbps, 100Gbps, 1Tbps? More?
If it's not too much then you could create a loop:
TOOL ==> back to the switch. The there apply your tap 2nd layer of filtering like you do today on the 7150.

But all that would be simply resolved by an upgrade to a recent EOS version.

Post your Answer

You must be logged in to post an answer.