Tag :: EOS 4.25.1F

The primary challenge with using a switching ASIC as a load balancer has been how to deal with changes in the network topology without disrupting existing TCP connections.

The following table describes the advanced mirroring features that are currently supported with links to their respective TOIs.

This feature adds support for user-configured BGP Nexthop Resolution RIB profiles for various BGP-based services e.g. IP unicast, L3 VPN, EVPN, etc. The feature allows an administrator to customize the next hop resolution semantics of BGP routes with an ordered list, or profile, of resolution RIB domains (i.e., either tunnel or IP domain). This allows EOS to direct specific services over the specified RIB domains, overriding the default behavior.

BGP Non Stop Forwarding (NSF) aims to minimize the traffic loss when the the following scenarios occur:

RPKI provides a mechanism to validate the originating AS of an advertised prefix. Using the result of the validation to apply inbound policy in a route map.

This feature supports counting ECN-marked packets (ECN = Explicit Congestion Notification) on a per egress port per tx-queue basis. The feature can be used to gather these packet counts via CLI or SNMP.

Egress traffic-policing can be applied on L3 Ethernet subinterfaces for outbound traffic.

EOS-4.24.0 adds support for hardware-accelerated sFlow on R3 systems. Without hardware acceleration, all sFlow processing is done in software, which means performance is heavily dependent on the capabilities of the host CPU. Aggressive sampling rates also decrease the amount of processing time available for other EOS applications.

The document describes the support for dedicated and group ingress policing on interfaces without using QoS policy-maps to match on the traffic and apply policing.

IP Locking is an EOS feature configured on an Ethernet Layer 2 port or on a VLAN. When enabled, it ensures that a configured port or all member ports of a configured VLAN will only permit IP and ARP packets with IP source addresses that have been authorized. IP Locking prevents another host on a different IP Locking enabled interface from claiming ownership of an IP address through either IP or ARP spoofing. Additionally, IP Locking prevents hosts from masquerading as a DHCP server by blocking DHCP (server-to-client) packets.

Subinterfaces divide a single ethernet or port channel interface into multiple logical L3 interfaces based on the 802.1q tag (VLAN ID) of incoming traffic. Subinterfaces are commonly used in the L2/L3 boundary device, but they can also be used to isolate traffic with 802.1q tags between L3 peers by assigning each subinterface to a different VRF. L3 subinterface shaping + VRF is also supported.

Introduced in EOS-4.20.1F, “selectable hashing fields” feature controls whether a certain header’s field is used in the hash calculation for LAG and ECMP.

MRU (maximum receive unit) enforcement provides the ability to drop frames that exceed a configured threshold on the ingress interface.

E-Tree is an L2 EVPN service (defined in RFC8317) in which each attachment circuit (AC) is assigned the role of Root or Leaf. Root ACs can communicate with leaf ACs and other root ACs. Leaf ACs can only communicate with root ACs. Leaf AC to leaf AC traffic is blocked. In this implementation, ACs are configured at the VLAN level, and the forwarding rules are enforced using a combination of local configuration of leaf VLANs (for local hosts), and asymmetric route targets (for remote hosts).

This feature provides isolation and allows segregating/dividing the link state database based on interface. 

ITU-T G8275.1 is a PTP profile defined by ITU-T for telecommunication applications. It defines a set of functions from the IEEE 1588 to achieve phase/time synchronization with full timing support from the network (meaning, all of the network devices support PTP).

RSVP-TE, the Resource Reservation Protocol (RSVP) for Traffic Engineering (TE), is used to distribute MPLS labels for steering traffic and reserving bandwidth. The Label Edge Router (LER) feature implements the headend functionality, i.e., RSVP-TE tunnels can originate at an LER which can steer traffic into the tunnel.

Subinterfaces divide a single ethernet or port channel interface into multiple logical L2 or L3 interfaces based on the 802.1q or 802.1ad tags of incoming traffic. Subinterfaces are commonly used in the L2/L3 boundary device, but they can also be used to isolate traffic with 802.1q tags between L3 peers by assigning subinterfaces to different VRFs or different L2 bridging domains.

IPv4 Unicast Reverse Path Forwarding (uRPF) can help limit malicious IPv4 traffic on a network. uRPF works by enabling the router to verify reachability (routing) of the source IP address (SIP) in the packet being forwarded. If the SIP is determined to not be a valid address, the packet is dropped.

Multicast NAT is a feature that performs NAT translations on multicast traffic. It can be configured under SVIs,

ARP and IPv6 Neighbor Discovery use a neighbor cache to store neighbor address resolutions. The capacity of the neighbor cache is determined by the resources and capabilities of the device platform. The neighbor cache capacity feature adds a means to specify a per-interface capacity for the neighbor cache. A neighboring device, through misconfiguration or maliciousness, can unfairly use a large number of address resolutions. This feature can help to mitigate this over-utilization.

This document describes the OSPFv2 feature that allows the setting of “Down” (DN) bit in type-5 and type-7 LSAs. The DN Bit is a loop prevention mechanism implemented when OSPF is used as CE - PE IGP protocol. Its usage in OSPF is explained by RFC4576. By default, OSPF honors the DN-bit in type-3, type-5 or type-7 LSAs in non-default VRFs.