46.3 DirectFlow Feature Interactions
DirectFlow flow entries can have one of the following actions:
• A set of egress ports for sending a matched packet
• Copy to CPU
• Redirect to CPU
• Drop (default)
• No specified action (in this case, the traffic is output normally).
The only exception is the ingress or egress mirroring action, where the DirectFlow entry causes the packet to be mirrored.
When the ingress or egress packets are mirrored, the original traffic is sent out normally.
• DirectFlow entries have precedence over all entries in the MAC table, including static MAC entries and static MAC drop entries. Packets that do not match DirectFlow entries are forwarded based on the MAC address table.
• VLANs: DirectFlow entries can modify the VLAN of a packet. MAC learning takes place in the original VLAN for DirectFlow entries that modify the VLAN. The modified packet will be subject to VLAN membership checks on the egress port. If a packet has no VLAN tag, DirectFlow assumes it came in on the native VLAN for the ingress interface. A VLAN override causes the packet to obey the VLAN rules on the egress port.
• Q-in-Q: Q-in-Q is supported as DirectFlow entries match only on the outer tag.
• Counters: All packets that match DirectFlow entries cause interface counters to increment as usual.
DirectFlow runs alongside MSTP, RSTP, and PVST. DirectFlow entries do not match on packets that ingress an STP discarding port. DirectFlow entries that cause a packet to be forwarded out an STP discarding port will result in the packets being dropped on egress.
When STP is enabled, BPDUs will always be trapped to the CPU. When STP is disabled, BPDUs will be subject to DirectFlow entries and not be copied to the CPU by default.
LLDP, LAGs, and LACP
• LLDP packets are always trapped to the CPU. DirectFlow entries can never match LLDP packets.
• LAGs are fully supported, and can be part of a match criteria and part of an output action to an interface.
• LACP packets are always trapped to CPU. DirectFlow entries can never match LACP packets.
sFlow is unaffected by DirectFlow.
IGMP control packets are trapped to the CPU when IGMP Snooping is enabled. DirectFlow entries can match IGMP Snooping control traffic and override the trap to CPU.
Link-local-multicast packets are flooded in hardware in the VLAN via a TCAM entry. DirectFlow entries can match link-local-multicast packets and change the flooding behavior. As DirectFlow entries have to specify output interfaces or drop, the action will conflict and so matching DirectFlow entries will get precedence.
When IGMP snooping is enabled, unknown IPV4 multicast packets are flooded to the multicast-router ports in the VLAN. If DirectFlow entries match unknown IPV4 multicast packets, they will override the flooding behavior.
Data packets in groups under IGMP snooping control are sent to the group members through a MAC table entry. Matching DirectFlow entries override the MAC table entries.
DirectFlow entries are lower priority than any configured Port ACLs (ingress). Packets coming in on a port that match DirectFlow entries obey any configured ACL on that port, and will only apply to packets that have a permit action.
DirectFlow entries are higher priority than any configured RACLs. Packets coming in on an L3 interface that match DirectFlow entries ignore any RACLs configured on that interface.
DirectFlow entries are lower priority than any configured Egress ACLs.
46.3.1 Layer Three Features and DirectFlow
DirectFlow runs alongside IP routing. If a packet is routed out a layer three interface using a DirectFlow entry, the actions associated with the entry will have to specify the new source MAC and destination MAC for the packet, as well as the physical port or LAG. If there are no output ports specified in an entry, packets that match that entry will be dropped.
When unicast routing is enabled, DirectFlow entries that match take precedence for all packets that would have been otherwise been routed. The three exceptions are the ingress mirror, egress mirror and copy-to-CPU actions where the packets will be routed normally in addition to the action being performed. Routed packets that do not match DirectFlow entries are forwarding based on the L3 lookup.
When multicast routing is enabled, DirectFlow entries that match take precedence for all packets that would have otherwise been multicast routed. The packets are not replicated based on the hardware multicast tables, but are forwarded strictly according to the actions specified by the DirectFlow entry. The entry can specify a set of output interfaces, which will result in the packet being replicated based on the DirectFlow entry.
46.3.2 Displaying DirectFlow Configurations
To show directflow flows
command displays the contents of the flow table, showing each entry with its match rules, actions, and packet counters.
• This example shows the status of a default (persistent) flow.
switch(config-directflow)#show directflow flows
ingress interface: Ethernet1
source ip address: 10.10.10.10
output mirror: Ethernet2
matched: 0 packets, 0 bytes
• This example shows the status of a non-persistent flow. The flow will be deleted once 5 minutes have elapsed.
switch(config-directflow)#show directflow flows example-non-persistent
hard timeout: 300
idle timeout: 0
matched: 0 packets, 0 bytes