5: Monitoring and filtering
Layer-2 Protocol Tunneling
73
•
yy: the protocol ID. This is automatically generated according to which Layer-2 control
protocol the rule handles.
Operation mode
This controls how the rule will handle the traffic associated with the specified protocol. Four
modes of operation are available:
•
Drop:
frames matching the specific rule are dropped.
•
Forwarding:
frames are sent unaltered to and from the specified ports (both ways).
•
Tunneling:
frames matching the specific rule get their destination MAC address replaced
by the MAC specified in the rule's parameters when ingressing the specified client port.
Frames matching the specific rule get their original destination MAC address put back
when ingressing the specified network port.
•
Peering:
the frames are sent to software layers for further processing.
Incoming port
This allows the incoming port used by the rule to be selected. The incoming port is considered
to be the port where the layer-2 control protocols will ingress.
Outgoing port
This allows the outgoing port used by the rule to be selected. The outgoing port is considered
to be the port where the tunneled frames, containing a replacement destination MAC, will
egress.
Unique ID
This is used to uniquely identify a rule when performing tunneling. As described in the
Replacement MAC section above, this value is used when building the replacement
destination MAC address. Note that the same value has to be used on both sides when
creating a tunnel-detunnel set of rules between a pair of units.
VLAN1 ethertype
Allows selecting the ethertype of the first tag inserted in the tunneled frame. This is available
only when the Tunneling operation mode is selected.
VLAN2 ethertype
Allows selecting the ethertype of the second tag inserted in the tunneled frame (for Q-in-Q).
This is available only when the Tunneling operation mode is selected.
VLAN list
This specifies which VLAN tags to insert in the tunneled frames. The format is a list of
comma-separated groups formatted as vlan1:vlan2. The second tag (Q-in-Q) entry is optional.
For example, if we wanted to single-tag tunneled frames with VLAN ID 3, and double-tag
frames with VLAN IDs 5-6 and 22-88, we would specify: 3, 5:6, 22:88.
Note that the frames are duplicated for each entry in the VLAN list. In the example above, 3
frames would egress the network port for each ingressing frame, matching the rule, on the
client port.
Also note that there should be at least one entry in the list, as tunneling untagged frames is
currently not supported.
The VLAN list is available only when the Tunneling operation mode is selected.
