29. Layer 3 Switching
ROX™ v2.2 User Guide
291
RuggedBackbone™ RX5000
29.1.6. Layer 3 Multicast Switching
Some RuggedCom Layer 3 Switch models do not have full multicast Layer 3 switching capability and
only support multicast cross-VLAN Layer 2 switching. Multicast cross-VLAN Layer 2 switching differs
from the normal multicast Layer 3 switching in the following ways:
• Packet modification is not done. That is, the source MAC address and TTL values in forwarded
packets do not change. This should not be a problem in most cases, but it should be taken into
consideration.
• Cross-VLAN Layer 2 switching is less efficient in ASIC resource utilization and packet latency.
• Separate TCAM table entries are required for each egress VLAN in the multicast switching rule. For
example, a multicast stream ingressing VLAN 1 and egressing VLAN 2 and VLAN 3 requires two
TCAM table entries: one for VLAN 2 and one for VLAN 3.
• Supported bandwidth depends on the rule. Multicast traffic potentially has multiple egress VLANs,
and the total utilized ASIC bandwidth is the ingress bandwidth multiplied by the number of ingress and
egress VLANs. For example, a 256Mbps multicast stream ingressing VLAN 1 and egressing VLANs
2 and 3 requires 768Mbps (256Mbps × 3) of ASIC bandwidth.
• If a multicast packet should be forwarded to multiple egress VLANs, it egresses those VLANs
sequentially rather than concurrently. This means that the packet will experience different latency for
each egress VLAN.
29.1.7. Size of the Layer 3 Switch Forwarding Table
The routing table in a software router is limited only by the amount of available memory; its size can be
virtually unlimited. However, the size of the TCAM in Layer 3 switching ASICs is significantly limited and
may not be sufficient to accommodate all Layer 3 switching rules. If the TCAM is full and a new static
rule is created, the new rule replaces some dynamically learned rule. If all of the rules in the TCAM are
static, then the new static rule is rejected.
29.1.8. Interaction with the Firewall
If security is a concern and you use a firewall in a Layer 3 Switch, it is important to understand how the
Layer 3 switch interacts with the firewall.
A software router always works in agreement with a firewall so that firewall rules are always applied.
However, in a Layer 3 Switch, if a switching rule is set in the switching ASIC (for example, due to a
statically configured route), the ASIC switches all the traffic matching the rule before the firewall inspects
the traffic.
Layer 3 switch ASICs are somewhat limited in how switching rules can be defined. These limitations do
not allow configuring arbitrary firewall rules directly in the Layer 3 switch hardware. For sophisticated
firewall rules, the firewall has to be implemented in software and the Layer 3 Switch must not switch
traffic that is subject to firewall processing.
Whenever a change is made to the firewall configuration, some of the dynamically learned Layer
3 switching rules might “conflict” with the new firewall configuration. To resolve potential conflicts,
dynamically learned Layer 3 switching rules are flushed upon any changes to the firewall configuration.
The dynamically learned Layer 3 switching rules then have to be re-learned while the new firewall rules
are applied.
For statically configured Layer 3 switching rules, take care to avoid conflicts between Layer 3 switching
and the firewall. It should be understood that static Layer 3 switching rules always take precedence.
Therefore, you must thoroughly examine the switch configuration for potential conflicts with the firewall.
