Egress ACL Rate Limiting Considerations

SLX 9540 and SLX 9640

Consider the following when you configure egress ACL rate limiting:

• Egress rate limit supports packets that are received at a physical port but transmitted on a different physical port. If the packets are received and transmitted on the same physical port, you should deploy ingress rate limit.
• If the multiple VLANs are on the same ingress port belonging to the same bridge domain and egress ACL rate limiting is configured to rate limit one of the VLANs, the traffic of all VLANs is rate limited. As a workaround, add a matching source or destination MAC address with the VLAN in the ACL.
• Ingress ACL rate limit and egress ACL rate limit do not work together on the same flow of traffic.
• To redirect traffic that requires egress rate limit to new sets of VOQ, the devices uses PMF and VOQ resources that limits the number of supported policies.
  • The following system scale numbers are based on the limitation of VOQ connector and PMF entries:

    Table 1. Scale numbers

    Device type	Maximum RL class per tower	Maximum RL class per system
    SLX 9540	2,000	2, 000

  • The PMF is configured to filter the certain types of Layer 2 or VPLS traffic and reroute them to the VOQs for egress rate limiting.

    Table 2. PMF filter keys

    Filter key	Description
    Port	Egress port of the Layer 2 packets.
    VLAN	VLAN-based rate limit: The VLAN in which the port participates.
    Bridge Domain	Bridge domain-based rate limit: The bridge domain in which the port's logical interface participates.
    VLAN Tag	ACL-based rate limit: The configuration of either the single tag or the double tags of the traffics on the egress port is required with the following match: For a VLAN, the single tag must match the VLAN to which the port participates. For a bridge domain, the associated logical interface must exist first.
    Ethernet Type	ACL-based rate limit: Ethernet type of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.
    Source MAC	ACL-based rate limit: Source MAC address of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.
    Destination MAC	ACL-based rate limit: Destination MAC address of Layer 2 packets. It is optional, but assists in restricting packets for egress rate limiting.

• For egress rate limiting, enable the L2-Egress-RateLimit TCAM profile and then reboot the device after making this configuration change. A maximum of 2,048 egress rate limiting is supported system wide.

SLX 9740/Extreme 8820

• These devices support policing on the egress side and Egress TCAM helps to identify the flow. Egress RL supports CBS, EIR and EBS configurations on SLX 9740/Extreme 8820.

• The Maximum value for the CBS is 255MB.

• Egress TCAM has support for only 1024 entries for egress ACL lookup which is also shared with Security ACL. This limits the maximum scale number supported on Flow based Egress Rate-limiting to 1024.

• Egress Rate limiting cannot be used along with BD configuration. Rate limiting at egress works for known unicast and BUM traffic. But due to hardware issue, BUM traffic gets corrupted. If BUM traffic hits the Egress RL, the VLAN ID of the out going frame will be replaced with Bridge Domain ID.
• Egress metering does not consider inter-frame-gap (IFG)/inter-packet-gap (IPG) in SLX 9740/Extreme 8820. This is a hardware limitation. Hence, a deviation is seen between the operational CIR and the on-wire rate. This deviation is more for smaller sized packets. For packets with size more than 1024 bytes, the deviation is less than 3%.
• Supported functionality includes the following:
  • Per port egress rate limit
  • Per flow egress rate limit for Layer 2 VLAN, bridge domain, and ACL
  • Per flow egress strict priority for Layer 2 VLAN, bridge domain, and ACL
  • VPLS ingress direction
  • Per flow egress rate limit for Layer 3 IPv4 and ACL
  • Per flow egress rate limit for Layer 3 IPv6 and ACL; IPv6 Optimised profile to be enabled for this to work
• Unsupported functionality includes the following:
  • WFQ
  • Per-priority shaping
  • VPLS egress direction
  • VXLAN (in and out direction)

Additional limitations for IPv6 Egress Rate Limiting

The following limitations must be kept in mind for IPv6 Egress Rate Limiting:

• This feature is only supported on ipv6-optimised profile and will not be supported on the default profile.
• The Policer is created on all the cores.
  

  Note

  • On SLX 9740-40C/Extreme 8820-40C devices, two cores are available (Core 0 and 1).

    • Ports 1 to 20 are part of core 0.

    • Ports 21 to 40 are part of core 1

  • On SLX 9740-80C/Extreme 8820-80C devices, two cores are available for each unit.

    • Ports 1 to 2