You may become confused when trying to troubleshoot MLS because the commands you need to watch out for are not directly related to MLS. Remember this basic rule: Any command that involves the router examining each packet to perform an action will disable MLS on an interface.

Let’s take a look at some of these commands and the effect each command has on the interface:

∙clear ip route—Clears all MLS cache entries for all the switches that are acting as MLS−SEs

∙ip security—Disables MLS on the interface it is applied to

∙ip tcp header−compression—Disables MLS on the interface it is applied to

∙ip tcp compression−connection—Disables MLS on the interface it is applied to

∙no ip routing—Purges all MLS caches and disables MLS on the interface it is applied to

The following IP features and protocols also have a negative impact on MLS:

∙Committed access rate (CAR)—CAR will disable MLS on the interface.

∙Data encryption—Any data encryption configured on the interface will cause MLS to fail.

∙IP accounting—This feature will not work if MLS is enabled on an interface.

∙Network Address Translation (NAT)—MLS is automatically disabled on an interface if NAT is enabled.

∙Policy route map—MLS is disabled if policy route maps are used.

Now that we have discussed these issues, let’s see how to configure MLS in your network. Even though this is a book on switching, in order for MLS to work properly in your network, you need to know how to configure both the MLS supporting switch and the MLS supporting router or internal route processor. In the next section, we will cover the configuration of both of these devices.

Configuring MLS

Configuring MLS involves tasks on both the MLS−RP and the MLS−SE. When using an internal route processor (such as an RSM) on the Catalyst 5000, the only tasks necessary are to verify that MLS is enabled on each interface and that all the interfaces are members of the same VLAN Trunking Protocol (VTP) domain. Because MLS is enabled by default, you need to re−enable MLS only on the interfaces that have been disabled. On a Catalyst 6000, no configuration is needed unless you have disabled MLS.

On the MLS−SE, you need to configure the switch to determine the IP destination of the MLS−RP, if it is an external router. If it is an internal MLS−RP, no configuration is necessary. The default behavior of IP is to maintain a cache entry for each destination IP address. This entry can be modified either to a source−destination pair or to a more specific IP flow.

On an external router being used as the MLS−RP, you need to configure the router to participate in MLS. If your switch has been configured to participate in a VTP domain, the MLS−RP must be in the same domain. You must configure each individual interface acting as an MLS−RP for MLS. Only one interface on the MLS−RP needs to be configured as the MLS management interface.

Note If the router is connected via non−trunk links to the switch, you need to configure a VLAN ID for each interface.

When configuring MLS on both the switch and the router, you should pay attention to several items. This information can be helpful for troubleshooting and configuring MLS. Let’s take a look at the following MLS features and components:

∙MLS cache

∙Aging timers

∙VLAN IDs

233

∙VTP domains

∙Management interfaces

Tip On the Catalyst 2926G−L3, 4908G−L3, or 2948G−L3 switch, at least one MLS−RP must be configured. Multiple MLS−RPs can be configured in a single line; up to 16 MLS−RPs can participate in MLS.

MLS Cache

The MLS cache is used to maintain the flow information for all active flows. The size of the MLS cache is limited to a maximum of 128K. This size limitation will occasionally cause MLS entries to be dropped from the MLS cache—usually if no traffic takes place in a network flow for 256 seconds. Certain routing changes and other network conditions can also force the MLS cache to purge its current entries.

Aging Timers

After the two hosts participating in a flow have completed their communication, you no longer need to maintain any entries regarding the flow. The quicker the end of the flow can be detected and the entries purged from the cache, the more effectively the switching process will function. Why? Because detecting and aging out these entries saves a lot of MLS cache space for real data traffic.

Tip Cisco recommends that the total MLS cache entries be kept below 32K. To implement this limit, set the initial aging time value to 128 seconds. If the cache entries continue to go over 32K, decrease the aging time setting and adjust it as necessary. If cache entries still continue to go over 32K, decrease the normal aging time in increments of 64 seconds from the 128−second default until the cache remains below 32K.

You can adjust the amount of time the MLS cache keeps an entry in its table and set it to a value other than the default 128 seconds by using the agingtime command. This command is useful for eliminating short−lived entries in the cache, such as Domain Name Service (DNS).

The aging time can be configured from 8 to 2,032 seconds, in increments of 8 seconds. At the end of the aging time interval, if no further packets are seen in a network flow, the entries related to that flow will be purged from the MLS cache.

The agingtime fast command allows you to age out MLS cache entries quickly based on the number of packets received during a configured time period. The command has two parameters:

∙fastagingtime—Identifies the amount of time an entry remains in the cache. The default for fastagingtime is 0, which means that the aging time is disabled and no fast aging occurs. This value can be configured for 32, 64, 96, or 128 seconds.

∙pkt_threshold—Identifies the number of packets that must be detected during the configured fastaging time in order for the entry to remain in the MLS cache. The default parameter value is 0. You can configure this value to 0, 1, 3, 7, 15, 31, or 63 packets.

Note If fastagingtime is not configured to one of the values indicated, it adjusts to the closest value.

On the Catalyst 6000, MLS aging is configured somewhat differently. You configure it on the switch using the mls aging command, which has three parameters:

∙normal—Configures the waiting time before aging out and deleting shortcut entries in the Layer 3 table. This parameter can be set in the range of 32 to 4,092 seconds.

∙fast aging—Used similarly to the Catalyst 5000 command for fast aging. Ages out entries created for flows that use a few packets and then are never used again. Both the fast aging threshold and time parameters are set with this command; they can be in the range of 1 to 128 seconds.

∙long—Flushes entries that have been in use for the specified time value, even if the Layer 3 entry is still active. This parameter is used to prevent inaccurate statistics. The long parameter can be set in the range of 64 to 900 seconds.

234