Multifield classification policies
SR Linux supports rule-based QoS multifield classification of IPv4 and IPv6 packets. Each IPv4 and IPv6 multifield classification policy is structurally similar to an IPv4 or IPv6 interface ACL, containing a list of ordered entries, each specifying a set of match conditions and associated actions.
Each multifield classification rule, or entry, has a sequence ID. The policy evaluates packets starting with the entry with the lowest sequence ID, progressing to the entry with the highest sequence ID. Evaluation stops at the first matching entry (that is, when the packet matches all of the conditions specified by the multifield classification entry).
Multifield classification policies are supported only on the 7220 IXR-D2/D2L/D3/D3L.
Match conditions
Each IPv4 or IPv6 policy entry can specify zero or more of the following match conditions.
| Match condition | Description | IPv4 policy support | IPv6 policy support |
|---|---|---|---|
| Destination IP | Matches by prefix or by address and mask | ✔ | ✔ |
| Destination port | Matches by destination TCP or UDP port or range. Comparison
operators define whether the matching destination port must be:
|
✔ | ✔ |
| DSCP set | Matches one of the DSCP values listed. This setting matches against the ingress DSCP value (not the rewritten DSCP value). If left empty, any DSCP value matches. | ✔ | ✔ |
| Fragment/first-fragment | Matches a packet that is a fragment, and optionally the first fragment | ✔ | Not applicable |
| ICMP type/code | Matches one of the specified ICMP type and code combinations | ✔ | Not applicable |
| ICMPv6 type/code | Matches one of the specified ICMPv6 type and code combinations | Not applicable | ✔ |
| Next-header number | Matches the first next-header field (in the IPv6 fixed header) if it contains the specified value | Not applicable | ✔ |
| Protocol number | Matches the IP protocol type field | ✔ | Not applicable |
| Source IP | Matches by prefix or by address and mask | ✔ | ✔ |
| Source port | Matches source TCP or UDP port or range. Comparison operators
define whether the matching source port must be:
|
✔ | ✔ |
| TCP flags | Matches the TCP flag names: RST, SYN, and ACK based on a logical expression using the &, |, and ! operators | ✔ | ✔ |
Supported actions
Each IPv4 or IPv6 policy entry supports the following actions:
- Set the forwarding class (mandatory action in each entry)
- Set the drop probability (optional action in each entry, default is low)
- Rewrite the ingress DSCP value (optional action in each entry)
Supported interfaces: routed, bridged, and IRB
You can bind a multifield classification policy (IPv4, IPv6, or both) to the following subinterface types:
- Routed subinterface of a default or ip-vrf network instance, associated with an Ethernet port, LAG, or IRB
- Bridged subinterface of a mac-vrf network instance, associated with an Ethernet port or LAG
DSCP classification policy and multifield classifier policy on the same subinterface
You can apply both a DSCP classification policy and a multifield classifier policy to the same IP/routed subinterface for a specified protocol (IPv4 or IPv6). If an ingress IPv4 or IPv6 packet matches a multifield classification rule, its forwarding class and drop probability are determined solely by the matching multifield classification rule. If an ingress IPv4 or IPv6 packet does not match any multifield classification rule, forwarding class and drop probability are determined as follows:
- On 7220 IXR-D2/D2L/D3/D3L:
Forwarding class and drop probability are determined by the configured or default DSCP policy.
Scaling and restrictions
The following describe scaling and restrictions for multifield classification policies.
7220 IXR-D2/D2L/D3/D3L
On the 7220 IXR-D2/D2L/D3/D3L:
- Multifield classifier policies always operate in subinterface-specific mode, with no option available for a shared mode. As a result, the number of TCAM entries required to implement one multifield classifier policy is N * S, where N is the number of TCAM entries required to implement one instance of the policy and S is the number of subinterfaces where the policy is applied.
- SR Linux blocks the binding of a MAC ACL and an IPv4 or IPv6 multifield classifier policy on the same subinterface. MAC ACL and multifield classification are mutually exclusive options in R22.11.
Ingress DSCP rewrite
Packets arriving on an interface can have IP DSCP markings that are not trusted. For example, when the upstream devices do not classify or mark the packets properly, or when the interface is at the beginning of a service SLA that is defined in terms of application characteristics instead of DSCP. In this case, an ingress DSCP rewrite action in the multifield classification policy can replace the DSCP value for matching IPv4 or IPv6 packets with a new value.
The following table provides more details about the packet flows that are supported with ingress DSCP rewrite.
| Ingress packet | Ingress subif type | Ingress subif MF classifier entry action | Forwarding | IRB subif MF classifier entry action | Egress subif(s) DSCP rewrite policy | Egress Packet |
|---|---|---|---|---|---|---|
| IP/Ethernet | bridged (mac-vrf) |
set fc=A dscp-rewrite=B |
L2 switched | configured or not configured (no effect in either case) | bridged subif DSCP rewrite policy: NO effect | DSCP=B |
| IP/Ethernet | bridged (mac-vrf) |
set fc=A dscp-rewrite=B |
L3 routed between mac‑vrf1 and mac‑vrf2 using IRB | not configured |
mac-vrf2 IRB subif DSCP rewrite policy: NO effect mac-vrf2 bridged subif DSCP rewrite policy: NO effect |
DSCP=B |
| IP/Ethernet | bridged (mac-vrf) |
set fc=A dscp-rewrite=B |
L3 routed between mac‑vrf1 and mac‑vrf2 using IRB |
IRB of mac-vrf1: set fc=C dscp-rewrite=D |
mac-vrf2 IRB subif DSCP rewrite policy: NO effect mac-vrf2 bridged subif DSCP rewrite policy: NO effect |
DSCP=D |
| IP/Ethernet | bridged (mac-vrf) |
set fc=A dscp-rewrite=B |
L3 routed followed by VXLAN encap (symmetric or asymmetric) | not configured | routed subif DSCP rewrite policy: only changes outer DSCP | VXLAN with outer DSCP based on fc=A lookup in the DSCP rewrite policy, payload DSCP=B |
| IP/Ethernet | bridged (mac-vrf) |
set fc=A dscp-rewrite=B |
L3 routed followed by VXLAN encap (symmetric or asymmetric) |
IRB of mac-vrf1: set fc=C dscp-rewrite=D |
routed subif DSCP rewrite policy: only changes outer DSCP | VXLAN with outer DSCP based on fc=C lookup in the DSCP rewrite policy, payload DSCP=D |
| IP/Ethernet | routed (ip-vrf or default) |
set fc=A dscp-rewrite=B |
L3 routed | N/A | routed subif DSCP rewrite policy: NO effect | DSCP=B |
Configuring multifield classification policies for input traffic
Configure IPv4 multifield classification policy
# info qos classifiers multifield ipv4-policy multifield-test
qos {
classifiers {
multifield {
ipv4-policy multifield-test {
entry 10 {
match {
fragment true
first-fragment true
protocol tcp
tcp-flags syn&ack
dscp-set [
AF11
]
destination-ip {
prefix 10.10.20.0/24
}
icmp {
type 4
code [
3
]
}
source-ip {
address 10.10.10.1
mask 255.255.255.0
}
destination-port {
operator eq
value 25
}
source-port {
operator ge
value 2526
}
}
action {
forwarding-class fc6
drop-probability low
rewrite {
set-dscp 40
}
}
}
}
}
}
}
Configure IPv6 multifield classification policy
# info qos classifiers multifield ipv6-policy multifield-test-v6
qos {
classifiers {
multifield {
ipv6-policy multifield-test-v6 {
entry 100 {
match {
next-header icmp
tcp-flags ack
dscp-set [
CS7
]
destination-ip {
address fd92:834d:fae9:fa28::
mask ffff:ffff:ffff:fc00::
}
icmp6 {
type 1
code [
3
]
}
source-ip {
prefix fc00::/7
}
destination-port {
operator eq
range {
start 800
end 1000
}
}
source-port {
operator le
value 700
}
}
action {
forwarding-class fc7
drop-probability medium
rewrite {
set-dscp 56
}
}
}
}
}
}
}
Applying a multifield classification policy to a subinterface
Apply multifield classification policy to subinterface
# info interface ethernet-1/1 subinterface 1 qos
interface ethernet-1/1 {
subinterface 1 {
qos {
input {
classifiers {
multifield {
ipv4-policy multifield-test
ipv6-policy multifield-test-v6
}
}
}
}
}
}