Using policy forwarding for tunnel decapsulation
IP tunneling can be used to transport payload packets from point A to point B. This approach adds one or more encapsulation headers at point A, and removes one or more of these encapsulation headers at point B. Between point A and point B, forwarding of the tunneled packets is based on the encapsulation headers and not the original payload headers.
On the node doing the decapsulation (point B), you can configure SR Linux policy forwarding to identify tunneled packets, decide which should be decapsulated, and which headers should be removed. After decapsulation, traffic is forwarded according its inner header destination IP address.
A forwarding policy used for tunnel decapsulation can use an IPv4/v6 prefix or a configured
IPv4/v6 prefix-list as a match condition. The ipv4.protocol and
ipv6.next-header match conditions are supported, but if configured, they
must be set to udp. The transport.destination-port match
condition is supported, but if configured, it must be set to 6080.
A destination-ip match condition is required. The
destination-ip prefix (and prefixes in the prefix-list) must not overlap
with a destination-ip prefix in a rule with a
decapsulate-mpls-in-udp action in the same network-instance (VRF). An
exception to this rule is that an IPv4 /32 prefix may overlap a non-/32 IPv4 prefix because
they are programmed into different tables; identical prefixes remain rejected. IPv6
overlapping prefixes are not covered by this exception.
The following table lists the supported tunnel decapsulation actions. For any rule that
contains a decapsulation action, the destination-ip match condition is
required.
| Action | Description | Platform support |
|---|---|---|
decapsulate-gre |
Remove the Generic Routing Encapsulation (GRE) header from packets matching the rule. For any rule with a This action supports an IPv4 |
|
decapsulate-gue |
Remove the Generic UDP Encapsulation (GUE) IP-UDP headers from packets matching the rule. For any rule with a This action supports an IPv4 and IPv6 |
|
decapsulate-ip-in-ip |
Remove the outer IP header from IP-in-IP encapsulated packets matching the rule. |
|
decapsulate-mpls-in-udp |
Remove the IP-UDP encapsulation when it encapsulates an MPLS packet. For any rule with a This action supports an IPv6 |
|
A forwarding policy configured with any decapsulate action in the above table must be configured as a global-decap-policy. This applies the forwarding policy to all subinterfaces within the network-instance. Additionally, the only supported actions for global-decap-policy rules are the decapsulate actions listed in the table.
Configuring tunnel decapsulation with policy forwarding
To configure a forwarding policy to decapsulate tunneled packets, specify the match conditions as a prefix or prefix-list and configure the type of tunnel traffic to decapsulate, either GRE, GUE, or MPLS-in-UDP.
Decapsulate GRE traffic
The following example configures a forwarding policy to decapsulate GRE traffic to a specific prefix. The forwarding policy removes the GRE headers of matching packets. The policy rules are evaluated for traffic on all IP interfaces in the network-instance.
--{ + candidate shared default }--[ ]--
# info with-context network-instance base policy-forwarding
network-instance base {
policy-forwarding {
global-decap-policy p1
policy p1 {
type pbr-policy
rule 1 {
action {
decapsulate-gre true
}
match {
ipv4 {
destination-ip {
prefix 172.16.1.0/24
}
}
}
}
}
}
}Decapsulate GRE traffic using a prefix list as match condition
The following example configures a prefix list and uses the prefix list as a match condition in a forwarding policy. The forwarding policy removes the GRE headers of matching packets.
--{ * candidate shared default }--[ ]--
# info with-context acl match-list ipv4-prefix-list list-1
acl {
match-list {
ipv4-prefix-list list-1 {
prefix 1.1.1.1/32 {
}
prefix 2.2.2.2/32 {
}
}
}
}--{ * candidate shared default }--[ ]--
# info network-instance default policy-forwarding
global-decap-policy p1
policy p1 {
type pbr-policy
rule 10 {
action {
decapsulate-gre true
}
match {
ipv4 {
destination-ip {
prefix-list list-1
}
}
}
}
}Decapsulate GUE traffic using a prefix list as match condition
The following example configures a prefix list and uses the prefix list as a match condition in a forwarding policy. The forwarding policy removes the GUE IP-UDP headers of matching packets.
--{ + candidate shared default }--[ ]--
# info with-context acl match-list ipv4-prefix-list p_set
acl {
match-list {
ipv4-prefix-list p_set {
prefix 10.10.10.0/24 {
}
prefix 10.10.20.0/24 {
}
}
}
}--{ + candidate shared default }--[ ]--
# info with-context network-instance base policy-forwarding
network-instance base {
policy-forwarding {
global-decap-policy p2
policy p2 {
type pbr-policy
rule 1 {
action {
decapsulate-gue true
}
match {
ipv4 {
protocol udp
destination-ip {
prefix-list p_set
}
}
transport {
destination-port 6080
}
}
}
}
}
}
Decapsulate MPLS-in-UDP traffic
The following example configures a forwarding policy to decapsulate MPLS-in-UDP traffic to a specific IPv6 prefix. The policy rules are evaluated for traffic on all IP interfaces in the network-instance. The forwarding policy removes the outer UDP header of matching packets. A static LSP defines the matching MPLS label to pop and then redirect the inner packet to a configured next-hop in a network-instance.
--{ + candidate shared default }--[ ]--
# info with-context network-instance default policy-forwarding
network-instance default {
policy-forwarding {
global-decap-policy p1
policy p1 {
type pbr-policy
rule 1 {
action {
decapsulate-mpls-in-udp true
}
match {
transport {
destination-port 6635
}
ipv6 {
next-header udp
destination-ip {
prefix 100:100::1/128
}
}
}
}
}
}
}--{ +* candidate shared default }--[ ]--
# info with-context network-instance default mpls
network-instance default {
mpls {
lsps {
static-lsp CUST1-IPv4-UNICAST_1 {
payload-type unicast
egress {
incoming-label 78
network-instance CUST1-VRF
pipe-mode true
next-hop 1 {
ip-address 10.10.10.19
}
}
}
}
}
}Decapsulate GUE and MPLS-in-UDP traffic (overlapping IPv4 destination prefixes)
Normally, overlapping destination-IP prefixes are not allowed between a
decapsulate-gue rule and a
decapsulate-mpls-in-udp rule in the same network-instance
(VRF). Overlap includes covering and more-specific prefixes, not just identical
prefixes.
An exception to this rule is that an IPv4 /32 prefix may overlap a non-/32 IPv4 prefix because they are programmed into different tables; identical prefixes remain rejected. Overlapping IPv6 prefixes are not covered by this exception.
The following example configures a forwarding policy with a
decapsulate-gue rule and a
decapsulate-mpls-in-udp rule. The destination IPv4 prefixes in
both rules overlap, but the configuration is valid.
The decapsulate-gue rule takes precedence over the
decapsulate-mpls-in-udp rule, so traffic with a destination IP
of 100.1.1.0 matches the decapsulate-gue /24 rule, not the
decapsulate-mpls-in-udp /32 rule.
--{ + candidate shared default }--[ ]--
# info with-context network-instance default policy-forwarding policy p1
network-instance default {
policy-forwarding {
policy p1 {
type pbr-policy
rule 1 {
action {
decapsulate-gue true
}
match {
ipv4 {
protocol udp
destination-ip {
prefix 100.1.1.0/24
}
}
transport {
destination-port 6080
}
}
}
rule 2 {
action {
decapsulate-mpls-in-udp true
}
match {
ipv4 {
protocol udp
destination-ip {
prefix 100.1.1.0/32
}
}
transport {
destination-port 6635
}
}
}
}
}
}Decapsulate IP-in-IP traffic
The following example configures a forwarding policy to remove the outer IP header from IP-in-IP encapsulated packets matching the rule.
--{ + candidate shared default }--[ ]--
# info with-context network-instance default policy-forwarding policy p2
network-instance default {
policy-forwarding {
policy p2 {
type pbr-policy
rule 101 {
action {
decapsulate-ip-in-ip true
}
match {
ipv4 {
destination-ip {
prefix 100.1.1.0/32
}
}
}
}
}
}
}