Contents
Contents
Introduction
This document provides an overview of the Switching Database Manager (SDM) on the Catalyst 3750 series Layer 3 (L3) switches, and provides some SDM configuration examples and troubleshooting tips based on common deployments. The SDM is implemented in all versions of Cisco IOS® Software for the Catalyst 3750.
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
The information in this document is based on this software version:
-
Cisco IOS Software Release 12.1(14)EA1
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions
Refer to Cisco Technical Tips Conventions for more information on document conventions.
Overview of the SDM
The SDM on the Catalyst 3750 series L3 switches manages the Layer 2 (L2) and L3 switching information that is maintained in the Ternary Content Addressable Memory (TCAM). The TCAM is used for forwarding lookups.
The TCAM is a specialized piece of memory designed for rapid table lookups by the access control list (ACL) engine on the Catalyst 3750 switches. The ACL engine performs ACL lookups based on packets passing through the switch. The result of the ACL engine lookup into the TCAM determines how the switch handles a packet. For example, the packet may be permitted or denied. The TCAM has a limited number of entries that are populated with mask values and pattern values. There is one mask for eight entries in the TCAM. For more information about TCAM, refer to this document:
The main issue users face when configuring ACLs on Catalyst 3750 family switches are resource contention and exhaustion. Since the Catalyst 3750 switches enforce several types of ACLs in hardware rather than in software, the switch programs hardware lookup tables and various hardware registers in the TCAM subsystem. When a packet arrives, the switch can perform a hardware table lookup and perform the appropriate action.
Architecture
The Catalyst 3750 uses a TCAM subsystem that is shared between L2 and L3 forwarding entries, router access control lists (RACLs), VLAN access control lists (VACLs), and Quality of Service (QoS) ACLs. Unlike some types of Catalyst 3550 switches, the Catalyst 3750 has one TCAM subsystem.
TCAM Table Structure
-
Layer 2 Learning—This part holds the information about the port learning policies. For example, the regular access, secure, or dynamic VLAN port has a different learning policy.
-
Layer 2 Forwarding—This part holds the information about learned unicast and multicast addresses.
-
Layer 3 Routing—This part is used for unicast and multicast route lookups.
-
ACL and QoS Table—This part holds the information on how to identify the traffic according to security and QoS ACLs.
SDM Templates
Since the Catalyst 3750 can be used in numerous different applications, flexibility in TCAM subsystems resource allocation is vital. To this end, there are three predefined SDM templates that can be used to divide the TCAM to suit the use of the Catalyst 3750. The first one is the routing template which maximizes the system resources for unicast routing. The routing template would typically be used when the box is used as as a router or route aggregator in the center of the network. The VLAN template is the second one and with this template, unicast routing is disabled, allowing the maximum number of supported MAC addresses. The VLAN template would be used when the switch is being used as a purely L2 device. Finally there is the default template which is a mix between the routing and VLAN templates. This template gives a good balance between L2 and L3 capabilities. The sdm prefer route templateor sdm prefer routing-pbr template commands have to be used if policy-based routing (PBR) is used on the switch. If not, then the commands used for PBR will disappear.
For each template, there are two different versions: the Desktop Template and the Aggregator template. Only Catalyst switch model 3750-12S currently supports the Aggregator template. All Catalyst 3750 switches (including the 3750-12S) support the Desktop template.
| Catalyst 3750 SDM Desktop Template | |||
|---|---|---|---|
| Resource | Default | Routing | VLAN |
| Unicast MAC address | 6K | 3K | 12K |
| IGMP groups and Multicast routes | 1K | 1K | 1K |
| Unicast routes | 8K | 11K | 0 |
| 6K | 3K | 0 |
| 2K | 8K | 0 |
| PBR ACEs | 0 | 512 | 0 |
| QoS ACEs | 512 | 512 | 512 |
| Security ACEs | 1K | 1K | 1K |
| VLANs | 1K | 1K | 1K |
| Catalyst 3750 SDM Aggregator Template table (currently only supported by the 3750-12S) | |||
|---|---|---|---|
| Resource | Default | Routing | VLAN |
| Unicast MAC address | 6K | 6K | 12K |
| IGMP groups and Multicast routes | 1K | 1K | 1K |
| Unicast routes | 12K | 20K | 0 |
| 6K | 6K | 0 |
| 6K | 14K | 0 |
| PBR ACEs | 0 | 512 | 0 |
| QoS ACEs | 896 | 512 | 896 |
| Security ACEs | 1K | 1K | 1K |
| VLANs | 1K | 1K | 1K |
Notes:
-
All templates are predefined. There is no way to edit template category individual values.
-
The switch reload is required to use a new SDM template.
-
The ACL merge algorithm, as opposed to the original access control entries (ACEs) configured by the user, generate the number of TCAM entries listed for security and QoS ACEs. Refer to the Merge Algorithm section for more details.
-
The first eight lines (up to Security ACEs) represent approximate hardware boundaries set when a template is used. If the boundary is exceeded, all processing overflow is sent to the CPU which can have a major impact on the performance of the switch.
-
Choosing the VLAN template will actually disable routing (number of entry for unicast or multicast route is zero) in hardware.
SDM Templates and Switch Stacks
When the 3750 switches are being part of a stack, there are several points that one should keep in mind in regards to the SDM templates that can be used.
-
When a switch is added to a stack, the SDM template on the master will override the SDM template on the new switch.
-
If a 3750-12S running an Aggregate Template is being added as a member of the stack with a master running a Desktop template, the 3750-12S will move to the same Desktop template which is running on the master. When doing this, there is a risk that the newly added switch will loose a part of the configuration if the number of existing TCAM entries exceeds those available on the Desktop template running on the master.
-
If the stack master is a 3750-12S running an Aggregate Template and the member switches are not 3750-12S switches, they will not be able to support the Aggregate Template and the member switches will move into SDM mismatch mode. To verify whether there are any switches in SDM mismatch mode, you can issue the show switch command.
Resource Exhaustion
The different resources within the TCAM subsystem are limited. Depending on the configuration of the network and the Catalyst 3750, these resources may be exhausted. If these resources are exhausted, one or more of the following may occur:
-
For Layer 2 Forwarding and Learning, a new learned address will be flooded to all ports within the ingress VLAN. This is consistent with the operation of a bridge when the forwarding table is full. The Catalyst 3750 does not have the option of a network drain port to disable learning on specific interfaces.
-
For Layer 3 Routing, any L3 unicast and multicast routes will be learned only in software and not programmed into the TCAM. This results in slower software-based forwarding (routing) of packets between VLANs. The Catalyst 3750 can store a considerable amount more of L3 routes in software compared to the SDM template, however it is not recommended since performance will decrease and CPU utilization will raise.
Since the Catalyst 3750 allows only one ACL lookup per ingress or egress traffic direction, security ACLs, VACLs, and RACLs need to be merged into one compiled ACL in the TCAM. The following sequence will occur:
-
If the RACL and a VACL is merged and compiled into the TCAM, the compiler will attempt to fit either one into the TCAM.
-
If the merge fails, the Catalyst 3750 attempts to fit the VACL and a simplified RACL in the TCAM which essentially sends all routed packets to the CPU for filtering there.
-
If the RACL fits into the TCAM, but the VACL does not, only the RACL is processed in hardware. The VACL is processed through the CPU.
-
If either the RACL or a VACL is being compiled into the TCAM and does not fit, the entire RACL or VACL is unloaded from hardware. All processing is done through software. If neither the RACL or VACL can individually fit into the TCAM, both are software processed.
Merge Algorithm
The Cisco IOS Software on the Catalyst 3750 uses the Order Dependent Merge (ODM) algorithm. This algorithm is enabled by default and is not configurable.
Example of SDM Configurations
To check the current SDM template, issue the show sdm prefer command.
C3750G-24T#show sdm prefer
The current template is "desktop default" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.
number of unicast mac addresses: 6K
number of igmp groups + multicast routes: 1K
number of unicast routes: 8K
number of directly connected hosts: 6K
number of indirect routes: 2K
number of policy based routing aces: 0
number of qos aces: 512
number of security aces: 1K
C3750G-24T#
C3750G-24T#show sdm prefer vlan
"desktop vlan" template:
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.
number of unicast mac addresses: 12K
number of igmp groups: 1K
number of multicast routes: 0
number of unicast routes: 0
number of policy based routing aces: 0
number of qos aces: 512
number of security aces: 1K
C3750G-24T#
Note: There is no space reserved for the unicast or multicast entries.
To change the SDM template to the VLAN template:
C3750G-24T#conf t
Enter configuration commands, one per line. End with CNTL/Z.
C3750G-24T(config)#sdm prefer vlan
Changes to the running SDM preferences have been stored, but cannot take effect
until the next reload.
Use 'show sdm prefer' to see what SDM preference is currently active.
C3750G-24T(config)#^Z
C3750G-24T#show sdm prefer
The current template is "desktop default" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.
number of unicast mac addresses: 6K
number of igmp groups + multicast routes: 1K
number of unicast routes: 8K
number of directly connected hosts: 6K
number of indirect routes: 2K
number of policy based routing aces: 0
number of qos aces: 512
number of security aces: 1K
On next reload, template will be "desktop vlan" template.
C3750G-24T#
Troubleshooting
The following information can help you troubleshoot your configuration.
%STACKMGR-6-SWITCH_ADDED_SDM:Switch 2 has been ADDED to the stack (SDM_MISMATCH)
If the stack master is a Catalyst 3750-12S running an Aggregate Template and a new member switch which is not a 3750-12S is added to the stack, the following is seen on the master:
2d23h:%STACKMGR-6-SWITCH_ADDED_SDM:Switch 2 has been ADDED to the stack (SDM_MISMATCH) 2d23h:%SDM-6-MISMATCH_ADVISE: 2d23h:%SDM-6-MISMATCH_ADVISE: 2d23h:%SDM-6-MISMATCH_ADVISE:System (#2) is incompatible with the SDM 2d23h:%SDM-6-MISMATCH_ADVISE:template currently running on the stack and 2d23h:%SDM-6-MISMATCH_ADVISE:will not function unless the stack is 2d23h:%SDM-6-MISMATCH_ADVISE:downgraded. Issuing the following commands 2d23h:%SDM-6-MISMATCH_ADVISE:will downgrade the stack to use a smaller 2d23h:%SDM-6-MISMATCH_ADVISE:compatible desktop SDM template: 2d23h:%SDM-6-MISMATCH_ADVISE: 2d23h:%SDM-6-MISMATCH_ADVISE: "sdm prefer vlan desktop" 2d23h:%SDM-6-MISMATCH_ADVISE: "reload"
To check if there are any members of the stack running in SDM mismatch mode, you can issue the following command:
C3750-12S# show switch
Current
C3750-12S# Role Mac Address Priority State
------------------------------------------------------------
*1 Master 000a.fdfd.0100 5 Ready
2 Slave 0003.fd63.9c00 5 SDM Mismatch
If you are seeing this type of error on your master, make sure that you set the SDM Template on the Catalyst 3750-12S to Desktop.
I Cannot Configure the Desktop Template on My 3750 Switch
Only the Catalyst 3750-12S supports both the Desktop and Aggregate templates. All other Catalyst 3750 series switches support the Desktop template only, which is configured by default and cannot be changed. On the other models of 3750 series switches, no option is available in the CLI for desktop and aggregate templates as in the example below.
C3750G-24T(config)#sdm prefer routing ? <cr>
On the Catalyst 3750-12S, the option to choose between the Desktop and Aggregate template is not available. Aggregate is the default and to change to Desktop issue the following commands (this example changes to Routing Desktop):
C3750-12S(config)# sdm prefer routing desktop C3750-12S(config)# end C3750-12S# reload Proceed with reload? [confirm]
I Cannot Change the SDM Template on My 3750-12S to the Aggregate Template
The Aggregate keyword in the sdm prefer command on is not shown on the Catalyst 3750-12S switch because it runs the Aggregate template by default. If the template has been changed (for example, to the Routing Desktop template), the following commands can change it back to Routing Aggregate:
C3750-12S(config)# no sdm prefer !--- This brings the switch back to its default SDM template which is Aggregate. C3750-12S(config)# sdm prefer routing !--- This brings the switch to the Routing Aggregate template.
1791
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
