3

I read and read the information and somehow it is inconsistent or incomplete. The specification of 802.1Q also read, but to me as a person who has not previously read the specification is difficult. I draw a diagram. The diagram shows an illustration of the included ingress filtering. Is this a correct opinion? What is mapped at all, what are the "variables", maybe there is some sort of VLAN memberset where multiple allowed VLANs can be entered. Need a direct understanding of how this works. DIAGRAM

In pseudocode, it can be illustrated like this:

fvid = frame.tag8021q.VLAN
isUntagged = fvid == 0 
if isUntagged {
    if egressPort.Mode&ACCESS != 0 {
        if ingressPort.PVID() != egressPort.PVID() {
            return 0
        }
    }
    if egressPort.Mode&TRUNK != 0 {
        isMatched = egressPort.AllowedVlans().Contains(ingressPort.PVID())
        if !isMatched {
            return 0 
        }
    }
} else {
    if fvid != ingressPort.PVID() {
        return 0
    }
}

EDIT:

Unknown moment #1: We are searching in FDB, check frame source address and frame VID, if there is an entry and data match - we continue frame processing, otherwise - we discard. Is that correct?

Unknown moment #2: If ingress filtering is turned off on the egress port, so there will be no VLAN member set, what should we match the VID of the frame with? Completely scheme of three phases processing of frame: enter image description here

1 Answer 1

3

Ingress PVID equals VID of frame? should really be current frame VLAN tag is member of PVIDs? as there can be many VLANs associated with a port. And you've skipped the test for the ingress frame's VLAN being allowed on the inbound port.

Also, I don't think it's practical to try doing the ingress and the egress processing in one step.

Actual hardware implementations are likely simpler than that. The VLAN ID from an ingress frame is stored in memory along with the frame. During MAC learning and where to forward, that tag is used to match the CAM entries. The only special cases is for untagged frames that are appended with a port-dependent VLID on ingress or stripped of their tag on egress. The other special case of a non-existant/non-associated VLID isn't really special as the frame's simply blackholed.

5
  • Thank you for answer. In fact in the software implementation we can imagine some "VLAN member set" which includes several VLANs, then we iterate over this array and if we do not find a VLAN we discard the frame? But, i can't understand one moment in your quote, "And you've skipped the test for the ingress frame's VLAN being allowed on the inbound port." Are you talking about "admit rules"? Or about "MAC-To-VLAN entry", which contains MAC field and VLAN field, and then we check the VLAN field of entry with frame VLAN which came to inbound port (only if tagged)?
    – Manticore
    Apr 18, 2022 at 21:14
  • Yes - if the tagged VLAN doesn't exist the frame is dropped. You need to test a tagged VLAN on ingress since it may not be allowed on the given port. That's not an ACL matter but part of the VLAN configuration. For completeness, untagged frames may not be allowed on a ingress trunk port either. You should really consider treating ingress and egress separately.
    – Zac67
    Apr 19, 2022 at 4:00
  • After rereading your words, reviewing other schemes, and putting everything together, I drew a complete diagram of the processing of the frame. But I still do not understand some points. I can give the diagram that you have slightly corrected it according to requirements of the standard. I edited my post.
    – Manticore
    Apr 19, 2022 at 9:54
  • At Unknown Moment #1, an unknown destination MAC must not drop the frame. Frames with unknown MACs need to be flooded.
    – Zac67
    Apr 19, 2022 at 10:59
  • This I know that we do broadcast to all ports except the port from which the frame came. The question I have here is, if the MAC record is found, but the VLAN of the frame and the VLAN in the record don't match, how do we do? And what about Unknown moment #2
    – Manticore
    Apr 19, 2022 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.