Resource allocation for service ingress QoS policies using CAM-based classification

The available global pool of ingress internal CAM hardware resources can be allocated based on user needs and shared among different features, such as SAP ingress QoS policy, ingress ACLs, and so on. Use the configure>system>resource-profile>ingress-internal-tcam>qos-sap-ingress-resource command to allocate SAP ingress QoS classification and meter resources from this global pool.

In addition, resources can be allocated for different SAP ingress QoS policy classification match criteria based on operator needs. Users can modify resource allocation to scale the number of entries available per match criteria or to scale the number of SAPs. Resources from the global ingress internal CAM pool are allocated in fixed slices. The number of classification entries and meters per slice varies across 7210 SAS platforms.

For more information about number of slices that can be allocated to a feature, see the "System Resource Allocation" section in the 7210  SAS-Mxp, R6, R12, S, Sx, T Basic System Configuration Guide. For example, on a 7210 SAS-R6 IMM-b card, each slice allows 256 classification entries and 128 meters. The number of slices allotted for a SAP ingress QoS policy is configured using the configure>system>resource-profile>ingress-internal-tcam>qos-sap-ingress-resource command.

Users can configure the resources available for SAP ingress QoS policies and can limit the amount of resources used per match criteria supported for SAP ingress QoS policies. A specific slice can be used for either MAC criteria or IP criteria or IPv6 criteria, or both MAC and IP criteria. Allocation of classification entries also allocates meter/policer resources that are used to implement per FC per traffic type policing.

Note:

For SAP ingress classification, in addition to CAM-based resource allocation, the 7210 SAS-Mxp, 7210 SAS-R6, and 7210 SAS-R12 support table-based resource allocation for DSCP-classification on SAP ingress. See Table-based classification using dot1p and IP DSCP for assigning FC and profile on SAP ingress for the 7210 SAS-Mxp, 7210 SAS-R6, and 7210 SAS-R12 for more information.

By default, the system allocates resources for SAP ingress QoS policies to maintain backward compatibility with Release 4.0 and allocates resources for MAC criteria and IP criteria (by setting num-resources to max). Setting the num-resources value to max allows each match criteria to use the available SAP ingress QoS resources on a first-come-first-served model. By default, system does not allocate resources for use by ingress IPv6 classification or for using both IP (any) and MAC (any) criteria in a single SAP ingress policy. You must allocate resources before associating a SAP with an IPv6 SAP ingress policy or both IP (any) and MAC (any) criteria in a SAP ingress policy. Until appropriate resources are allocated, attempts to associate the policy with the SAP will fail.

If the configure>system>resource-profile>qos-sap-ingress-resource command is used to allocate resources for SAP ingress QoS policies, the system allocates resources in slices for a fixed number of entries; the entries allocated per slice is platform-dependent. The use of these entries by different types of match criteria is described in the following table.

Table: SAP ingress resource allocation and match criteria types
Type of match criteria Description

mac-criteria (any)

Before using SAP-ingress policies with mac-criteria (any), use the configure system resource-profile ingress-internal-tcam qos-sap-ingress-resource mac-match-enable CLI command to allocate resources from the SAP-ingress QoS resource pool. Resources are allocated for SAP-ingress policies that use mac-criteria (any and dot1p-only). Each entry in the SAP-ingress QoS policy that is configured to use mac-criteria uses one entry from the slices in the hardware resource pool allocated to mac-criteria.

For example, assume a SAP ingress QoS policy is configured to use mac-criteria with 50 entries and uses the configure> system> resource-profile> ingress-internal-tcam> qos-sap-ingress-resource> mac-match-enable 1 CLI command to configure one slice for use by mac-criteria (allowing a total of 512 entries for use by policies that use mac-criteria). In this case, the user can configure 10 SAPs that use the mac-criteria SAP ingress policy and consume 500 entries.

ipv4-criteria (any)

The use of ipv4-criteria (any) match criteria is the same as the mac-criteria. Use the configure system resource-profile ingress-internal-tcam qos-sap-ingress-resource ipv4-match-enable CLI command to allocate resources. Additionally, IPv4 criteria can share entries allocated for IPv6 criteria. The SR OS automatically allocates entries from an IPv6 criteria slice to IPv4 criteria policies, if no entries are available in the allocated IPv4 criteria slices and no slices are available for allocation to IPv4 criteria from the SAP-ingress QoS resource pool. If an IPv4 criteria entry uses IPv6 criteria slices, the number of hardware entries used is the same as required by an IPv6 criteria entry (see ipv6-criteria (any) for more information).

ipv6-criteria (any)

Before using the ipv6-criteria match criteria, use the configure> system> resource-profile> ingress-internal-tcam> qos-sap-ingress-resource> ipv6-ipv4-match-enable CLI command, and specify the ipv6 keyword for the num-qos-classifiers command to allocate resources from the SAP ingress QoS resource pool.

Each ipv4-criteria match entry or ipv6-criteria configured in the QoS policy that uses ipv6-criteria uses two (2) entries from the slices allocated for use by ipv6-criteria (128-bit) in the hardware. The system allocates entries from the ipv6-criteria pool in the following cases:

  • if the SAP ingress QoS policy uses ipv6-criteria entries (any or IPv6 DSCP) and ipv4-criteria entries (any or IPv4 DSCP)

  • if the SAP ingress QoS policy uses only ipv6-criteria (any or IPv6 DSCP)

  • if the SAP ingress QoS policy uses ipv4-criteria (any) and there are no resources available in the ipv4-criteria (see ipv4-criteria (any) for more information)

For example, assume a QoS policy is configured to use ipv6-criteria with 50 entries and the configure>system>resource-profile>ingress-internal-tcam>qos-sap-ingress-resource>ipv4-ipv6-128-match-enable 1 command is used to configure one slice for ipv6-criteria. This allows a total of 256 entries for use by SAPs using SAP ingress QoS policies with ipv6-criteria (because each IPv6 entry uses 2 entries in hardware). In this example, the user can configure five (5) SAPs that use this policy and consume a total of 250 entries. These resources can be shared with policies that use IPv4 criteria, though each IPv4 criteria entry consumes two (2) entries in the hardware. IPv4 criteria policies can consume spare IPv6 resources; however, if a larger number of IPv4 criteria policies are planned, it is good practice to allocate more resources for use with IPv4 criteria. 1

IPv4 (any) and MAC (any) match

Before using IP-criteria (any) and MAC-criteria (any) in a single policy, use the configure>system>resource-profile>ingress-internal-tcam>qos-sap-ingress-resource>ipv4-mac-match-enable command to allocate resources from the SAP ingress QoS resource pool. Each ipv4-criteria match entry or MAC-criteria match entry configured in the QoS policy uses two (2) entries from the allocated slices. The system allocates entries from the ipv4-mac-match-enable pool if the SAP ingress QoS policy uses both ip-criteria (any) and ipv6-criteria (any).

The system also allocates entries for all other criteria if there are no resources available to use in the pool allocated to those criteria. That is, if no resources are available in other pools, the following criteria are allocated resources from this pool: only mac-criteria any, only ip-criteria any, mac-criteria dot1p-only, ip-criteria dscp-only, ipv4-criteria dscp-only. 2

dot1p-only, IPv4 dscp-only, IPv6 dscp-only, and default SAP ingress QoS policies

Use the dot1p-only or dscp-only option if only dot1p bits or only IP DSCP bits or only IP precedence bits are used for SAP ingress classification. This facilitates efficient use of available hardware resources and better scaling. SAP ingress policies that use only dot1p bits or only IPv4/IPv6 DSCP or IPv4/IPv6 precedence or default SAP ingress QoS policy bits can use the resources from slices currently allocated for use by either IP-criteria or MAC-criteria or IPv6 criteria. The following is a list of special cases for resource allocation for default, dot1p-only, and dscp-only SAP ingress policies are as follows:

  • If no slices are available to accomodate a SAP associated with default or dot1p-only or a dscp-only SAP ingress policy, the SR OS allocates resources against mac-criteria if the SAP is configured in a VLL or VPLS service. The SR OS uses the required number of entries for this policy. The remaining entries are available for SAPs that use mac-criteria or that use only dot1p or only IPv4/IPv6 DSCP or that use a default policy.

  • If no slices are available to accomodate a SAP associated with default, dot1p-only, or a dscp-only SAP ingress policy, the SR OS allocates resources against ipv4-criteria if the SAP is configured in an IES, RVPLS, or a VPRN service. The SR OS uses the required number of entries for this policy. The remaining entries are available for SAPs that use ipv4-criteria or that use only IPv4/IPv6 DSCP or only dot1p criteria or that use default policy.

  • For a SAP ingress QoS policy, if the enable-table-classification command is set to use table-based classification and TCAM-based meters, and there are no resources available in the pool of slices allocated for ip-dscp-port-if-match criteria, a new slice is allocated and set to the ip-dscp-port-if-match-enable criteria. The SR OS uses the required number of entries from this slice for the policy being configured. The remaining entries are used for SAPs configured with default sap ingress QoS policy, or for SAPs with the enable-table-classification command set, which uses dot1p or IP DSCP table-based classification with TCAM meters.

The SAP ingress resource slices described in this section are different from the resources that are configured using the num-qos-classifiers command.The num-qos-classifiers command sets the limit on the resources needed per SAP ingress QoS policy. The qos-sap-ingress-resource resources set the maximum limit on the resources available to all the SAP ingress policies that are in use simultaneously on the system.

The SR OS manages the resource slices allocated to the SAP ingress QoS policy pool and allocates the slice entries when a SAP ingress QoS policy is associated with a SAP. In other words, a SAP specifies the number of QoS resources it needs using the num-qos-classifiers command (in the SAP ingress policy), while the system allocates the resources required by the SAP from the qos-sap-ingress-resource slices, depending on whether the SAP ingress policy uses ip-criteria or mac-criteria or ipv6-criteria.

Use the tools dump system-resources command to view the current usage and availability of system resources. One or more entries per slice are reserved for system use.

Parent topic: Resource allocation for SAP ingress policy
1 When a slice is allocated for IPv6 criteria, the system automatically adjusts the number of available classification entries in that slice to half the number of total entries available. For example, on the 7210 SAS-T, if a slice with a total of 256 entries is allocated for IPv6 criteria, the actual number of classification entries available for IPv6 classification is only 128. The number of meters available is 128 in this example.
2 Resources are not allocated to ipv6-criteria (any) from this pool.