Ternary Content Addressable Memory Table

Co Not Gare: All Remaining Rits

Srt IP* 10.1.1.1

Empty s

Empty 3

Empty A

Empty G

Empty G

Empty 7

Empty fl

Mask 2 Matth: Most Signiticanl

24 Bitfi or Souroe IP AcJdr

Du Hui Cari: All Regina in ijiu

Bits

SrclP= 10.1.14

Empty I

Empty S

Empty 4

Empty 5

Empty i

Empty 1

Mask

Pattemt

TCAM is a specialized piece of memory designed for rapid table lookups—based on packets passing through the switch—performed by the ACL engine. The result of the ACL engine lookup into the TCAM table determines how the switch handles a packet. For example, the packet might be permitted or denied.

The TCAM table has a limited number of entries that are populated with pattern values and mask values, each with an associated result. These are known as value, mask, result (VMR) entries. The term VMR simply refers to the format in which access control entries (ACEs) are represented in the TCAM table.

The "value" in VMR refers to the pattern that is to be matched (such as IP addresses, protocol ports, and so on). The "mask" refers to the mask bits associated with the pattern. The "result" refers to the result or action that occurs in the case of a lookup returning a hit for the pattern and mask. This result might be a simple "permit" or "deny," or it may be a pointer to other more complex information. For example, in policy-based routing (PBR), the result is a pointer to an entry in the hardware adjacency table that contains the next-hop information.

With TCAM, matching is based on three values: 0, 1, or x (where x is either number), hence the term ternary. The memory structure is broken into a series of patterns and masks. Masks are shared among a specific number of patterns and are used to wildcard some content fields.

To perform a lookup in a TCAM table, all entries are checked in parallel. The performance is independent of the number of entries. This allows a switch to use the longest match lookup when needed and provides fixed latency to ignore fields.

These platforms use TCAMs for Layer 3 switching:

■ Catalyst 6500

■ Catalyst 4000

■ Catalyst 3550

An example of using ACLs stored in TCAMs is shown in the figure. Assume these two entries: access-list 101 permit ip host 10.1.1.1 any access-list 101 deny ip 10.1.1.0 0.0.0.255 any

The two mask value entries and two pattern value entries are consumed. You can mask the values that you do not care about. The remaining mask bits are "do not care bits," meaning that the destination IP address, port numbers, and so on, are of no concern.

The TCAM table consists of these types of regions:

■ Exact-match region: The exact-match region consists of Layer 3 entries for multiple protocol regions, such as IP adjacencies and Internetwork Packet Exchange (IPX ) node.

■ Longest-match region: Each longest-match region consists of groups of Layer 3 address entries ("buckets") organized in decreasing order by mask length. All entries within a bucket share the same mask value and key size. The buckets can change their size dynamically by borrowing address entries from neighboring buckets. Although the size of the whole protocol region is fixed, you can reconfigure it. The reconfigured size of the protocol region is effective only after the next system reboot.

■ First-match region: The first-match region consists of ACL entries. Lookup stops after first match of the entry.