Exploring TCAM
A TCAM is a content-addressable memory where each bit is allowed to store a 0, 1, or a don't-care value—the ternary qualification comes from the fact that three different types of values can be stored. You can think of a CAM as a reverse random-access memory: Data is provided and an address is returned. Don't care bits play an important role in ACL lookups because ACLs frequently ignore portions of an IP address. For example, if an ACL is interested in matching traffic from 192.168.2.0/24, it does not care about the low-order byte. (The subnet mask is 24 bits long, while an entire IP address is 32 bits long.) From a logical standpoint, a TCAM is organized as a collection of masks with several values associated to them. A mask is a bit map that says, "Match the first 24 bits of the IP address," or "Match all 32 bits of the IP address," or again, "Match the full 32 bits of the source IP but do not care about the destination IP." Several values are associated with each mask. Values represent IP addresses that have that mask. For example, if the mask says, "First 24-bit of the IP address," the values associated with that entry in the TCAM could be all ACL entries that permit or deny /24 source subnets. Figure 16-7 shows this concept.
Figure 16-7 TCAM: Masks and Values
Masks
|
Mask Number One Match Condition: All 32 Bits of Source IP Address Don't Care: All Remaining Bits |
Source IP = 8.1.1.1 |
|
Source IP = 8.2.1.1 |
|
|
Empty 3 |
|
|
Empty 4 |
|
|
Empty 5 |
|
|
Empty 6 |
|
|
Empty 7 |
|
|
Empty 8 |
|
|
Mask Number Two Match Condition: Most Significant 24 Bits of Source IP Address Don't Care: All Remaining Bits |
Source IP = 8.1.1.X |
|
Empty 2 |
|
|
Empty 3 |
|
|
Empty 4 |
|
|
Empty 5 |
|
|
Empty 6 |
|
|
Empty 7 |
|
|
Empty 8 |
Result: Permit Result: Deny
Result: Deny
Referring to Figure 16-7, consider the ACL shown in Example 16-2.
Example 16-2 ACL Programmed in the TCAM per Figure 16-7
Referring to Figure 16-7, consider the ACL shown in Example 16-2.
Example 16-2 ACL Programmed in the TCAM per Figure 16-7
|
access |
list |
101 |
8.1.1.1 any |
||
|
access |
list |
101 |
deny ip 8.1.1.C |
255.255.255.Î |
any |
|
access |
list |
101 |
deny ip host 8 |
2.1.1 any |
With this ACL, the TCAM contains two masks: Match all 32 bits of the source IP address, and match the first 24 bits of the source IP. IP address 8.1.1.1 is associated with the first mask, while IP prefix 8.1.1.0/24 is stored with the second mask. The remaining mask bits are don't-care bits, corresponding to the destination IP address, port numbers, and so on. They are marked as don' t-care bits because the ACL is not interested in matching them (that is, the any keyword in the ACL). Each pattern points to a result in case of a hit. A result can be "permit," "deny," "capture," "redirect," and so on. Referring to the ACL in Example 16-2, a lookup for source IP address 8.1.1.1 returns a permit result. On the other hand, a lookup for source IP 8.1.1.8 results in the packet being denied because it does not match the full 32-bit entry for 8.1.1.1.
You can find an excellent online reference on TCAM architecture at Cisco.com (http:// tinyurl.com/2sefej).
Continue reading here: Discovering Extensible Authentication Protocol
Was this article helpful?