WO2018045862A1 - 三态内容寻址存储器tcam表的写入方法及装置 - Google Patents

三态内容寻址存储器tcam表的写入方法及装置 Download PDF

Info

Publication number
WO2018045862A1
WO2018045862A1 PCT/CN2017/097917 CN2017097917W WO2018045862A1 WO 2018045862 A1 WO2018045862 A1 WO 2018045862A1 CN 2017097917 W CN2017097917 W CN 2017097917W WO 2018045862 A1 WO2018045862 A1 WO 2018045862A1
Authority
WO
WIPO (PCT)
Prior art keywords
acl
port
aggregation
tcam
tcam table
Prior art date
Application number
PCT/CN2017/097917
Other languages
English (en)
French (fr)
Inventor
吴小娟
陈文迅
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018045862A1 publication Critical patent/WO2018045862A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/74591—Address table lookup; Address filtering using content-addressable memories [CAM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]

Definitions

  • the present disclosure relates to the field of communications, and in particular, to a method and apparatus for writing a TCAM table of a three-state content addressed memory.
  • an access control list (ACL) access control list is a traffic classification tool.
  • the high-end router uses ACLs to classify and control port traffic, traffic mirroring, routing policies, and policy routing.
  • the ACL can filter and filter packets according to the fields in the packet.
  • the most common filtering field is the quintuple in the data packet, that is, the source IP address, destination IP address, protocol number, source port number, and destination port number.
  • An ACL list can have multiple rules, each of which describes a certain matching condition. For a given message, the interpretation begins with the first rule. Once the rule is matched, the action (permit/deny) set in the rule is executed and returned.
  • a trunk port (a trunk port) is a logical port that aggregates multiple physical ports to implement load balancing of traffic and redundant backup between links. According to the type of physical port, it is usually divided into aggregation of Ethernet links and aggregation of POS links.
  • ACL-related services include port ACL, Unicast Reverse Path Forwarding (URPF), policy-route-route-flow, traffic mirroring, and flow sampling. All services reference the rules in the ACL list. Write the rules to the table.
  • URPF Unicast Reverse Path Forwarding
  • All services reference the rules in the ACL list. Write the rules to the table.
  • the core router device is a multi-network processor (Network Processor, NP for short).
  • the device has 4 NPs per line card slot, which are called NP0, NP1, NP2, and NP3.
  • Each NP supports 100Gbps forwarding.
  • Performance, single line card can support 400Gbps forwarding performance.
  • the single-line card supports the mutual conversion of 400G and 200G, 400G is effective for 4 NPs, 200G is NP0, and NP1 is effective.
  • the ACL-related service write table means that after the ACL-related service is applied to the port, the device writes all the rules included in the ACL to the Ternary Content Addressable Memory (TCAM) table of the NP where the port is located. All businesses share a single TCAM table. For aggregated ports, regardless of how many physical members the aggregated port contains, the device writes ACL rules to the TCAM tables of all NPs of all line cards. Subsequently, if the physical members of the aggregation port change, the TCAM table will not be dynamically updated.
  • TCAM Ternary Content Addressable Memory
  • the device writes the ACL rule to the TCAM table of the NP without distinguishing it. This wastes TCAM table resources and increases the time of writing tables.
  • the ACL rule is written to the NP0 and TP1 TCAM tables.
  • the new port is added to the NP2 and NP3. To aggregation In the port, the newly added member port will not take effect because the device does not update the TCAM table when there is a member update.
  • NP2 and NP3 when converting from 400G to 200G, NP2 and NP3 will be unloaded. If the device writes rules to the TCAM table of NP2 and NP3, it will cause an exception.
  • Embodiments of the present disclosure provide a method and apparatus for writing a TCAM table of a tri-state content-addressable memory to at least solve the problem of wasting TCAM table resources in the related art in the related art.
  • a method for writing a tri-state content-addressable memory TCAM table including: after applying related services of an access control list ACL to an aggregation port, all rule entries included in the ACL are included Write to the TCAM table of the network processor NP where the member port of the aggregation port is located.
  • all the rule entries included in the ACL are written in the TCAM table of the network processor NP where the member port of the aggregation port is located, including at least one of the following methods: separately writing the related services of different service types into the TCAM table.
  • the TCAM table is written; the inbound and outbound directions are respectively written into the TCAM table; the ACL types are respectively written into the TCAM table.
  • the service type of the related service of the ACL includes: port ACL, URPF, Route-Map, flow mirroring, and stream sampling.
  • the method further includes performing one of the following operations on the TCAM table: adding a member port, deleting a member port, and updating a member port.
  • applying the related service to the aggregation port includes: if the same related service is applied to multiple aggregation ports, if the member ports of the multiple aggregation ports belong to the same NP, the same The related service is written in any TCAM table corresponding to the member port; if the member ports of the multiple aggregation ports belong to different NPs, the same related service is written to the corresponding member port. Different TCAM tables.
  • the method further includes: performing one of the following operations on the TCAM table: adding the ACL rule, deleting the ACL rule, and updating the ACL rule.
  • the method further includes: performing the following operation on the TCAM table: deleting the related service.
  • a writing apparatus for a tri-state content-addressable memory TCAM table which is applied to a routing device, comprising: a write table module, configured to apply related services of an access control list ACL to an aggregation After the port, all the rule entries included in the ACL are written to the TCAM table of the network processor NP where the member port of the aggregation port is located.
  • all the rule entries included in the ACL are written in the TCAM table of the network processor NP where the member port of the aggregation port is located, including at least one of the following methods: separately writing the related services of different service types into the TCAM table.
  • the TCAM table is written; the inbound and outbound directions are respectively written into the TCAM table; the ACL types are respectively written into the TCAM table.
  • the service type of the related service of the ACL includes: port ACL, URPF, Route-Map, flow mirroring, and stream sampling.
  • the write table module is further configured to be The TCAM table performs one of the following operations: adding a member port, deleting a member port, and updating a member port.
  • the write table module is further configured to: if the same related service is applied to multiple aggregation ports, if the member ports of the multiple aggregation ports belong to the same NP, the same correlation is performed.
  • the service is written in any TCAM table corresponding to the member port; if the member ports of the multiple aggregation ports belong to different NPs, the same related service is written to different TCAMs corresponding to the member ports. In the table.
  • the write table module is further configured to perform one of the following operations on the TCAM table: adding the ACL rule, deleting the ACL rule, and updating the ACL rule.
  • the write table module is further configured to perform the following operations on the TCAM table: deleting the related service.
  • a storage medium is also provided.
  • the storage medium is configured to store program code for performing the following steps: after applying the access control list related service to the aggregation port, write all rule entries included in the ACL to the TCAM of the network processor NP where the member port of the aggregation port is located In the table.
  • FIG. 1 is a flow chart of a method of writing a tri-state content-addressable memory TCAM table in accordance with an embodiment of the present disclosure
  • FIG. 2 is a flowchart of an aggregation port binding ACL related service and an aggregation port member update according to an embodiment
  • FIG. 3 is a schematic diagram of an addition process performed when an NP state of 0 ⁇ 1 changes according to an embodiment
  • FIG. 4 is a schematic diagram of a deletion process performed when an NP state 1 ⁇ 0 changes according to an embodiment
  • FIG. 5 is a flowchart of deleting an aggregation port ACL related service according to an embodiment
  • FIG. 6 is a schematic diagram of updating an ACL rule according to an embodiment.
  • the technical solution in this application file can be run on a core router device provided with a multi-NP line card.
  • FIG. 1 is a flow chart of a method for writing a TSTAT table of a tri-state content-addressable memory according to an embodiment of the present disclosure. As shown in FIG. 1, the method includes the following steps:
  • Step S102 The related service of the access control list ACL is applied to the aggregation port.
  • Step S104 Write all the rule entries included in the ACL to the TCAM table of the network processor NP where the member port of the aggregation port is located.
  • the member ports in the aggregation port may belong to different NPs, that is, in the above embodiment, it may be written in a TCAM table of multiple NPs. There is no direct connection between the aggregation port and the NP, and it is a collection of two different technical layers.
  • the service related to the ACL can be matched with the ACL rule when the service is executed.
  • the service type of the related service includes: port ACL, URPF, Route-Map, and flow mirroring. Stream sampling.
  • all the rule entries included in the ACL are written to the TCAM table of the network processor NP where the member port of the aggregation port is located, including at least one of the following manners:
  • the three write table manners in this embodiment are to write the table according to the above rules when writing the table.
  • the method of writing the table described in the present application may be the following embodiment: in a TCAM table of an NP, similar to the EXCEL table, there will be many rows or columns, and one row records that IPV4 enters the URPF service. Then, if the subsequently added or deleted service is the same as the service, the line in the table is added or deleted.
  • the method further includes: performing one of the following operations on the TCAM table: adding a member port, deleting a member port, and updating a member port.
  • the same related service is applied to multiple aggregation ports
  • the same related service is written to the corresponding member port.
  • the same related service is written to different TCAM tables corresponding to the member ports.
  • the ACL rule in the case that the ACL rule is updated, perform one of the following operations on the TCAM table: adding the ACL rule, deleting the ACL rule, and updating the ACL rule.
  • the preferred embodiment of the present disclosure provides an aggregation port ACL-related service in a multi-NP environment.
  • the method of writing a table the following describes the method of writing the table by means of a functional description, and the TCAM table written by using the written form described in the present application file includes the following five main functions:
  • Function 1 supports writing TCAM tables with ACL-related service types, directions, and ACL types.
  • ACL-related service types include port ACL, URPF, Route-Map, flow mirroring, and stream sampling.
  • port ACL port ACL
  • URPF Route-Map
  • flow mirroring flow mirroring
  • stream sampling stream sampling
  • Each aggregation port contains two directions, inbound and outbound, or uplink and downlink, and each direction is written to the TCAM table.
  • the ACL types include IPV4 and IPV6, and the two types are written to the TCAM table.
  • Function 2 which supports member updates of aggregated ports, including member addition, deletion, and update.
  • An aggregation port usually binds multiple physical ports to one logical port.
  • the physical port in the aggregation port is a member port.
  • the TCAM table in this document supports the addition, deletion, and update of member ports.
  • ACLs that have been referenced by ports
  • updates to ACL rules are supported, including the addition, deletion, and update of rules.
  • Function 5 Supports the application of ACL-related services and the deletion of ACL-related services on the aggregation port.
  • the application of the ACL-related service and the aggregation port binding ACL-related services on the aggregation port are the same technical operations, the application operation and the equivalent binding operation. In the subsequent implementation manner, the binding count is performed. It is a term commonly used in the technical field.
  • a plurality of modules and an ACL write table related operation are involved.
  • the processing involved in the forwarding table management module is mainly described.
  • the specific statistics counting, reporting path, display, interrupt, etc. are not the present application files. The focus is ignored or briefly introduced.
  • the port IFID is used to uniquely identify a port.
  • the ACL type is used to distinguish between an IPV4ACL and an IPV6 ACL.
  • the ACL is used to identify the bound ACL.
  • the same ACL is assigned only one ACL NUM.
  • the ACL ID is used to uniquely identify an ACL rule. Use Work Type to identify the type of ACL-related services.
  • FIG. 2 is a flowchart of an aggregation port binding ACL-related service and an aggregation port member update according to an embodiment.
  • an aggregation port is bound to an ACL-related service or a member of an aggregation port changes, an update process is initiated.
  • the aggregation port binding ACL is equivalent to the special case of empty member update. As shown in Figure 2, the following steps are included:
  • step S201 the port is bound to an ACL-related service or a port member update. Newly bind ACL-related services or member updates of aggregated ports, and process them according to the same process.
  • step S202 it is determined whether the port is an aggregation port. If the non-aggregation port goes to step S203, the aggregation port goes to step S204.
  • Step S203 the update process of the physical port or the sub-interface, which is not explained here.
  • Step S204 View the history cache of the NP according to the IFID of the aggregation port, and go to step S205. Check the NPs of all the members of the aggregation port. The status of each NP is 0 or 1. If the value is 1, the ACL is bound to the ACL. If the value is 0, the NP is not bound to the related service.
  • Step S205 View the actual NP state according to the IFID of the aggregation port. Check which NPs belong to all the members of the existing aggregation port, and obtain the current status of each NP as 0 or 1.
  • Step S206 updating the cache of the aggregated port based on the actual NP state, and updating the NP state to the actual NP state.
  • Step S207 comparing the NP states of S204 and S205, and executing an update process. Including the adding process step S208, the deleting process step S209, and other steps S210 and S211.
  • step S208 when the NP state is 0 ⁇ 1, the adding process is performed.
  • This NP is not a member of the aggregation port and is a newly added member. See Figure 3 for the implementation process.
  • step S209 when the NP state is 1 ⁇ 0, the deletion process is executed.
  • This NP was previously an aggregation port and is a member of the aggregation port. It is now deleted, as shown in the implementation flow of Figure 4.
  • step S210 when the NP state is 1 ⁇ 1, no processing is performed. This NP member has not changed.
  • step S211 when the NP state is 0 ⁇ 0, no processing is performed. This NP member has not changed.
  • FIG. 3 is a schematic diagram of an adding process performed when the NP state 0 ⁇ 1 changes according to an embodiment, as shown in FIG. 3, including the following steps:
  • step S303 the TCAM table corresponding to the NP is written, and the entry information of the ACL is written into the TCAM table corresponding to the NP.
  • step S304 the binding count is incremented by 1, and the corresponding binding count value is incremented by one.
  • the inbound direction, IPV4, and port ACL are bound to the ingress direction, IPV4, and port ACL.
  • step S306 the count is incremented by one, and the TCAM table is not updated. For example, if the binding is in the ingress direction, IPV4, and port ACL, the binding count corresponding to the ingress direction, IPV4, and port ACL is increased by 1.
  • FIG. 4 is a schematic diagram of a deletion process performed when the NP state 1 ⁇ 0 changes according to an embodiment, as shown in FIG. 4, including the following steps:
  • step S402 the binding count is >1, that is, the members of the multiple aggregation ports belong to the NP, and the multiple aggregation ports are bound to the same ACL, the same ACL Type, and the same ACL of the same Work Type.
  • step S403 the binding count is decremented by 1, and the TCAM table is not updated.
  • the binding count is >1, the NP member of an aggregation port is deleted. Only the binding count needs to be decremented by one, and the TCAM table is kept unchanged. Other aggregation ports can continue to use this table.
  • step S404 the binding count is 1, that is, only one aggregation port is bound to the same direction, the same ACL Type, and the same ACL of the same Work Type.
  • step S405 the binding count is decremented by one.
  • the associated binding count value needs to be decremented by one.
  • step S406 the TCAM table is deleted.
  • the binding count is decremented by 1, the binding count value becomes 0.
  • the entry information of the corresponding NP in the TCAM table needs to be deleted.
  • FIG. 5 is a flowchart of deleting an aggregation port ACL related service according to an embodiment. As shown in FIG. 5, the following steps are included.
  • step S501 the ACL-related service bound to the port is deleted. For example, delete the ACL-based flow mirroring bound to the port.
  • step S502 it is determined whether it is an aggregation port. If the port type is an aggregation port or a physical port or a sub-interface, if it is not an aggregation port, go to step S503; otherwise, go to step S504.
  • step S503 if it is not an aggregation port, the process of the physical port or the sub-interface is taken.
  • Step S504 determining whether the NP is a member of the aggregation port. It is checked one by one whether each NP above the device is a member of the aggregation port, and if not, it is not considered, and if so, step S505 is continued.
  • the binding count is detected.
  • step S506 the binding count is >1.
  • other members of the aggregation port also belong to this NP, and the binding direction, ACL NUM, Work Type, and ACL Type are also the same.
  • step S507 the binding count is decremented by 1, and the process goes to step S512. Only the binding count is decremented by 1, and the TCAM entry of the NP is not deleted.
  • step S509 the binding count is decremented by 1, and the process goes to step S512.
  • Delete the TCAM entry When the binding count is decremented by 1, the binding count value becomes 0. In this case, the NP entry information in the TCAM table needs to be deleted.
  • step S511 the abnormal exit is performed.
  • the interface is bound to the ACL service.
  • step S512 the NP member states of the bundle port cache are all cleared.
  • the ACL-related information of all the NP members needs to be deleted, including: (1) IPV4, IPV6, (2) Ingress, and Egress (3) ACL NUM (4) ACL related service types. Work Type.
  • FIG. 6 is a schematic diagram of updating an ACL rule according to an embodiment.
  • the ACL rule update is actually the process of deleting the existing rules in the TCAM table and then writing the new rules to the TCAM table.
  • Figure 6 includes the following steps:
  • Each NP obtains the binding count based on the port binding direction, ACL NUM, Work Type, and ACL Type. For NPs containing aggregate port members, the binding count is detected.
  • the ACL is bound to an ACL-related service.
  • the aggregation port is bound to an ACL-related service or multiple aggregation ports.
  • Step S604 the NP deletes the rule. Delete all rules of the ACL Num in the TCAM table of the NP.
  • step S605 the NP adds a new rule. After the rule entry corresponding to the ACL Num in the TCAM table is deleted, the new ACL Num rule is written in the TCAM table.
  • a writing device for the TCAM table of the three-state content-addressable memory is also provided, which is applied to the routing device, and the device is used to implement the above-mentioned embodiments and preferred embodiments, which are not described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • a writing device for a tri-state content-addressable memory TCAM table comprising:
  • the write table module is configured to apply the related service of the access control list ACL to the aggregation port, and write all rule entries included in the ACL to the TCAM table of the network processor NP where the member port of the aggregation port is located.
  • all the rule entries included in the ACL are written in the TCAM table of the network processor NP of the member port of the aggregation port, including at least one of the following methods: writing the related service of different service types to the TCAM table separately. Write the inbound and outbound directions to the TCAM table separately; write the ACL type to the TCAM table separately.
  • the service type of the related service includes: port ACL, URPF, Route-Map, flow mirroring, and stream sampling.
  • the write table module is further configured to perform one of the following operations on the TCAM table: adding a member port, deleting a member port, and updating a member port.
  • the write table module is further configured to: if the same related service is applied to multiple aggregation ports, if the member ports of the multiple aggregation ports belong to the same NP, write the same related service to In any TCAM table corresponding to the member port; if the member ports of the multiple aggregation ports belong to different NPs, the same related service is written to different TCAM tables corresponding to the member port.
  • the write table module is further configured to perform one of the following operations on the TCAM table: adding the ACL rule, deleting the ACL rule, and updating the ACL rule.
  • the write table module is further configured to The TCAM table does the following: deletes the related service.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • Embodiments of the present disclosure also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the processor performs the method steps in the foregoing embodiments according to the stored program code in the storage medium.
  • modules or steps of the present disclosure described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. As such, the disclosure is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供了一种三态内容寻址存储器TCAM表的写入方法及装置，其中，该方法包括：将访问控制列表ACL相关业务应用到聚合端口之后，将ACL包含的所有规则条目写到该聚合端口的成员端口所在网络处理器NP的TCAM表中。采用上述技术方案，解决了相关技术中浪费TCAM表资源的问题，有效节约了TCAM表资源，同时实现了路由设备便捷的管理多NP的TCAM表。

Description

三态内容寻址存储器TCAM表的写入方法及装置 技术领域
本公开涉及通信领域，具体而言，涉及一种三态内容寻址存储器TCAM表的写入方法及装置。
背景技术
在相关技术中，访问控制列表(Access Control List，简称为ACL)访问控制列表，是一种流分类工具，高端路由器使用ACL可以实现端口流量的分类和控制、流镜像、路由策略、策略路由等功能。ACL可以依据报文中的字段对报文进行筛选过滤，最为常见的筛选字段是数据报文中的五元组，即源IP地址、目的IP地址、协议号、源端口号和目的端口号。
一张ACL列表(list)可以有多条规则(rule)，每条规则都描述了一定的匹配条件。对于给定的报文，从第一条规则开始判读是否匹配，一旦匹配中规则，就执行规则内设定的动作(permit/deny)并返回。
聚合端口(Trunk)是一个逻辑端口，是多个物理端口的聚合，以用来实现流量的负载分担、链路间的冗余备份等功能。按照物理端口的类型通常分为以太链路的聚合和POS链路的聚合。
ACL相关的业务包括端口ACL，单播路由反向路由查找(Unicast Reverse Path Forwarding，简称为URPF)，策略路由Route-Map，流镜像，流采样等，所有业务都会引用ACL列表中的规则，并将规则写表。
核心路由器设备是一个多网络处理器(Network Processor，简称为NP)的环境，设备每块线卡槽位有4个NP，分别称为NP0，NP1，NP2，NP3，每个NP支持100Gbps的转发性能，单线卡可以支持400Gbps的转发性能。单线卡支持400G和200G的相互转化，400G是4个NP都生效，200G是NP0，NP1生效。
ACL相关业务写表是指，将ACL相关业务应用到端口后，设备将ACL包含的所有规则都写到端口所在NP的三态内容寻址存储器(Ternary Content Addressable Memory，简称为TCAM)表中，所有的业务都公用一张TCAM表。对于聚合端口，不论聚合端口包含多少物理成员，设备会将ACL规则写到所有线卡的所有NP的TCAM表中。后续，聚合端口的物理成员若发生了变化，也不会动态更新TCAM表。
经过分析，在相关技术中的实现方法存在如下问题：
1、无论某个NP中是否包含聚合端口的物理成员口，设备都会将ACL规则写入此NP的TCAM表中，而不进行区分。这样既浪费了TCAM表资源，也增加了写表时间。
2、在200G升级到400G或者400G恢复为200G的环境中，会导致错误和异常。
以200G升级到400G为例，200G时聚合端口绑定ACL相关业务后，会将ACL规则写入到NP0，NP1的TCAM表中，当升级到400G后，若NP2、NP3中有新的端口添加到聚合 端口中，由于设备当有成员更新时，不会更新TCAM表，新添加的成员口将不会生效。
此外，从400G转化为200G时，NP2、NP3将被卸载，若设备还往NP2、NP3的TCAM表中写规则会导致异常。
针对相关技术中，浪费TCAM表资源的问题，目前还没有有效地解决方案。
发明内容
本公开实施例提供了一种三态内容寻址存储器TCAM表的写入方法及装置，以至少解决相关技术中相关技术中浪费TCAM表资源的问题。
根据本公开的一个实施例，提供了一种三态内容寻址存储器TCAM表的写入方法，包括：将访问控制列表ACL的相关业务应用到聚合端口之后，将所述ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中。
可选地，将ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中，包括以下至少之一方式：将不同业务类型的所述相关业务分别写入所述TCAM表；将入向和出向分别写入所述TCAM表；将ACL类型分别写入所述TCAM表。
可选地，所述ACL的相关业务的业务类型包括：端口ACL，URPF，Route-Map，流镜像，流采样。
可选地，在所述聚合端口中的成员端口存在更新的情况下，所述方法还包括：对所述TCAM表执行以下之一操作：添加成员端口、删除成员端口和更新成员端口。
可选地，将相关业务应用到聚合端口，包括：在将相同的相关业务应用到多个聚合端口的情况下，如果所述多个聚合端口中的成员端口属于相同的NP，将所述相同的相关业务写到与所述成员端口对应的任一TCAM表中；如果所述多个聚合端口中的成员端口属于不同的NP，将所述相同的相关业务写到与所述成员端口对应的不同TCAM表中。
可选地，在ACL规则存在更新的情况下，所述方法还包括：对所述TCAM表执行以下操作之一：添加所述ACL规则、删除所述ACL规则、更新所述ACL规则。
可选地，在应用到所述聚合端口的相关业务存在更新的情况下，所述方法还包括：对所述TCAM表执行以下操作：删除所述相关业务。
根据本公开另一个实施例，还提供了一种三态内容寻址存储器TCAM表的写入装置，应用于路由设备，包括：写表模块，设置为将访问控制列表ACL的相关业务应用到聚合端口之后，将所述ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中。
可选地，将ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中，包括以下至少之一方式：将不同业务类型的所述相关业务分别写入所述TCAM表；将入向和出向分别写入所述TCAM表；将ACL类型分别写入所述TCAM表。
可选地，所述ACL的相关业务的业务类型包括：端口ACL，URPF，Route-Map，流镜像，流采样。
可选地，在所述聚合端口中的成员端口存在更新的情况下，所述写表模块还设置为对所 述TCAM表执行以下之一操作：添加成员端口、删除成员端口和更新成员端口。
可选地，所述写表模块还设置为在将相同的相关业务应用到多个聚合端口的情况下，如果所述多个聚合端口中的成员端口属于相同的NP，将所述相同的相关业务写到与所述成员端口对应的任一TCAM表中；如果所述多个聚合端口中的成员端口属于不同的NP，将所述相同的相关业务写到与所述成员端口对应的不同TCAM表中。
可选地，在ACL规则存在更新的情况下，所述写表模块还设置为对所述TCAM表执行以下操作之一：添加所述ACL规则、删除所述ACL规则、更新所述ACL规则。
可选地，在应用到所述聚合端口的相关业务存在更新的情况下，所述写表模块还设置为对所述TCAM表执行以下操作：删除所述相关业务。
根据本公开的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：将访问控制列表相关业务应用到聚合端口之后，将ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中。
通过本公开，在ACL的相关业务应用到聚合端口之后，只是将该ACL包含的所有规则条目写到，聚合端口中的成员端口所在NP的TCAM表中，而不是写到所有NP的TCAM表中。采用上述技术方案，解决了相关技术中浪费TCAM表资源的问题，有效节约了TCAM表资源，同时实现了路由设备便捷的管理多NP的TCAM表。
附图说明
此处所说明的附图用来提供对本公开的进一步理解，构成本申请的一部分，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1是根据本公开实施例的一种三态内容寻址存储器TCAM表的写入方法流程图；
图2是根据一种实施方式中聚合端口绑定ACL相关业务及聚合端口成员更新流程图；
图3是根据一种实施方式中当NP状态0→1变化时，执行的添加流程示意图；
图4是根据一种实施方式中当NP状态1→0变化时，执行的删除流程示意图；
图5是根据一种实施方式中的聚合端口ACL相关业务的删除流程图；
图6是根据一种实施方式中为ACL规则更新示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本公开。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请文件中的技术方案可以运行于设置有多NP线卡的核心路由器设备上。
图1是根据本公开实施例的一种三态内容寻址存储器TCAM表的写入方法流程图，如图1所示，该方法包括以下步骤：
步骤S102，访问控制列表ACL的相关业务应用到聚合端口；
步骤S104，将该ACL包含的所有规则条目写到该聚合端口的成员端口所在网络处理器NP的TCAM表中。
需要补充的是，聚合端口中的成员端口可能属于不同的NP，即在上述实施例中，有可能是写到了多个NP的TCAM表中。聚合端口和NP两者之间是不存在直接的连接关系，是两个不同技术层面的集合。
需要说明的是，ACL的相关业务是指可以在执行该业务时，该业务可以匹配Match该ACL规则，具体地，该相关业务的业务类型包括：端口ACL，URPF，Route-Map，流镜像，流采样。
可选地，将ACL包含的所有规则条目写到该聚合端口的成员端口所在网络处理器NP的TCAM表中，包括以下至少之一方式：
将不同业务类型的该相关业务分别写入该TCAM表；
将入向和出向分别写入该TCAM表；
将ACL类型分别写入该TCAM表。
需要说明的是，本实施例中的三种写表方式是说在写表时按照上述规则写表。在本申请文件中记载的写表方式可以是下述实施例：在某个NP的TCAM表中，类似于EXCEL表格，会有许多行或者列，某一行记载的是，IPV4入向URPF业务，则在后续添加或者删除的业务与该业务相同的情况下，则在该表格中的这一行进行添加或者删除操作。
可选地，在该聚合端口中的成员端口存在更新的情况下，该方法还包括：对该TCAM表执行以下之一操作：添加成员端口、删除成员端口和更新成员端口。
可选地，在将相同的相关业务应用到多个聚合端口的情况下，如果该多个聚合端口中的成员端口属于相同的NP，将该相同的相关业务写到与该成员端口对应的任一TCAM表中；如果该多个聚合端口中的成员端口属于不同的NP，将该相同的相关业务写到与该成员端口对应的不同TCAM表中。
可选地，在ACL规则存在更新的情况下，对该TCAM表执行以下操作之一：添加该ACL规则、删除该ACL规则、更新该ACL规则。
可选地，在应用到该聚合端口的相关业务存在更新的情况下，对该TCAM表执行以下操作：删除该相关业务。
下面结合本公开优选实施例进行详细说明。
针对相关技术中200G、400G切换过程中易导致错误和异常的问题，为了降低TCAM表的资源消耗，降低写TCAM表时间，本公开优选实施例中提供一种多NP环境下聚合端口ACL相关业务的写表方法，下面通过功能性描述方式记载该写表的方法，采用本申请文件中的记载的写表方式写出的TCAM表，包括以下五个主要功能：
功能1，支持以ACL相关业务类型、方向、ACL类型为粒度写TCAM表。
ACL相关业务类型包括端口ACL，URPF，Route-Map，流镜像，流采样等，在写表时，不同的业务分别写TCAM表，即使是引用同一个ACL的不同业务，也会分别写入TCAM表。
每个聚合端口包含两个方向，分别是入向和出向，或者叫做上行和下行，每个方向分别写入TCAM表。
ACL类型包括IPV4、IPV6，两种类型分别写入TCAM表。
功能2，支持聚合端口的成员更新，包括成员的添加、删除、更新。
聚合端口通常是将多个物理端口捆绑到一个逻辑端口中，聚合端口中的物理端口即为成员端口，本申请文件中的TCAM表支持成员口的添加、删除和更新操作。
功能3，支持同一个ACL相关业务绑定到多个聚合端口，也支持同一个聚合端口绑定多个ACL相关业务。
同一个聚合端口绑定不同的ACL相关业务，会分别写入聚合端口中的成员端口所在NP的TCAM表中。不同的聚合端口，绑定相同的ACL相关业务，若不同聚合端口的成员端口属于相同的NP，则在该NP中的TCAM表中只写一份规则条目，若聚合端口的成员端口属于不同的NP，则在不同的NP中都需要写相同的TCAM表。
功能4，支持ACL rule规则的更新。
对于已经被端口引用的ACL，支持ACL规则的更新，包括规则的添加、删除和更新。
功能5，支持聚合端口应用ACL相关业务和删除ACL相关业务。
需要补充的是，在本申请文件中，聚合端口应用ACL相关业务和聚合端口绑定ACL相关业务是相同的技术操作，应用操作和相当于绑定操作，在后续的实施方式中，绑定计数是技术领域常用的词语。
下面结合本公开优选实施例的一种实施方式进一步说明。
在一种实施方式中涉及有多个模块和ACL写表相关操作，该实施方式中着重描述转发表管理模块所涉及的处理过程，具体统计计数、上报路径、显示、中断等过程不是本申请文件的重点，忽略或简略介绍。
该具体实施方式中用端口IFID来唯一标识一个端口，用ACL Type区分IPV4ACL和IPV6ACL，用ACL NUM来标识绑定的ACL，同一个ACL只分配一个ACL NUM，用ACL ID来唯一标识一条ACL rule，用Work Type来标识ACL相关业务的类型。
在本申请文件中的技术方案，写TCAM表的时候会基于如下的几个维度进行比较和判断：(1)ACL Type，IPV4、IPV6分别写表；(2)入向Ingress和出向Egress分别写表；(3)ACL NUM，不同的ACL NUM分别写表；(4)ACL的相关业务类型，不同的Work Type分别写表。
图2是根据一种实施方式中聚合端口绑定ACL相关业务及聚合端口成员更新流程图，当聚合端口绑定ACL相关业务或者聚合端口的成员发生变化时，都会促发更新流程。聚合端口绑定ACL相当于是空成员更新的特殊情况，如图2所示，包括以下步骤：
步骤S201，端口绑定ACL相关业务或者端口成员更新。新绑定ACL相关业务或者聚合端口的成员更新，按照相同的流程处理。
步骤S202，判断端口是否为聚合端口，若非聚合端口走步骤S203，若为聚合端口走步骤S204。
步骤S203，物理口或子接口的更新流程，此处不做讲解。
步骤S204，根据聚合端口的IFID，查看NP的历史缓存，转步骤S205。查看聚合端口的所有成员属于哪些NP，每个NP的状态是0还是1，如果为1说明NP上有ACL相关业务的绑定，如果为0说明NP上没有绑定相关业务。
步骤S205，根据聚合端口的IFID，查看实际的NP状态。查看现有聚合端口的所有成员属于哪些NP，获取每个NP的当前状态是0还是1。
步骤S206，基于实际的NP状态，更新聚合端口的缓存，将NP状态更新为实际的NP状态。
步骤S207，比较S204与S205的NP状态，执行更新流程。包括添加流程步骤S208、删除流程步骤S209，还有其他情况的步骤S210和步骤S211。
步骤S208，在NP状态0→1时，执行添加流程。此NP之前不是聚合端口的成员，是新添加的成员，见图3的实施流程。
步骤S209，在NP状态1→0时，执行删除流程。此NP此前属于聚合端口，是聚合端口的成员，现在被删除，见图4的实施流程。
步骤S210，在NP状态1→1时，不做处理。此NP成员未变化。
步骤S211，在NP状态0→0时，不做处理。此NP成员未变化。
当一个端口被创建后，就会给端口分配一段缓存，缓存中与ACL相关的信息包括：(1)IPV4、IPV6，(2)Ingress、Egress，(3)ACL NUM，(4)ACL的相关业务类型Work Type。每个端口会基于缓存生成不同类型的绑定计数，比如入向和出向都绑定ACL相关业务，则会分别生成一个入向绑定计数和出向绑定计数；比如绑定了IPV4和IPV6的ACL相关业务，则分别生成一个IPV4绑定计数和IPV6绑定计数；每生成一个绑定计数，对应类型的绑定计数值就加1。图3是根据一种实施方式中当NP状态0→1变化时，执行的添加流程示意图，如图3所示，包括以下步骤：
步骤S301，查看绑定计数，查看聚合端口是否有相关的绑定信息，绑定计数＝0，转步骤S302；绑定计数>＝1，转S305。比如本次绑定的是Ingress方向，IPV4，端口ACL，就检查是否有相同Ingress方向，相同ACL Type，相同Work Type的绑定计数值。
步骤S302，绑定计数＝0，NP之前未绑定任何相同的ACL业务。
步骤S303，写NP对应的TCAM表，将ACL的表项信息写入对应NP的TCAM表中。
步骤S304，绑定计数加1，将对应的绑定计数值加1。
步骤S305，绑定计数>＝1，说明NP之前有绑定相同的ACL。比如本次绑定的是Ingress方向，IPV4，端口ACL，之前此NP也绑定过Ingress方向，IPV4，端口ACL。
步骤S306，计数加1，不更新TCAM表。比如本次绑定的是Ingress方向，IPV4，端口ACL，就将Ingress方向，IPV4，端口ACL对应的绑定计数加1。
图4是根据一种实施方式中当NP状态1→0变化时，执行的删除流程示意图，如图4所示，包括以下步骤：
步骤S401，查看绑定计数，查看聚合端口是否有相关的绑定计数值，绑定计数>1，转步骤S402；绑定计数＝1，转步骤S404。
步骤S402，绑定计数>1，也就是说多个聚合端口的成员都属于此NP，且多个聚合端口都绑定了相同方向，相同ACL Type，相同Work Type的相同ACL。
步骤S403，绑定计数减1，不更新TCAM表。当绑定计数>1时，某个聚合端口的NP成员被删除，只需要将绑定计数减1，保留TCAM表不变，其它聚合端口可以继续使用此表。
步骤S404，绑定计数＝1，也就是说NP之前只有1个聚合端口绑定了相同方向，相同ACL Type，相同Work Type的相同ACL。
步骤S405，绑定计数减1。需要将相关的绑定计数值减1。
步骤S406，删除TCAM表。当绑定计数减1后，绑定计数值就变成0，此时需要删除TCAM表中对应NP的表项信息。
图5是根据一种实施方式中的聚合端口ACL相关业务的删除流程图，如图5所示，包括以下步骤。
步骤S501，删除端口绑定的ACL相关业务。比如说删除端口绑定的基于ACL的流镜像。
步骤S502，判断是否为聚合端口。判断端口类型，是聚合端口还是物理口或者子接口，若不是聚合端口，转步骤S503；其余转步骤S504。
步骤S503，若不是聚合端口，走物理口或者子接口的流程。
步骤S504，判断NP是否为聚合端口的成员。逐个检查设备上面的每个NP是否是聚合端口的成员，若不是，则不予考虑，若是，则继续执行步骤S505。
步骤S505，基于NP，根据端口绑定方向，ACL NUM，Work Type，ACL Type获取绑定计数，绑定计数>1，转步骤S506；绑定计数＝1，转步骤S508；绑定计数＝0，转步骤S510。对于包含聚合端口成员的NP，查出绑定计数。
步骤S506，绑定计数>1。除了当前的聚合端口外，还有其它的聚合端口的成员也属于此NP，且绑定方向，ACL NUM，Work Type，ACL Type也都相同。
步骤S507，绑定计数减1，转步骤S512。只是绑定计数减1，不删除NP的TCAM表项。
步骤S508，绑定计数＝1。只有当前的聚合端口绑定了ACL。
步骤S509，绑定计数减1，转步骤S512。删除TCAM表项。当绑定计数减1后，绑定计数值就变成0，此时需要删除TCAM表中NP的表项信息。
步骤S510，绑定计数＝0。
步骤S511，异常退出。理论上接口绑定ACL业务，绑定计数是>＝1，若绑定计数＝0，会走异常处理流程，直接退出，待软件工程师来处理。
步骤S512，将捆绑端口缓存的NP成员状态全部清空。当捆绑端口删除ACL相关业务后，所有NP成员之前缓存的ACL相关的信息都需要删除，包括：(1)IPV4、IPV6(2)Ingress、Egress(3)ACL NUM(4)ACL的相关业务类型Work Type。
图6是根据一种实施方式中为ACL规则更新示意图。ACL规则更新实际就是先删除TCAM表中已有规则，再往TCAM表中写新的规则的过程。图6包括以下步骤：
步骤S601，循环查看所有NP的绑定计数，绑定计数＝0，转步骤S602；绑定计数>＝1， 转步骤S603。每个NP根据端口绑定方向，ACL NUM，Work Type，ACL Type获取绑定计数。对于包含聚合端口成员的NP，查出绑定计数。
步骤S602，绑定计数＝0。说明此NP无ACL相关业务，无需修改。
步骤S603，绑定计数>＝1。说明此NP有绑定ACL相关业务，可能是一个聚合端口绑定了ACL相关业务，也可能是多个聚合端口。
步骤S604，NP删除规则。删除NP的TCAM表中，ACL Num对应的所有规则。
步骤S605，NP添加新规则。TCAM表中ACL Num对应的规则条目删除后，再往TCAM表中写新的ACL Num对应的规则。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本公开各个实施例所述的方法。
实施例2
在本实施例中还提供了一种三态内容寻址存储器TCAM表的写入装置，应用于路由设备，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
根据本公开的一个实施例，提供了一种三态内容寻址存储器TCAM表的写入装置，该装置包括：
写表模块，设置为将访问控制列表ACL的相关业务应用到聚合端口之后，将该ACL包含的所有规则条目写到该聚合端口的成员端口所在网络处理器NP的TCAM表中。
可选地，将ACL包含的所有规则条目写到该聚合端口的成员端口所在网络处理器NP的TCAM表中，包括以下至少之一方式：将不同业务类型的该相关业务分别写入该TCAM表；将入向和出向分别写入该TCAM表；将ACL类型分别写入该TCAM表。
可选地，该相关业务的业务类型包括：端口ACL，URPF，Route-Map，流镜像，流采样。
可选地，在该聚合端口中的成员端口存在更新的情况下，该写表模块还设置为对该TCAM表执行以下之一操作：添加成员端口、删除成员端口和更新成员端口。
可选地，该写表模块还设置为在将相同的相关业务应用到多个聚合端口的情况下，如果该多个聚合端口中的成员端口属于相同的NP，将该相同的相关业务写到与该成员端口对应的任一TCAM表中；如果该多个聚合端口中的成员端口属于不同的NP，将该相同的相关业务写到与该成员端口对应的不同TCAM表中。
可选地，在ACL规则存在更新的情况下，该写表模块还设置为对该TCAM表执行以下操作之一：添加该ACL规则、删除该ACL规则、更新该ACL规则。
可选地，在应用到该聚合端口的相关业务存在更新的情况下，该写表模块还设置为对该 TCAM表执行以下操作：删除该相关业务。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本公开的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，将访问控制列表ACL的相关业务应用到聚合端口之后，将该ACL包含的所有规则条目写到该聚合端口的成员端口所在网络处理器NP的TCAM表中。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行上述实施例中的方法步骤。
可选地，本实施例中的示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本公开的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本公开不限制于任何特定的硬件和软件结合。
以上所述仅为本公开的优选实施例而已，并不用于限制本公开，对于本领域的技术人员来说，本公开可以有各种更改和变化。凡在本公开的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。

Claims (11)

  1. 一种三态内容寻址存储器TCAM表的写入方法，包括：
    将访问控制列表ACL的相关业务应用到聚合端口之后，将所述ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中。
  2. 根据权利要求1所述的方法，其中，将ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中，包括以下至少之一方式：
    将不同业务类型的所述相关业务分别写入所述TCAM表；
    将入向和出向分别写入所述TCAM表；
    将ACL类型分别写入所述TCAM表。
  3. 根据权利要求1所述的方法，其中，在所述聚合端口中的成员端口存在更新的情况下，所述方法还包括：对所述TCAM表执行以下之一操作：添加成员端口、删除成员端口和更新成员端口。
  4. 根据权利要求1所述的方法，其中，将ACL的相关业务应用到聚合端口，包括：
    在将相同的相关业务应用到多个聚合端口的情况下，如果所述多个聚合端口中的成员端口属于相同的NP，将所述相同的相关业务写到与所述成员端口对应的任一TCAM表中；如果所述多个聚合端口中的成员端口属于不同的NP，将所述相同的相关业务写到与所述成员端口对应的不同TCAM表中。
  5. 根据权利要求1所述的方法，其中，在ACL规则存在更新的情况下，所述方法还包括：对所述TCAM表执行以下操作之一：添加所述ACL规则、删除所述ACL规则、更新所述ACL规则。
  6. 根据权利要求1所述的方法，其中，在应用到所述聚合端口的相关业务存在更新的情况下，所述方法还包括：对所述TCAM表执行以下操作：删除所述ACL的相关业务。
  7. 一种三态内容寻址存储器TCAM表的写入装置，应用于路由设备，包括：
    写表模块，设置为将访问控制列表ACL的相关业务应用到聚合端口之后，将所述ACL包含的所有规则条目写到所述聚合端口的成员端口所在网络处理器NP的TCAM表中。
  8. 根据权利要求7所述的装置，其中，在所述聚合端口中的成员端口存在更新的情况下，所述写表模块还设置为对所述TCAM表执行以下之一操作：添加成员端口、删除成员端口和更新成员端口。
  9. 根据权利要求7所述的装置，其中，所述写表模块还设置为在将ACL相同的相关业务应用到多个聚合端口的情况下，如果所述多个聚合端口中的成员端口属于相同的NP，将所述相同的相关业务写到与所述成员端口对应的任一TCAM表中；如果所述多个聚合端口中的成员端口属于不同的NP，将所述相同的相关业务写到与所述成员端口对应的不同TCAM表中。
  10. 根据权利要求7所述的装置，其中，所述写表模块还设置为：
    在ACL规则存在更新的情况下，所述写表模块还用于对所述TCAM表执行以下操作 之一：添加所述ACL规则、删除所述ACL规则、更新所述ACL规则；
    在应用到所述聚合端口的相关业务存在更新的情况下，所述写表模块还用于对所述TCAM表执行以下操作：删除所述相关业务。
  11. 一种计算机存储介质，所述计算机存储介质存储有执行指令，所述执行指令用于执行权利要求1至6中任一项所述的方法。
PCT/CN2017/097917 2016-09-06 2017-08-17 三态内容寻址存储器tcam表的写入方法及装置 WO2018045862A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610805501.6 2016-09-06
CN201610805501.6A CN107800627B (zh) 2016-09-06 2016-09-06 三态内容寻址存储器tcam表的写入方法及装置

Publications (1)

Publication Number Publication Date
WO2018045862A1 true WO2018045862A1 (zh) 2018-03-15

Family

ID=61530819

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/097917 WO2018045862A1 (zh) 2016-09-06 2017-08-17 三态内容寻址存储器tcam表的写入方法及装置

Country Status (2)

Country Link
CN (1) CN107800627B (zh)
WO (1) WO2018045862A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210359997A1 (en) * 2020-05-14 2021-11-18 Arista Networks, Inc. Automatic tcam profiles
CN114448882A (zh) * 2020-11-04 2022-05-06 国家计算机网络与信息安全管理中心 一种实现高性能大容量路由设备的设计方法

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111083068A (zh) * 2018-10-22 2020-04-28 中兴通讯股份有限公司 一种聚合链路收敛方法、装置及存储介质
CN111324382B (zh) * 2018-12-13 2023-03-03 华为技术有限公司 指令处理方法和芯片
CN111181870B (zh) * 2019-12-31 2022-05-13 国家计算机网络与信息安全管理中心 一种基于网络处理器实现多业务规则共享的方法
CN112073438B (zh) * 2020-10-10 2021-12-17 迈普通信技术股份有限公司 一种访问控制规则配置方法、装置、交换机及存储介质
CN112702311B (zh) * 2020-11-30 2022-10-14 锐捷网络股份有限公司 一种基于端口的报文过滤方法和装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1606294A (zh) * 2003-10-07 2005-04-13 阿尔卡特公司 改进的用于路由器的访问控制列表机制
CN101090403A (zh) * 2006-06-15 2007-12-19 中兴通讯股份有限公司 一种在聚合端口访问控制列表的装置及其实现方法
US7366830B1 (en) * 2005-09-01 2008-04-29 Netlogic Microsystems, Inc. Row expansion reduction by inversion for range representation in ternary content addressable memories
CN101651623A (zh) * 2009-09-07 2010-02-17 中兴通讯股份有限公司 访问控制列表应用的生成方法及装置
CN103812774A (zh) * 2012-11-09 2014-05-21 华为技术有限公司 基于tcam的策略配置方法、报文处理方法及相应装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090125470A1 (en) * 2007-11-09 2009-05-14 Juniper Networks, Inc. System and Method for Managing Access Control Lists
CN103618711B (zh) * 2013-11-25 2016-11-23 华为技术有限公司 一种acl规则的配置方法及网络设备
CN105744010A (zh) * 2014-12-12 2016-07-06 中兴通讯股份有限公司 一种网络地址转换与访问控制列表规则聚合方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1606294A (zh) * 2003-10-07 2005-04-13 阿尔卡特公司 改进的用于路由器的访问控制列表机制
US7366830B1 (en) * 2005-09-01 2008-04-29 Netlogic Microsystems, Inc. Row expansion reduction by inversion for range representation in ternary content addressable memories
CN101090403A (zh) * 2006-06-15 2007-12-19 中兴通讯股份有限公司 一种在聚合端口访问控制列表的装置及其实现方法
CN101651623A (zh) * 2009-09-07 2010-02-17 中兴通讯股份有限公司 访问控制列表应用的生成方法及装置
CN103812774A (zh) * 2012-11-09 2014-05-21 华为技术有限公司 基于tcam的策略配置方法、报文处理方法及相应装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
SHAN, JIALING: "Application Research of ACL in Aggregate-port", COMPUTER & DIGITAL ENGINEERING, vol. 39, no. 2, 28 February 2011 (2011-02-28) *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210359997A1 (en) * 2020-05-14 2021-11-18 Arista Networks, Inc. Automatic tcam profiles
US11711370B2 (en) * 2020-05-14 2023-07-25 Arista Networks, Inc. Automatic TCAM profiles
CN114448882A (zh) * 2020-11-04 2022-05-06 国家计算机网络与信息安全管理中心 一种实现高性能大容量路由设备的设计方法

Also Published As

Publication number Publication date
CN107800627A (zh) 2018-03-13
CN107800627B (zh) 2021-04-06

Similar Documents

Publication Publication Date Title
WO2018045862A1 (zh) 三态内容寻址存储器tcam表的写入方法及装置
US10411951B2 (en) Network policy conflict detection and resolution
US11863591B2 (en) On-demand security policy provisioning
US10284390B2 (en) Techniques for efficient service chain analytics
US9197563B2 (en) Bypassing congestion points in a converged enhanced ethernet fabric
US20160182385A1 (en) Shortening of service paths in service chains in a communications network
US10567345B2 (en) Verifying firewall filter entries using rules associated with an access control list (ACL) template
US20160205018A1 (en) Hardware and software methodologies for creating and managing protable service function chains
US20190036782A1 (en) Network modification impact prediction
US10187286B2 (en) Method and system for tracking network device information in a network switch
CN109067585B (zh) 一种查询acl表项下发方法及装置
US20180167337A1 (en) Application of network flow rule action based on packet counter
US20210359929A1 (en) Analysis of routing policy application to routes
CN114915587A (zh) 流表老化管理方法及相关设备
WO2016179973A1 (zh) 一种基于访问控制列表acl的流量统计方法及装置
EP3613228A1 (en) Regulation based switching system for electronic message routing
WO2017054469A1 (zh) 数据流的镜像处理方法及装置
US10764177B2 (en) Efficient implementation of complex network segmentation
US20160337232A1 (en) Flow-indexing for datapath packet processing
CN113595919A (zh) 一种负载分担的方法及装置
US20180198704A1 (en) Pre-processing of data packets with network switch application -specific integrated circuit
CN111107142B (zh) 业务访问方法和装置
US20090119661A1 (en) Method and System for Providing a Filter for a Router
US20180183712A1 (en) Traffic control method and apparatus
US10862801B1 (en) Selective media access control (MAC) learning and purging to reduce flooding and replication in a network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17848035

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17848035

Country of ref document: EP

Kind code of ref document: A1