VSC7511 datasheet(25/324 Pages) MICROSEMI

25 / 324 page

Product Overview

VMDS-10488 VSC7511 Datasheet Revision 4.2

Figure 3 •

Versatile Content Aware Processor

The VCAP uses a TCAM-based frame processor enabling implementation of a rich set of security

features. The flexible VCAP engine supports wire-speed frame inspection based on Layer 2-4 frame

information, including the ability to perform longest prefix matching and identifying port ranges. The

action associated with each VCAP entry (programmed into the VCAP action RAM) includes the ability to

do frame filtering, dual leaky bucket rate limitation (frame or byte based), snooping to CPU, redirection to

CPU, mirroring, 1588 time stamping, and accounting. Even though the VCAP is located in the ingress

path of the device, it possesses both ingress and egress capabilities.

The VCAP embeds powerful protocol awareness for well-known protocols such as LLC, SNAP, ARP,

IPv4, IPv6, and UDP/TCP. IPv6 is supported with full matching against both the source and the

destination IP addresses.

Each frame is looked up three times in IS2. The first lookup is a host match lookup for IPv4 and IPv6

frames enabling MAC/IP binding and IP source guarding. The key consists of information identifying the

source host: ingress port number, source MAC address, and full source IP address. The output is an

action informing the following two lookups in IS2 of whether the host is accepted into the network. The

following two lookups in IS2 construct a key based on the frame type (LLC, SNAP, ARP, IPv4, IPv6,

UDP/TCP, OAM, custom) extracting relevant information. IS2 supports up to 256 host match entries, 128

LLC, SNAP, ARP, IPv4-TCP/UDP, or OAM entries and 64 IPv6-TCP/UDP, and custom entries.

2.3.4

Policing

Each frame is subject to a number of different policing operations. The device features 192

programmable policers. The policers are split into the followings groups:

•

Queue policers: ingress port number and QoS class determine which policer to use.

•

Port policers: ingress port number determines which policer to use.

•

VCAP IS2 policers: an IS2 action can point to a policer.

The internal CPU port is the 12th port and also includes port and queue policers. The policers can

measure frame rates or bit rates.

Each frame can trigger up to three policers: a queue policer, a port policer, and a VCAP IS2 policer.

Each policer is a MEF-compliant dual leaky bucket policer supporting both color-blind and color-aware

operation. The initial frame color is derived from the drop precedence level from the frame classification.

For color-aware operation, a coupling mode is configurable for each policer.

VCAP-II Security Enforcement

IS2 Host Match Lookup

IS2 First Lookup

IS2

Classified VLAN

Custom lookup

Security profile (PAG)

Frame Data

ACL Actions:

Permit

Deny

Police

Redirect

CPU copy

Mirror

Timestamp

Classified DSCP

Key: L2-L4 frame data depending

on frame type

IS2 Second Lookup

Key: SMAC and SIP

VSC7511 bảng dữ liệu(PDF) 25 Page - Microsemi Corporation

VSC7511 bảng dữ liệu(HTML) 25 Page - Microsemi Corporation

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

bảng dữ liệu tải về

Link URL