3.2.34. fast-path¶

Note

requires a Product License.

Fast path configuration.

vsr running config# system fast-path

enabled (pushed)¶

Enable or disable the fast path.

vsr running config# system fast-path
vsr running fast-path# enabled true|false

Default value: true

port¶

A physical network port managed by the fast path.

vsr running config# system fast-path
vsr running fast-path# port PORT

`PORT` values	Description
<pci-port-name>	PCI port name.
<device-tree-port-name>	Device tree port name.
<hyper-v-port-name>	Hyper-V port name.

core-mask¶

Dedicate cores to fast path or exception path.

vsr running config# system fast-path core-mask

fast-path¶

List of cores dedicated to fast path.

vsr running config# system fast-path core-mask
vsr running core-mask# fast-path FAST-PATH

`FAST-PATH` values	Description
max	Dedicate the maximum number of cores to the fast path.
half	Dedicate half of the cores to the fast path.
min	Dedicate the minimum number of cores to the fast path.
<coremask>	A comma-separated list of cores or core ranges. Example: ‘1,4-7,10-12’.

exception¶

Control plane cores allocated to exception packets processing. If unset, use the first non fast path core.

vsr running config# system fast-path core-mask
vsr running core-mask# exception EXCEPTION

EXCEPTION

A comma-separated list of cores or core ranges. Example: ‘1,4-7,10-12’.

linux-to-fp¶

Fast path cores that can receive packets from Linux. It must be included in fast path mask. If unset, all fast path cores can receive packets from Linux.

vsr running config# system fast-path core-mask
vsr running core-mask# linux-to-fp LINUX-TO-FP

LINUX-TO-FP

A comma-separated list of cores or core ranges. Example: ‘1,4-7,10-12’.

qos (deprecated)¶

Attention

Deprecated since: 2021-11-16
Obsolete in release: 22q3
Description: Setting a QoS coremask is no longer supported. There is no need to dedicate a coremask as regular cores now process qos.
Replacement: none

Fast path cores dedicated for qos schedulers. These cores do not received any packets from the NIC or Linux.

vsr running config# system fast-path core-mask
vsr running core-mask# qos QOS

QOS	A comma-separated list of cores or core ranges. Example: ‘1,4-7,10-12’.

port¶

Map fast path cores with network ports, specifying which logical cores poll which ports. Example: ‘c1=0:1/c2=2/c3=0:1:2’ means the logical core 1 polls the port 0 and 1, the core 2 polls the port 2, and the core 3 polls the ports 0, 1, and 2. If unset, each port is polled by all the logical cores of the same socket.

vsr running config# system fast-path core-mask
vsr running core-mask# port <core-port-map>

cp-protection¶

Control plane protection configuration.

vsr running config# system fast-path cp-protection

budget¶

Maximum CPU usage allowed for Control Plane Protection in percent.

vsr running config# system fast-path cp-protection
vsr running cp-protection# budget <int16>

Default value: 10

crypto¶

Fast path crypto configuration.

vsr running config# system fast-path crypto

driver¶

Crypto driver. If unset, select automatically.

vsr running config# system fast-path crypto
vsr running crypto# driver DRIVER

`DRIVER` values	Description
multibuffer	Intel multibuffer library.
quickassist	Intel quickassist.
dpdk-pmd	DPDK crypto PMD.
octeontxcpt	Marvell Octeon TX.
octeontx2cpt	Marvell Octeon TX2.

offload-core-mask¶

Fast path cores that can do crypto operations for other fast path cores. It must be included in fast path mask. The crypto offloading is always done on cores in the same NUMA node.

vsr running config# system fast-path crypto
vsr running crypto# offload-core-mask OFFLOAD-CORE-MASK

`OFFLOAD-CORE-MASK` values	Description
<coremask>	A comma-separated list of cores or core ranges. Example: ‘1,4-7,10-12’.
none	Disable crypto offload.

nb-session¶

Maximum number of cryptographic sessions.

vsr running config# system fast-path crypto
vsr running crypto# nb-session <uint32>

nb-buffer¶

Maximum number of cryptographic buffers, representing the maximum number of in-flight operations, either being processed by the asynchronous crypto engine, or waiting in crypto device queues.

vsr running config# system fast-path crypto
vsr running crypto# nb-buffer <uint32>

advanced¶

Advanced configuration for fast path.

vsr running config# system fast-path advanced

nb-mbuf¶

Number of mbufs (network packet descriptors). The value can be an integer representing the total number of mbufs, an integer prefixed with ‘+’ representing the number of mbufs to add to the automatic value. In case of NUMA, the value can be a per-socket list. If unset, nb-mbuf is determined automatically.

vsr running config# system fast-path advanced
vsr running advanced# nb-mbuf <nb-mbuf>

machine-memory¶

Set the memory that will be used by the fast path (hugepages, shm, mallocs…) so it can run on a machine with this amount of physical memory.

vsr running config# system fast-path advanced
vsr running advanced# machine-memory <uint32>

mainloop-sleep-delay¶

If set, add a sleep time after each idle mainloop turn. This will drastically decrease performance. If the value is 0, it means it is disabled.

vsr running config# system fast-path advanced
vsr running advanced# mainloop-sleep-delay <uint16>

offload¶

Enable or disabled advanced offload features such as TSO, L4 checksum offloading, or offload information forwarding from a guest to the NIC through a virtual interface. If unset, use default product configuration.

vsr running config# system fast-path advanced
vsr running advanced# offload true|false

vlan-strip¶

Strip the VLAN header from incoming frames if supported by the hardware. By default, vlan stripping feature is disabled.

vsr running config# system fast-path advanced
vsr running advanced# vlan-strip true|false

intercore-ring-size¶

Set the size of the intercore rings, used by dataplane cores to send messages to another dataplane core. The default size depends on the product.

vsr running config# system fast-path advanced
vsr running advanced# intercore-ring-size <uint16>

software-txq¶

Set the default size of Tx software queue. This field must be a power of 2. Default is 0 (no software queue).

vsr running config# system fast-path advanced
vsr running advanced# software-txq <uint16>

mask-irq¶

Mask IRQ on fast path cores to reduce latency and increase zero-loss performance.

vsr running config# system fast-path advanced
vsr running advanced# mask-irq true|false

Default value: true

nb-rxd¶

Set the default number of Rx hardware descriptors for Ethernet ports. The value must be accepted by all devices on the system. If unset, an automatic value is used.

vsr running config# system fast-path advanced
vsr running advanced# nb-rxd <uint16>

nb-txd¶

Set the default number of Tx hardware descriptors for Ethernet ports. The value must be accepted by all devices on the system. If unset, an automatic value is used.

vsr running config# system fast-path advanced
vsr running advanced# nb-txd <uint16>

reserve-hugepages¶

Enable or disable the automatic huge pages allocation by the fast path. When disabled, the user is responsible for providing enough huge pages for the fast path to start. If value is unset, it is disabled by default when running in a container, else it is enabled.

vsr running config# system fast-path advanced
vsr running advanced# reserve-hugepages true|false

arp¶

Enable or disable the fast path ARP management.

vsr running config# system fast-path advanced
vsr running advanced# arp true|false

Default value: true

ipv4-netfilter-cache¶

Enable or disable the IPv4 netfilter cache.

vsr running config# system fast-path advanced
vsr running advanced# ipv4-netfilter-cache true|false

Default value: true

ipv6-netfilter-cache¶

Enable or disable the IPv6 netfilter cache.

vsr running config# system fast-path advanced
vsr running advanced# ipv6-netfilter-cache true|false

Default value: true

ipv4-pre-ipsec-fragmentation¶

Configure IPv4 pre IPsec fragmentation. When enabled, this behavior helps releasing pressure on the decrypting device, as the reassembly will be done on the destination host of the inner packet instead of the decrypting device. It applies only in tunnel mode.

vsr running config# system fast-path advanced
vsr running advanced# ipv4-pre-ipsec-fragmentation IPV4-PRE-IPSEC-FRAGMENTATION

`IPV4-PRE-IPSEC-FRAGMENTATION` values	Description
always	Pre IPsec fragmentation is always performed.
check-df-bit	Pre IPsec fragmentation is performed only if the don’t fragment bit is not set on the inner packet. Applies only to IPv4 inner packets.
off	Post IPsec fragmentation is performed.

Default value: off

ipv6-pre-ipsec-fragmentation¶

Configure IPv6 pre IPsec fragmentation. When enabled, this behavior helps releasing pressure on the decrypting device, as the reassembly will be done on the destination host of the inner packet instead of the decrypting device. It applies only in tunnel mode.

vsr running config# system fast-path advanced
vsr running advanced# ipv6-pre-ipsec-fragmentation IPV6-PRE-IPSEC-FRAGMENTATION

`IPV6-PRE-IPSEC-FRAGMENTATION` values	Description
always	Pre IPsec fragmentation is always performed.
check-df-bit	Pre IPsec fragmentation is performed only if the don’t fragment bit is not set on the inner packet. Applies only to IPv4 inner packets.
off	Post IPsec fragmentation is performed.

Default value: off

ipv6-lpm-long-prefix-optimization¶

Enable the IPv6 longest prefix match algorithm optimization. It improves the next hop lookup performance for routes with a long prefix.

vsr running config# system fast-path advanced
vsr running advanced# ipv6-lpm-long-prefix-optimization true|false

Default value: false

hardware-queue-map¶

Hardware queue map used to change the destination queue according the hash computed on the packet from the RSS function.

vsr running config# system fast-path advanced
vsr running advanced# hardware-queue-map <port> <uint16> <uint16>

<port>

PCI port name.

Hardware queue map table index.

Destination Rx queue.

limits¶

Global runtime limits for fast path.

vsr running config# system fast-path limits

fp-max-if¶

Maximum number of interfaces. It includes physical ports and virtual interfaces like gre, vlan, …

vsr running config# system fast-path limits
vsr running limits# fp-max-if <uint32>

fp-max-vrf¶

Maximum number of VRFs.

vsr running config# system fast-path limits
vsr running limits# fp-max-vrf <uint32>

ip4-max-addr¶

Maximum number of IPv4 addresses.

vsr running config# system fast-path limits
vsr running limits# ip4-max-addr <uint32>

ip4-max-route¶

Maximum number of IPv4 routes.

vsr running config# system fast-path limits
vsr running limits# ip4-max-route <uint32>

ip4-max-neigh¶

Maximum number of IPv4 neighbors.

vsr running config# system fast-path limits
vsr running limits# ip4-max-neigh <uint32>

ip6-max-addr¶

Maximum number of IPv6 addresses.

vsr running config# system fast-path limits
vsr running limits# ip6-max-addr <uint32>

ip6-max-route¶

Maximum number of IPv6 routes.

vsr running config# system fast-path limits
vsr running limits# ip6-max-route <uint32>

ip6-max-neigh¶

Maximum number of IPv6 neighbors.

vsr running config# system fast-path limits
vsr running limits# ip6-max-neigh <uint32>

pbr-max-rule¶

Maximum number of PBR rules.

vsr running config# system fast-path limits
vsr running limits# pbr-max-rule <uint32>

filter4-max-rule¶

Maximum number of IPv4 Netfilter rules.

vsr running config# system fast-path limits
vsr running limits# filter4-max-rule <uint32>

filter6-max-rule¶

Maximum number of IPv6 Netfilter rules.

vsr running config# system fast-path limits
vsr running limits# filter6-max-rule <uint32>

filter4-max-ct¶

Maximum number of IPv4 Netfilter conntracks.

vsr running config# system fast-path limits
vsr running limits# filter4-max-ct <uint32>

filter6-max-ct¶

Maximum number of IPv6 Netfilter conntracks.

vsr running config# system fast-path limits
vsr running limits# filter6-max-ct <uint32>

filter-max-ipset¶

Maximum number of ipsets per VRF.

vsr running config# system fast-path limits
vsr running limits# filter-max-ipset <uint32>

filter-max-ipset-entry¶

Maximum number of entries per ipset.

vsr running config# system fast-path limits
vsr running limits# filter-max-ipset-entry <uint32>

filter-bridge-max-rule¶

Maximum number of bridge filter rules.

vsr running config# system fast-path limits
vsr running limits# filter-bridge-max-rule <uint32>

vxlan-max-port¶

Maximum number of (VXLAN destination port, VRF) pairs.

vsr running config# system fast-path limits
vsr running limits# vxlan-max-port <uint32>

vxlan-max-if¶

Maximum number of VXLAN interfaces.

vsr running config# system fast-path limits
vsr running limits# vxlan-max-if <uint32>

vxlan-max-fdb¶

Maximum number of VXLAN forwarding database entries.

vsr running config# system fast-path limits
vsr running limits# vxlan-max-fdb <uint32>

reass4-max-queue¶

Maximum number of simultaneous reassembly procedures for IPv4.

vsr running config# system fast-path limits
vsr running limits# reass4-max-queue <uint32>

reass6-max-queue¶

Maximum number of simultaneous reassembly procedures for IPv6.

vsr running config# system fast-path limits
vsr running limits# reass6-max-queue <uint32>

ipsec-max-sp¶

Maximum number of IPv4 and IPv6 IPsec SPs.

vsr running config# system fast-path limits
vsr running limits# ipsec-max-sp <uint32>

ipsec-max-sa¶

Maximum number of IPv4 and IPv6 IPsec SAs.

vsr running config# system fast-path limits
vsr running limits# ipsec-max-sa <uint32>

ip-max-lpm-table¶

Maximum number of IPv4 and IPv6 tables.

vsr running config# system fast-path limits
vsr running limits# ip-max-lpm-table <uint32>

ip-max-lpm-memory¶

Amount of memory reserved for IPv4 and IPv6 LPM tree.

vsr running config# system fast-path limits
vsr running limits# ip-max-lpm-memory <uint32>

filter-max-cache¶

Maximum number of IPv4 flows stored in filter cache.

vsr running config# system fast-path limits
vsr running limits# filter-max-cache <uint32>

filter6-max-cache¶

Maximum number of IPv6 flows stored in filter cache.

vsr running config# system fast-path limits
vsr running limits# filter6-max-cache <uint32>

vlan-max-if¶

Maximum number of VLAN interfaces.

vsr running config# system fast-path limits
vsr running limits# vlan-max-if <uint32>

macvlan-max-if¶

Maximum number of MACVLAN (VRRP) interfaces.

vsr running config# system fast-path limits
vsr running limits# macvlan-max-if <uint32>

gre-max-if¶

Maximum number of GRE interfaces.

vsr running config# system fast-path limits
vsr running limits# gre-max-if <uint32>

svti-max-if¶

Maximum number of SVTI interfaces.

vsr running config# system fast-path limits
vsr running limits# svti-max-if <uint32>

pppoe-max-channel¶

Maximum number of PPPoE channels.

vsr running config# system fast-path limits
vsr running limits# pppoe-max-channel <uint32>

mpls-max-label¶

Maximum number of MPLS labels in a route.

vsr running config# system fast-path limits
vsr running limits# mpls-max-label <uint8>

mpls-max-route¶

Maximum number of pure MPLS routes.

vsr running config# system fast-path limits
vsr running limits# mpls-max-route <uint32>

mpls-max-lwt¶

Maximum number of MPLS lightweight tunnels. One is needed for each IP route doing MPLS encapsulation.

vsr running config# system fast-path limits
vsr running limits# mpls-max-lwt <uint32>

qos-max-schedulers¶

Maximum number of interfaces with QoS enabled.

vsr running config# system fast-path limits
vsr running limits# qos-max-schedulers <uint32>

qos-max-filters¶

Maximum number of QoS filter rules.

vsr running config# system fast-path limits
vsr running limits# qos-max-filters <uint32>

qos-max-classes¶

Maximum number of QoS classes.

vsr running config# system fast-path limits
vsr running limits# qos-max-classes <uint32>

bridge-max-if¶

Maximum number of bridge interfaces.

vsr running config# system fast-path limits
vsr running limits# bridge-max-if <uint32>

bridge-max-ports¶

Maximum number of bridge slave ports.

vsr running config# system fast-path limits
vsr running limits# bridge-max-ports <uint32>

bridge-max-fdb¶

Maximum number of bridge forwarding database entries.

vsr running config# system fast-path limits
vsr running limits# bridge-max-fdb <uint32>

fp-cur-if (state only)¶

Current number of interfaces. It includes physical ports and virtual interfaces like gre, vlan, …

vsr> show state system fast-path limits fp-cur-if

fp-cur-vrf (state only)¶

Current number of VRFs.

vsr> show state system fast-path limits fp-cur-vrf

ip4-cur-addr (state only)¶

Current number of IPv4 addresses.

vsr> show state system fast-path limits ip4-cur-addr

ip4-cur-route (state only)¶

Current number of IPv4 routes.

vsr> show state system fast-path limits ip4-cur-route

ip4-cur-neigh (state only)¶

Current number of IPv4 neighbors.

vsr> show state system fast-path limits ip4-cur-neigh

ip6-cur-addr (state only)¶

Current number of IPv6 addresses.

vsr> show state system fast-path limits ip6-cur-addr

ip6-cur-route (state only)¶

Current number of IPv6 routes.

vsr> show state system fast-path limits ip6-cur-route

ip6-cur-neigh (state only)¶

Current number of IPv6 neighbors.

vsr> show state system fast-path limits ip6-cur-neigh

pbr-cur-rule (state only)¶

Current number of PBR rules.

vsr> show state system fast-path limits pbr-cur-rule

filter4-cur-rule (state only)¶

Current number of IPv4 Netfilter rules.

vsr> show state system fast-path limits filter4-cur-rule

filter6-cur-rule (state only)¶

Current number of IPv6 Netfilter rules.

vsr> show state system fast-path limits filter6-cur-rule

filter4-cur-ct (state only)¶

Current number of IPv4 Netfilter conntracks.

vsr> show state system fast-path limits filter4-cur-ct

filter6-cur-ct (state only)¶

Current number of IPv6 Netfilter conntracks.

vsr> show state system fast-path limits filter6-cur-ct

filter-cur-ipset (state only)¶

Current number of ipsets per VRF.

vsr> show state system fast-path limits filter-cur-ipset

vxlan-cur-port (state only)¶

Current number of (VXLAN destination port, VRF) pairs.

vsr> show state system fast-path limits vxlan-cur-port

vxlan-cur-if (state only)¶

Current number of VXLAN interfaces.

vsr> show state system fast-path limits vxlan-cur-if

vxlan-cur-fdb (state only)¶

Current number of VXLAN forwarding database entries.

vsr> show state system fast-path limits vxlan-cur-fdb

ipsec-cur-sp (state only)¶

Current number of IPv4 and IPv6 IPsec SPs.

vsr> show state system fast-path limits ipsec-cur-sp

ipsec-cur-sa (state only)¶

Current number of IPv4 and IPv6 IPsec SAs.

vsr> show state system fast-path limits ipsec-cur-sa

ip-cur-lpm-table (state only)¶

Current number of IPv4 and IPv6 tables.

vsr> show state system fast-path limits ip-cur-lpm-table

ip-cur-lpm-memory (state only)¶

Current amount of memory reserved for IPv4 and IPv6 LPM tree.

vsr> show state system fast-path limits ip-cur-lpm-memory

vlan-cur-if (state only)¶

Current number of VLAN interfaces.

vsr> show state system fast-path limits vlan-cur-if

macvlan-cur-if (state only)¶

Current number of MACVLAN (VRRP) interfaces.

vsr> show state system fast-path limits macvlan-cur-if

gre-cur-if (state only)¶

Current number of GRE interfaces.

vsr> show state system fast-path limits gre-cur-if

svti-cur-if (state only)¶

Current number of SVTI interfaces.

vsr> show state system fast-path limits svti-cur-if

pppoe-cur-channel (state only)¶

Current number of PPPoE interfaces.

vsr> show state system fast-path limits pppoe-cur-channel

mpls-cur-route (state only)¶

Current number of pure MPLS routes.

vsr> show state system fast-path limits mpls-cur-route

mpls-cur-lwt (state only)¶

Current number of MPLS lightweight tunnels. One is needed for each IP route doing MPLS encapsulation.

vsr> show state system fast-path limits mpls-cur-lwt

qos-cur-schedulers (state only)¶

Current number of interfaces with QoS enabled.

vsr> show state system fast-path limits qos-cur-schedulers

qos-cur-filters (state only)¶

Current number of QoS filter rules.

vsr> show state system fast-path limits qos-cur-filters

qos-cur-classes (state only)¶

Current number of QoS classes.

vsr> show state system fast-path limits qos-cur-classes

bridge-cur-if (state only)¶

Current number of bridge interfaces.

vsr> show state system fast-path limits bridge-cur-if

bridge-cur-ports (state only)¶

Current number of bridge slave ports.

vsr> show state system fast-path limits bridge-cur-ports

bridge-cur-fdb (state only)¶

Current number of bridge forwarding database entries.

vsr> show state system fast-path limits bridge-cur-fdb

cg-nat¶

Fast path cg-nat configuration.

vsr running config# system fast-path limits cg-nat

max-conntracks¶

Maximum number of tracked connections.

vsr running config# system fast-path limits cg-nat
vsr running cg-nat# max-conntracks <uint32>

max-nat-entries¶

Maximum number of NAT translations.

vsr running config# system fast-path limits cg-nat
vsr running cg-nat# max-nat-entries <uint32>

max-users¶

Maximum number of users.

vsr running config# system fast-path limits cg-nat
vsr running cg-nat# max-users <uint32>

max-blocks¶

Maximum number of blocks.

vsr running config# system fast-path limits cg-nat
vsr running cg-nat# max-blocks <uint32>

max-block-size¶

Maximum number of ports per block.

vsr running config# system fast-path limits cg-nat
vsr running cg-nat# max-block-size <uint32>

linux-sync¶

Advanced tuning for fast path / Linux synchronization.

vsr running config# system fast-path linux-sync

fpm-socket-size¶

Buffer size of the socket used to communicate between the cache manager and the fast path manager.

vsr running config# system fast-path linux-sync
vsr running linux-sync# fpm-socket-size <uint32>

Default value: 2097152

nl-socket-size¶

Buffer size of the cache manager netlink socket.

vsr running config# system fast-path linux-sync
vsr running linux-sync# nl-socket-size <uint32>

Default value: 67108864

ipset-dump-delay¶

Delay period for polling the ipset content.

vsr running config# system fast-path linux-sync
vsr running linux-sync# ipset-dump-delay <uint32>

Default value: 1

disable¶

Disable synchronization for specific modules.

vsr running config# system fast-path linux-sync
vsr running linux-sync# disable DISABLE

`DISABLE` values	Description
bpf	Disable BPF synchronization (used by traffic capture).
bridge	Disable bridge interface synchronization.
conntrack	Disable connection tracking synchronization.
firewall	Disable firewall synchronization.
gre	Disable GRE interface synchronization.
ipip	Disable IP in IP interface synchronization.
ipsec	Disable IPsec synchronization.
ipset4	Disable IPv4 ipset synchronization (used by firewall IPv4 address/network groups).
ipset6	Disable IPv6 ipset synchronization (used by firewall IPv6 address/network groups).
ipv6	Disable IPv6 synchronization.
lag	Disable LAG interface synchronization.
macvlan	Disable MACVLAN interface synchronization (used by VRRP).
mpls	Disable MPLS synchronization.
nat	Disable NAT synchronization.
svti	Disable SVTI interface synchronization.
vlan	Disable VLAN interface synchronization.
vxlan	Disable VXLAN interface synchronization.

mirror-traffic¶

Mirror traffic.

vsr running config# system fast-path mirror-traffic

from¶

The source of mirroring.

vsr running config# system fast-path mirror-traffic
vsr running mirror-traffic# from interface <interface> vrf <vrf> type <type> \
...   to interface INTERFACE vrf VRF

An interface name.

<vrf>

The vrf name.

`<type>` values	Description
<string>	The type of traffic to mirror.
ingress	Mirror only incoming traffic.
egress	Mirror only outgoing traffic.
both	Mirror both incoming and outgoing traffic.

to¶

The destination of mirroring.

to interface INTERFACE vrf VRF

interface (mandatory)¶

The interface that is mirrored.

interface INTERFACE

INTERFACE

An interface name.

vrf (mandatory)¶

The VRF of the mirrored interface.

vrf VRF

VRF	The vrf name.

cpu-usage (state only)¶

The list of busy percentage per CPU.

busy (state only)¶

The busy percentage.

vsr> show state system fast-path cpu-usage <string> busy