WEBVTT 00:00:01.000 --> 00:00:07.000 Let's dig into some device architecture now. 00:00:07.000 --> 00:00:14.000 In this particular case, we're going to have to be well aware of a multitude of terms and definitions for the certification exam. 00:00:14.000 --> 00:00:22.000 So the first discussion I want to have is about planes, not the ones that fly, planes within our device. 00:00:22.000 --> 00:00:28.000 So in the context of networking devices, we have the concept of planes. 00:00:28.000 --> 00:00:33.000 And this is not only true for Cisco networking equipment, it's true for all networking equipment. 00:00:33.000 --> 00:00:35.000 We have the concept of planes. 00:00:35.000 --> 00:00:45.000 And planes refers to the different functional layers within our devices architecture. 00:00:45.000 --> 00:00:46.000 These planes help what? 00:00:46.000 --> 00:00:55.000 They help us organize and compartmentalize various tasks and functions that the networking device is going to have to perform. 00:00:55.000 --> 00:01:05.000 And each plane serves a very specific purpose and is going to contribute to the overall operation of the device itself. 00:01:05.000 --> 00:01:07.000 So starting here with the data plane. 00:01:08.000 --> 00:01:18.000 The data plane, also known as the forwarding plane, is going to be responsible for the actual forwarding of data packets. 00:01:18.000 --> 00:01:21.000 So our end user traffic. 00:01:21.000 --> 00:01:33.000 So the frames, the packets, the actual traffic that's coming from a PC in some sort of VLAN, subnet, broadcast domain, going where? 00:01:33.000 --> 00:01:37.000 Some web server, wherever it happens to be, on the internet, in a data center, doesn't matter. 00:01:37.000 --> 00:01:39.000 That's our data plane. 00:01:39.000 --> 00:01:47.000 So the data plane handles the routing, the switching of packets based on their destination addresses, their MAC addresses, their IP addresses. 00:01:47.000 --> 00:01:52.000 And so it's going to be using tables at the data plane. 00:01:52.000 --> 00:01:54.000 You can see some tables here. 00:01:55.000 --> 00:02:07.000 The CAM table, MAC address table, CAM table, our forwarding table, our forwarding information base, our adjacency table, our adjacency information base, more on those later, very important. 00:02:07.000 --> 00:02:10.000 So this plane is what? 00:02:10.000 --> 00:02:17.000 Concerned with the efficient movement of data and doesn't make any high level decisions. 00:02:18.000 --> 00:02:28.000 The control plane is responsible for making those high level decisions about how data should be forwarded. 00:02:28.000 --> 00:02:34.000 It maintains the routing tables, the MAC address tables. 00:02:34.000 --> 00:02:44.000 It's the one responsible for using our dynamic routing protocols to learn information and build our tables. 00:02:45.000 --> 00:02:51.000 It's the plane that's responsible for our ARPing and populating an ARP cache. 00:02:51.000 --> 00:03:09.000 It's the brains of the device, calculating the routes, resolving the network addresses, updating routing information, using spanning tree protocol, building and sending those BPDUs. 00:03:10.000 --> 00:03:19.000 Processing the DTP messages, the VTP messages, the Ether channel LACP or PEGP messages, and the list goes on and on and on. 00:03:19.000 --> 00:03:20.000 That's the control plane. 00:03:20.000 --> 00:03:22.000 That's what it's doing. 00:03:22.000 --> 00:03:24.000 And then you have the management plane. 00:03:24.000 --> 00:03:30.000 The management plane is really all about those protocols and services we can use to manage the device itself. 00:03:30.000 --> 00:03:37.000 So any tasks related to configuration, monitoring, maintenance by you as an administrator, it falls under this particular plane. 00:03:38.000 --> 00:03:41.000 And so the benefits of having these different planes are what? 00:03:41.000 --> 00:03:42.000 Well, number one, security, right? 00:03:42.000 --> 00:03:50.000 If we isolate the control plane from the data plane, it's possible to prevent unauthorized access to critical routing and control functions. 00:03:50.000 --> 00:03:54.000 So enhancing overall network security by having these different layers. 00:03:54.000 --> 00:04:05.000 Performance is also improved because if we can separate the data plane and the control plane again, the performance can be improved because this layer can focus on just forwarding of packets, 00:04:05.000 --> 00:04:09.000 while this layer can focus on making decisions. 00:04:09.000 --> 00:04:14.000 Making decisions like how to build the tables that are necessary to forward the packets. 00:04:14.000 --> 00:04:21.000 You keep those separate, then you can associate specific resources to do this and certain resources to do that. 00:04:21.000 --> 00:04:26.000 If they don't have to do the same thing or interfere with each other, you get better performance. 00:04:26.000 --> 00:04:28.000 And you get resiliency as well. 00:04:28.000 --> 00:04:30.000 Why do you get resilience in this particular case? 00:04:30.000 --> 00:04:36.000 Because if one plane experiences issues, it's isolated from the other planes. 00:04:36.000 --> 00:04:40.000 And so what happens in one plane should not affect another plane. 00:04:40.000 --> 00:04:50.000 Meaning a failure of the control plane should not necessarily disrupt the data forwarding that's happening in the data plane. 00:04:50.000 --> 00:04:53.000 Stateful switchover, nonstop forwarding. 00:04:53.000 --> 00:04:54.000 Remember those? 00:04:54.000 --> 00:04:55.000 Yes. 00:04:56.000 --> 00:04:59.000 So there's a good example of how when you have different planes, 00:04:59.000 --> 00:05:06.000 that you can have nonstop forwarding of the data plane while a switchover is happening at the control plane. 00:05:06.000 --> 00:05:10.000 So know at a high level these different planes. 00:05:10.000 --> 00:05:15.000 More importantly, control plane and data plane as I've described them to you. 00:05:15.000 --> 00:05:20.000 However, we still have to learn about the RIB, the FIB. 00:05:20.000 --> 00:05:23.000 What's really going on here with these different types of tables? 00:05:23.000 --> 00:05:25.000 Yes, exam relevant. 00:05:25.000 --> 00:05:30.000 So routing information base and forwarding information base. 00:05:32.000 --> 00:05:39.000 Two distinct components within our routing architecture, within our devices architecture. 00:05:41.000 --> 00:05:42.000 They are related. 00:05:42.000 --> 00:05:49.000 They kind of work together, but they serve two completely different purposes in the end. 00:05:50.000 --> 00:05:55.000 All because they are in different planes. 00:05:58.000 --> 00:06:05.000 I encourage you to be able to compare and contrast RIB versus FIB in Encore. 00:06:06.000 --> 00:06:09.000 So let's talk about them. 00:06:09.000 --> 00:06:12.000 The RIB is responsible for what? 00:06:12.000 --> 00:06:29.000 The RIB is responsible for storing, managing, all the routing information that has been learned from the multitude of sources that you have running on that device. 00:06:29.000 --> 00:06:38.000 For example, your routing protocols like OSPF, BGP, EIGRP, static routes, connected routes. 00:06:38.000 --> 00:06:47.000 All of those help populate our RIB, our routing information base. 00:06:47.000 --> 00:06:53.000 And our device has to process and calculate all that information, all those details. 00:06:53.000 --> 00:06:56.000 So think about administrative distance, think about metrics. 00:06:56.000 --> 00:06:57.000 All of that comes into play. 00:06:57.000 --> 00:07:02.000 We're at the control plane to help build that RIB, that routing information base. 00:07:03.000 --> 00:07:07.000 So when you typically type in show IP route, you're really looking at the RIB in the control plane, folks. 00:07:07.000 --> 00:07:09.000 That's really what you're looking at. 00:07:10.000 --> 00:07:23.000 The FIB, on the other hand, is responsible for really just forwarding network traffic in an optimized way, as fast and efficiently as it possibly can down at the data plane. 00:07:23.000 --> 00:07:30.000 So the FIB, the forwarding information base, is in the data plane. 00:07:31.000 --> 00:07:37.000 It's all about optimizing the forwarding of network traffic. 00:07:42.000 --> 00:07:44.000 So the RIB contains what? 00:07:44.000 --> 00:07:55.000 The RIB contains a comprehensive list of all the available routes, the different destination networks, the details that are necessary. 00:07:56.000 --> 00:07:57.000 But again, it's at the control plane. 00:07:57.000 --> 00:07:58.000 But again, it's at the control plane. 00:07:58.000 --> 00:08:04.000 If it's at the control plane, then the CPU deals with it. 00:08:06.000 --> 00:08:15.000 But the data plane doesn't need the CPU to do what it needs to do with the FIB. 00:08:15.000 --> 00:08:18.000 So the FIB is what? 00:08:18.000 --> 00:08:22.000 The FIB is a subset of the RIB. 00:08:22.000 --> 00:08:27.000 It is a copy of the best RIB information. 00:08:28.000 --> 00:08:35.000 It contains the best information that is needed in order to forward traffic. 00:08:35.000 --> 00:08:38.000 So the FIB is built from the RIB. 00:08:38.000 --> 00:08:40.000 Let me repeat that in case you didn't hear that. 00:08:40.000 --> 00:08:45.000 The FIB is built based on the information from the RIB. 00:08:46.000 --> 00:08:51.000 And it's the FIB that's actually being used to forward our traffic. 00:08:52.000 --> 00:08:53.000 The forwarding information base. 00:08:53.000 --> 00:08:58.000 So the FIB is our routing table in our data plane. 00:08:59.000 --> 00:09:03.000 Whereas the RIB is our routing table in the control plane. 00:09:03.000 --> 00:09:08.000 So if you're on your device, your Cisco device, you can type in show IP route and you're really looking at the RIB. 00:09:08.000 --> 00:09:13.000 But if you type in show IP set, you're looking at the FIB. 00:09:14.000 --> 00:09:15.000 Let me repeat that. 00:09:15.000 --> 00:09:17.000 Show IP set, you're looking at the FIB. 00:09:17.000 --> 00:09:20.000 Show IP route, you're looking at the RIB. 00:09:21.000 --> 00:09:26.000 So the location, as you've seen, the RIB is the control plane. 00:09:26.000 --> 00:09:27.000 Know that. 00:09:27.000 --> 00:09:28.000 The FIB is the data plane. 00:09:28.000 --> 00:09:31.000 It's programmed into the hardware. 00:09:31.000 --> 00:09:34.000 And it's optimized for quick lookups. 00:09:34.000 --> 00:09:35.000 Why? 00:09:35.000 --> 00:09:36.000 What are we trying to do? 00:09:36.000 --> 00:09:37.000 Traffic comes in. 00:09:37.000 --> 00:09:43.000 Without bugging the CPU, we want to make a decision as quickly as possible and forward it out in egress interface. 00:09:44.000 --> 00:09:47.000 So we want it to be as fast as possible. 00:09:47.000 --> 00:09:49.000 Fast forwarding decisions. 00:09:49.000 --> 00:09:50.000 Whereas the control plane would be slow. 00:09:50.000 --> 00:09:51.000 Why? 00:09:51.000 --> 00:09:53.000 Because the CPU has to get involved. 00:09:53.000 --> 00:09:57.000 And you see, the FIB is only going to be updated if the RIB gets updated. 00:09:57.000 --> 00:10:01.000 So our dynamic routing protocols are running between our devices. 00:10:01.000 --> 00:10:03.000 We're building hello packets. 00:10:03.000 --> 00:10:04.000 We're sending them. 00:10:04.000 --> 00:10:07.000 We're out sending LSAs for OSPF. 00:10:07.000 --> 00:10:09.000 We're sending EIGRP updates for EIGRP. 00:10:10.000 --> 00:10:11.000 Whatever protocols are running. 00:10:11.000 --> 00:10:13.000 And that information is being gathered by the control plane. 00:10:13.000 --> 00:10:15.000 It's being processed by the control plane. 00:10:15.000 --> 00:10:16.000 The RIB is being built. 00:10:16.000 --> 00:10:17.000 The RIB is being updated. 00:10:17.000 --> 00:10:21.000 And then when the updates happen here, then that can be updated down here. 00:10:21.000 --> 00:10:25.000 So there's no actual processing that's going on in the data plane to build a table. 00:10:25.000 --> 00:10:28.000 The table is built from the information of the control plane. 00:10:28.000 --> 00:10:30.000 Can't stress that enough. 00:10:30.000 --> 00:10:34.000 So when you look at your ARP table, your ARP cache, it's up here in the control plane. 00:10:34.000 --> 00:10:37.000 So the ARP table is built from information obtained from what? 00:10:37.000 --> 00:10:39.000 The address resolution protocol. 00:10:39.000 --> 00:10:41.000 Protocol. 00:10:41.000 --> 00:10:45.000 The ARP protocol is used by IP-enabled devices. 00:10:45.000 --> 00:10:47.000 To what? 00:10:47.000 --> 00:10:52.000 Dynamically learn the Ethernet MAC address of other IP-enabled devices on the same subnet 00:10:52.000 --> 00:10:55.000 slash VLAN slash broadcast domain. 00:10:55.000 --> 00:11:02.000 So with that in mind, whenever our router needs to build a frame or our multilayer switch needs to build a frame, 00:11:02.000 --> 00:11:03.000 what does it need to do? 00:11:04.000 --> 00:11:11.000 It needs to send out an ARP request to get the MAC address of the next top IP address so it can build the frame. 00:11:11.000 --> 00:11:16.000 If it already has that in the ARP cache, though, it doesn't have to ARP because it's already done it before. 00:11:16.000 --> 00:11:24.000 So the ARP cache is in the control plane because the process is involved with building the ARP requests 00:11:24.000 --> 00:11:27.000 and receiving the ARP replies and processing all that information and building an ARP cache. 00:11:28.000 --> 00:11:33.000 But again, do we want to get the CPU involved when we're trying to forward frames as quickly as possible, 00:11:33.000 --> 00:11:35.000 as fast as possible through the data plane? 00:11:35.000 --> 00:11:40.000 Well, no, we don't want the control plane to get involved because that requires the CPU to get involved. 00:11:40.000 --> 00:11:42.000 So this is where the adjacency table comes into play. 00:11:42.000 --> 00:11:46.000 The adjacency table, also known as the adjacency information base or the AIB, 00:11:46.000 --> 00:11:55.000 contains the MAC address mappings that we need to make fast, efficient, effective forwarding decisions 00:11:55.000 --> 00:11:57.000 right here at the data plane. 00:11:57.000 --> 00:12:03.000 So this is going to allow our router now, our multilayer switch, when making those forwarding decisions, 00:12:03.000 --> 00:12:09.000 to accept the packet inbound, the frame inbound, using correct terms, 00:12:09.000 --> 00:12:13.000 when the frame comes in, and then from there, make the decisions right here, 00:12:13.000 --> 00:12:19.000 and then forward it out and never have to get the CPU involved. 00:12:20.000 --> 00:12:24.000 Because if the CPU gets involved, that is what we call process switching. 00:12:24.000 --> 00:12:30.000 And we don't want the CPU involved, and that would be Cisco Express forwarding. 00:12:30.000 --> 00:12:36.000 So the term switching, folks, is kind of misleading until somebody explains it to you, 00:12:36.000 --> 00:12:37.000 which I'm going to do right now. 00:12:37.000 --> 00:12:43.000 You see, when we say switch, we typically think of a switch at Layer 2 forwarding frames. 00:12:44.000 --> 00:12:49.000 When we think of a router, we think of something that takes Layer 3 packets 00:12:49.000 --> 00:12:52.000 and makes decisions based on the destination IP address, forwards them. 00:12:52.000 --> 00:12:56.000 But what do we call the process? 00:12:56.000 --> 00:13:02.000 For example, taking a packet or a frame, whatever, that arrives inbound on an interface, 00:13:02.000 --> 00:13:06.000 and then we move it through the device to the exiting interface. 00:13:06.000 --> 00:13:12.000 We actually call this movement here from the incoming interface to the outgoing interface. 00:13:12.000 --> 00:13:15.000 And the movement is called switching. 00:13:15.000 --> 00:13:17.000 That's what it is, regardless of the device. 00:13:17.000 --> 00:13:24.000 So the method which our routers or our switches move packets arriving on an inbound interface 00:13:24.000 --> 00:13:27.000 to the outbound interface so they can be forwarded on. 00:13:27.000 --> 00:13:31.000 So we got process switching, and we got Ceph switching. 00:13:31.000 --> 00:13:35.000 So when it comes to process switching, 00:13:35.000 --> 00:13:43.000 this is the slowest method that our Cisco devices support. 00:13:43.000 --> 00:13:50.000 It's the earliest and least efficient methods that our device could use. 00:13:50.000 --> 00:13:58.000 Why? Because it involves the CPU being involved with every single forwarding decision, 00:13:58.000 --> 00:13:59.000 every single one. 00:13:59.000 --> 00:14:06.000 All right, so consider this from a multilayer switch standpoint. 00:14:06.000 --> 00:14:12.000 So we have our frame that arrives on our inbound interface. 00:14:12.000 --> 00:14:19.000 The frame needs to get sent to the control plane if we're using process switching. 00:14:19.000 --> 00:14:21.000 And so now the CPU gets involved. 00:14:21.000 --> 00:14:22.000 What's the CPU going to do? 00:14:22.000 --> 00:14:27.000 It's going to strip the Layer 2 header information. 00:14:27.000 --> 00:14:33.000 The CPU then has to look up the Layer 3 destination IP address 00:14:33.000 --> 00:14:43.000 and compare it to the RIB, the routing information base. 00:14:43.000 --> 00:14:48.000 It then figures out, based on the information in the routing table, 00:14:48.000 --> 00:14:54.000 what is the exiting interface and the next top IP address. 00:14:54.000 --> 00:15:00.000 Once it figures that out, it checks the ARP cache to see if there's a MAC address 00:15:00.000 --> 00:15:01.000 for that next top IP address. 00:15:01.000 --> 00:15:05.000 If there's not, then it has to send out an ARP request and wait for the ARP reply to come back. 00:15:05.000 --> 00:15:10.000 But if it already has it in the ARP cache, then it can go ahead and use the information. 00:15:10.000 --> 00:15:15.000 So once it has that information, then it can go ahead and build a new frame, the CPU that is. 00:15:15.000 --> 00:15:22.000 So now the new frame is built, and now we can send it down to the outgoing interface so it can be sent. 00:15:22.000 --> 00:15:27.000 So think about the fact that you have billions and billions and billions and billions of packets 00:15:27.000 --> 00:15:29.000 that need to be processed. 00:15:29.000 --> 00:15:31.000 And how big is typically a packet? 00:15:31.000 --> 00:15:34.000 A packet is 1,500 bytes, biggest size. 00:15:34.000 --> 00:15:38.000 So most packets are going to be probably smaller than that, not much. 00:15:38.000 --> 00:15:40.000 And then you get your voice packets that are a lot smaller. 00:15:40.000 --> 00:15:48.000 But in the end, could you imagine every single packet having to go through this? 00:15:48.000 --> 00:15:53.000 And that's the way it used to be. 00:15:53.000 --> 00:15:54.000 Right. 00:15:54.000 --> 00:15:55.000 That's the way it used to be. 00:15:55.000 --> 00:16:00.000 So software running on the CPU is going to be responsible for making the forwarding decision 00:16:00.000 --> 00:16:04.000 on a packet-by-packet-by-packet-by-packet basis. 00:16:04.000 --> 00:16:10.000 It's the most CPU-intensive method that is available on our devices. 00:16:10.000 --> 00:16:12.000 We could still have our devices do this. 00:16:12.000 --> 00:16:16.000 All you have to do is shut off Cisco Express Forwarding. 00:16:16.000 --> 00:16:19.000 So if you want to just shut it off on a single interface, 00:16:19.000 --> 00:16:22.000 you can do that by going to the interface on your device and saying, 00:16:22.000 --> 00:16:26.000 no, the command is, let me write this out for you just in case, 00:16:26.000 --> 00:16:34.000 noiprout, R-O-U-T-E, dash, C-A-C-H-E, cef. 00:16:34.000 --> 00:16:36.000 So essentially you're saying on the interface, 00:16:36.000 --> 00:16:40.000 I don't want to run Cisco Express Forwarding on the interface, 00:16:40.000 --> 00:16:42.000 and I don't want to cache any interface, interface, 00:16:42.000 --> 00:16:45.000 I don't want to cache any information, that's the word, 00:16:45.000 --> 00:16:48.000 information on the interface either. 00:16:48.000 --> 00:16:52.000 So in the end, kick everything to the processor for processing. 00:16:52.000 --> 00:16:53.000 So that's on the interface. 00:16:53.000 --> 00:16:57.000 That's an interface-level command. 00:16:57.000 --> 00:17:04.000 And the global command would be noipcef. 00:17:04.000 --> 00:17:05.000 That's what it would be. 00:17:05.000 --> 00:17:09.000 So if you go to global configuration mode, you type in noipcef, 00:17:09.000 --> 00:17:13.000 you then end up shutting off cef on the entire device. 00:17:13.000 --> 00:17:18.000 That means every single packet would be kicked to the CPU for processing sakes, 00:17:18.000 --> 00:17:21.000 and you don't want that, okay, in modern-day networks. 00:17:21.000 --> 00:17:23.000 That would be bad for your network. 00:17:23.000 --> 00:17:28.000 So Cisco Express Forwarding is actually the default switching method 00:17:28.000 --> 00:17:32.000 that we have running on our Cisco devices. 00:17:32.000 --> 00:17:33.000 So it's our fastest method, 00:17:33.000 --> 00:17:38.000 and the packets are forwarded based on pre-populated tables where? 00:17:38.000 --> 00:17:40.000 In hardware. 00:17:40.000 --> 00:17:45.000 So what we have now is we have this high-performance packet forwarding technology, 00:17:45.000 --> 00:17:50.000 that's a little Cisco marketing there for you, used in our Cisco network devices. 00:17:50.000 --> 00:17:54.000 So our routers, our switches, and so on and so forth using Cisco Express Forwarding. 00:17:54.000 --> 00:17:57.000 So we have significant improvement here over process switching. 00:17:57.000 --> 00:17:58.000 Why is that? 00:17:58.000 --> 00:18:02.000 Well, we get better efficiency, we get better speed, we get better scalability 00:18:02.000 --> 00:18:07.000 because we are not having to rely on the CPU anymore. 00:18:07.000 --> 00:18:08.000 Remember that with process switching, 00:18:08.000 --> 00:18:15.000 the CPU is involved in every decision that has to be made for all the user traffic. 00:18:15.000 --> 00:18:17.000 Whereas with Cisco Express Forwarding, 00:18:17.000 --> 00:18:19.000 we are going to be using the forwarding information base. 00:18:19.000 --> 00:18:25.000 We are going to be using the adjacency information base. 00:18:25.000 --> 00:18:29.000 Cef uses fib and AIB. 00:18:29.000 --> 00:18:30.000 I'm going to repeat that. 00:18:30.000 --> 00:18:34.000 Cef uses fib and AIB. 00:18:38.000 --> 00:18:41.000 So both those tables are created, remember, in advance. 00:18:41.000 --> 00:18:44.000 They are created in advance and they are going to be stored where? 00:18:44.000 --> 00:18:46.000 At the hardware layer. 00:18:46.000 --> 00:18:52.000 So depending on the device, this information can actually be stored on your line cards. 00:18:52.000 --> 00:18:57.000 So not on the supervisor module, but on the line cards themselves. 00:18:57.000 --> 00:19:01.000 And so based on that, just think about the fact that now, 00:19:01.000 --> 00:19:04.000 as traffic comes in on an interface on a line card, 00:19:04.000 --> 00:19:07.000 if it's going to be going out another interface on the same line card, 00:19:07.000 --> 00:19:09.000 it can stay within the line card 00:19:09.000 --> 00:19:14.000 and all the information can be decided right there using these tables. 00:19:14.000 --> 00:19:16.000 It never even has to go through the back plane of the device. 00:19:16.000 --> 00:19:19.000 It can stay within the line card. 00:19:19.000 --> 00:19:20.000 Now, if it had to go to a different line card, 00:19:20.000 --> 00:19:22.000 then it could actually go from line card to line card 00:19:22.000 --> 00:19:26.000 without even needing the supervisor module to get involved. 00:19:26.000 --> 00:19:30.000 So the CPU, the route processor, not needed. 00:19:30.000 --> 00:19:32.000 That's why this is so powerful. 00:19:32.000 --> 00:19:34.000 That's why this is so important. 00:19:34.000 --> 00:19:37.000 So we have what we call here hardware tables. 00:19:37.000 --> 00:19:38.000 I'm going to put those in quotes. 00:19:38.000 --> 00:19:40.000 Why hardware tables? 00:19:40.000 --> 00:19:45.000 Because of the fact that this is down in the hardware layer, not the software layer. 00:19:45.000 --> 00:19:48.000 We consider the control plane our software layer 00:19:48.000 --> 00:19:50.000 because that's where software runs and does things. 00:19:50.000 --> 00:19:51.000 This is our hardware layer. 00:19:51.000 --> 00:19:53.000 No software is running in here. 00:19:53.000 --> 00:19:56.000 We're just trying to take information we have, compare it to a table, 00:19:56.000 --> 00:19:58.000 make a decision, move it on. 00:19:58.000 --> 00:19:59.000 That's what we're trying to do. 00:19:59.000 --> 00:20:03.000 So our AIB, our FIB, hardware tables, 00:20:03.000 --> 00:20:06.000 in case they refer to it that way on the exam, 00:20:06.000 --> 00:20:10.000 they're created ahead of time by information in the control plane, 00:20:10.000 --> 00:20:12.000 as we talked about earlier, 00:20:12.000 --> 00:20:16.000 and then they're going to be put into the data plane for us 00:20:16.000 --> 00:20:20.000 even before the first packet arrives. 00:20:20.000 --> 00:20:23.000 So now the CPU, the control plane, is no longer involved in the forwarding. 00:20:23.000 --> 00:20:25.000 So how is that going to happen? 00:20:25.000 --> 00:20:29.000 Well, the frame arrives on our ingress interface, 00:20:29.000 --> 00:20:32.000 so arriving on an interface inbound. 00:20:32.000 --> 00:20:36.000 And in the Layer 2 header now, it doesn't even have to be taken apart. 00:20:36.000 --> 00:20:38.000 Because up here, with process switching, we said, 00:20:38.000 --> 00:20:41.000 oh, we're going to tear apart, rip apart, destroy the Layer 2 header. 00:20:41.000 --> 00:20:44.000 Well, not with Cisco Express Forwarding. 00:20:44.000 --> 00:20:46.000 We could just preserve the header information. 00:20:46.000 --> 00:20:51.000 We don't have the time or the need to rebuild a frame. 00:20:51.000 --> 00:20:55.000 Let's just preserve that framing information, 00:20:55.000 --> 00:20:59.000 and we'll just rewrite what needs to be rewritten inside, 00:20:59.000 --> 00:21:00.000 making it faster now. 00:21:00.000 --> 00:21:02.000 So we don't have to tear apart and build. 00:21:02.000 --> 00:21:07.000 We just have to erase and add information in it. 00:21:07.000 --> 00:21:10.000 So we look at the Layer 2 header information. 00:21:10.000 --> 00:21:13.000 We make a decision based on that. 00:21:13.000 --> 00:21:17.000 And if we were a router, as an example, 00:21:17.000 --> 00:21:20.000 our MAC address would have been the destination MAC address 00:21:20.000 --> 00:21:23.000 in that particular frame, 00:21:23.000 --> 00:21:26.000 based on our packet forwarding process, right? 00:21:26.000 --> 00:21:28.000 So it comes in, I look, oh, it's my MAC address. 00:21:28.000 --> 00:21:29.000 Okay, so don't delete the frame. 00:21:29.000 --> 00:21:35.000 Just erase what you don't need and preserve all the formatting, 00:21:35.000 --> 00:21:38.000 preserve everything, and just add stuff in after. 00:21:38.000 --> 00:21:40.000 So now what are you going to do? 00:21:40.000 --> 00:21:43.000 You're going to go ahead and look at the destination IP address. 00:21:43.000 --> 00:21:45.000 And now you're going to check it against the FIB and not the RIP. 00:21:45.000 --> 00:21:48.000 The FIB. 00:21:48.000 --> 00:21:50.000 With the FIB, you're going to figure out what the exit interface is. 00:21:50.000 --> 00:21:52.000 You're going to figure out what the next hop IP address is. 00:21:52.000 --> 00:21:54.000 You'll then be able to use the adjacency table 00:21:54.000 --> 00:21:58.000 to figure out the MAC address of the next hop IP address. 00:21:58.000 --> 00:22:02.000 And now you can add that information into the frame that you preserved. 00:22:02.000 --> 00:22:05.000 So erase the destination IP, put the new destination, 00:22:05.000 --> 00:22:07.000 not destination IP, destination MAC. 00:22:07.000 --> 00:22:10.000 Erase the destination MAC, put the new destination MAC in, 00:22:10.000 --> 00:22:13.000 source MAC, erase that, put your source MAC in there, 00:22:13.000 --> 00:22:16.000 and now you can send it out the egress interface. 00:22:16.000 --> 00:22:19.000 So we're just staying in here, and away we go. 00:22:19.000 --> 00:22:22.000 So it's much better, much, much better. 00:22:22.000 --> 00:22:24.000 And this is all done in hardware, as he said, 00:22:24.000 --> 00:22:27.000 in what are called application-specific integrated circuits, 00:22:27.000 --> 00:22:31.000 application-specific integrated circuits, ASICs. 00:22:31.000 --> 00:22:32.000 So if you don't know what an ASIC is, 00:22:32.000 --> 00:22:36.000 an ASIC is an application-specific integrated circuit, all right? 00:22:36.000 --> 00:22:40.000 But what that means, it is designed and fabricated 00:22:40.000 --> 00:22:43.000 for a very specific application for a very specific purpose. 00:22:43.000 --> 00:22:46.000 So think about our networking equipment here. 00:22:46.000 --> 00:22:47.000 What do we need? 00:22:47.000 --> 00:22:52.000 We need ASICs that are tailored to perform a very particular function. 00:22:52.000 --> 00:22:54.000 And what is that going to be? 00:22:54.000 --> 00:22:59.000 Well, it's going to be the ability to accelerate the packet processing 00:22:59.000 --> 00:23:02.000 that we need to have done and improve our data throughput. 00:23:02.000 --> 00:23:08.000 So these are specific ASICs designed to make this happen so fast, 00:23:08.000 --> 00:23:10.000 so that way we can have the tables, we can have the lookups, 00:23:10.000 --> 00:23:14.000 we can have everything we need done as quickly as possible 00:23:14.000 --> 00:23:21.000 with this purpose-built circuit that's going to do it just for us. 00:23:21.000 --> 00:23:23.000 That's exactly what we need. 00:23:23.000 --> 00:23:26.000 So unlike, what, a general-purpose microprocessor 00:23:26.000 --> 00:23:28.000 that can do a multitude of tasks, 00:23:28.000 --> 00:23:31.000 this is designed specifically for accelerating the packet process 00:23:31.000 --> 00:23:33.000 and improving our data throughput. 00:23:33.000 --> 00:23:36.000 Now, not all packets can be processed in hardware. 00:23:36.000 --> 00:23:38.000 Let's be very clear about that. 00:23:38.000 --> 00:23:42.000 And when they can't be processed in hardware, then what has to happen? 00:23:42.000 --> 00:23:44.000 It has to be, the term is, ready for it? 00:23:44.000 --> 00:23:45.000 Punted. 00:23:45.000 --> 00:23:46.000 Punted. 00:23:46.000 --> 00:23:49.000 So anything that needs to go to the control plane is punted. 00:23:49.000 --> 00:23:50.000 Keep that in mind. 00:23:50.000 --> 00:23:51.000 Punted. 00:23:51.000 --> 00:23:55.000 Just like in football, when you punt the ball, 00:23:55.000 --> 00:23:59.000 you are punting it to the control plane in this particular case. 00:23:59.000 --> 00:24:00.000 So when might this happen? 00:24:00.000 --> 00:24:04.000 Well, if the packet destination is actually the router itself, 00:24:04.000 --> 00:24:07.000 like a management packet goes to the router, as an example. 00:24:07.000 --> 00:24:11.000 So if that management packet was an SSH connection to this router, 00:24:11.000 --> 00:24:15.000 well, then it has to be punted to the CPU for processing. 00:24:15.000 --> 00:24:19.000 There is the possibility that the packet might contain IP header options, 00:24:19.000 --> 00:24:23.000 and if it does, it's got to be punted to the control plane for processing. 00:24:23.000 --> 00:24:27.000 If the time to live is expired, well, then what has to happen? 00:24:27.000 --> 00:24:30.000 Well, it needs to be punted to the CPU so the CPU can drop it, 00:24:30.000 --> 00:24:35.000 but then the CPU can create a time-to-live-exceeded message, 00:24:35.000 --> 00:24:37.000 so an ICMP time-to-live-exceeded message, 00:24:37.000 --> 00:24:40.000 and send that back to the original sending device. 00:24:40.000 --> 00:24:43.000 So that way there it knows that the time-to-live was exceeded 00:24:43.000 --> 00:24:46.000 or the packet expired in transit. 00:24:46.000 --> 00:24:49.000 Maybe we have a packet that needs to be sent out a tunnel interface, 00:24:49.000 --> 00:24:51.000 then it's got to be punted to the CPU. 00:24:51.000 --> 00:24:53.000 Why? Because we have to do some encapsulation now. 00:24:53.000 --> 00:24:56.000 We might have a packet that arrives with an unsupported encapsulation type. 00:24:56.000 --> 00:24:59.000 Well, in that case, we punt it to the control plane 00:24:59.000 --> 00:25:02.000 so the control plane can deal with that. 00:25:02.000 --> 00:25:05.000 What about a packet that has an MTU that's too large? 00:25:05.000 --> 00:25:08.000 If the MTU is too large, what has to happen? 00:25:08.000 --> 00:25:10.000 Fragmentation, that's right. 00:25:10.000 --> 00:25:12.000 So fragmentation has to happen, 00:25:12.000 --> 00:25:15.000 so we have to punt it to the CPU for fragmentation to occur, 00:25:15.000 --> 00:25:18.000 and if the do not fragment bit is set, well, then the packet gets dropped, 00:25:18.000 --> 00:25:20.000 but if the do not fragment bit is not set, 00:25:20.000 --> 00:25:23.000 then it can be fragmented in that particular case by the CPU, 00:25:23.000 --> 00:25:25.000 slowing the device down. 00:25:25.000 --> 00:25:27.000 So that's why fragmentation is bad, folks. 00:25:27.000 --> 00:25:30.000 It's because we are no longer using Cisco Express Forwarding 00:25:30.000 --> 00:25:32.000 where packets need to be fragmented. 00:25:32.000 --> 00:25:35.000 We go back to doing good old-fashioned process switching 00:25:35.000 --> 00:25:37.000 for that particular packet. 00:25:37.000 --> 00:25:39.000 All right. 00:25:39.000 --> 00:25:41.000 So with Ceph, we have two different modes. 00:25:41.000 --> 00:25:44.000 We have central Ceph and distributed Ceph. 00:25:44.000 --> 00:25:46.000 What's the difference? 00:25:46.000 --> 00:25:53.000 Well, Ceph is enabled by default, as I said, on our devices, 00:25:53.000 --> 00:25:58.000 but not all devices can have a distributed Ceph architecture, 00:25:58.000 --> 00:26:00.000 and why is that? 00:26:00.000 --> 00:26:03.000 Well, if you think about a lot of your devices, 00:26:03.000 --> 00:26:07.000 they are a standalone router, a standalone switch. 00:26:07.000 --> 00:26:12.000 They're not modular, but they still use Cisco Express Forwarding. 00:26:12.000 --> 00:26:16.000 So in that particular case, the FIB, the adjacency table, 00:26:16.000 --> 00:26:19.000 everything that we have in our data plane is not going to be on our line card, 00:26:19.000 --> 00:26:21.000 per se, right? 00:26:21.000 --> 00:26:25.000 It's still going to be part of our route processor 00:26:25.000 --> 00:26:28.000 on that particular device that we have. 00:26:28.000 --> 00:26:32.000 So we have central switching because no matter what is going on in the device, 00:26:32.000 --> 00:26:35.000 it is happening from a centralized standpoint. 00:26:35.000 --> 00:26:37.000 That's the idea here. 00:26:37.000 --> 00:26:40.000 Whereas with distributed Ceph, think of your modular switches 00:26:40.000 --> 00:26:43.000 with all the different modules you could have. 00:26:43.000 --> 00:26:47.000 Well, when you have a modular switch, then you have your route processor. 00:26:47.000 --> 00:26:51.000 You have your supervisor modules that are going to be in certain slots. 00:26:51.000 --> 00:26:53.000 Well, now you have line cards in the other slots. 00:26:53.000 --> 00:26:57.000 Well, in the distributed Ceph for that particular device, 00:26:57.000 --> 00:27:01.000 what happens is that those tables are actually going to be stored where? 00:27:01.000 --> 00:27:03.000 On the line cards, distributed Cephs. 00:27:03.000 --> 00:27:07.000 Now, the line cards can perform the Express Forwarding by themselves, 00:27:07.000 --> 00:27:11.000 and it relieves the main processor of the involvement 00:27:11.000 --> 00:27:15.000 of being part of this entire process. 00:27:15.000 --> 00:27:19.000 That's the difference between central Ceph and distributed Ceph, 00:27:19.000 --> 00:27:21.000 what it boils down to. 00:27:21.000 --> 00:27:23.000 Now we have our CAM and our TCAM. 00:27:23.000 --> 00:27:27.000 CAM and TCAM, two terms I want you to know for the exam. 00:27:27.000 --> 00:27:31.000 CAM and TCAM are just really referring to the concept of tables 00:27:31.000 --> 00:27:35.000 stored in fast memory so that forwarding decisions are made extremely fast. 00:27:35.000 --> 00:27:37.000 When you think about something like our FIB, where is that? 00:27:37.000 --> 00:27:39.000 Well, that is in our TCAM. 00:27:39.000 --> 00:27:43.000 When you think about our MAC address table, that is in our CAM. 00:27:43.000 --> 00:27:48.000 CAM and TCAM, what are they really? 00:27:48.000 --> 00:27:53.000 CAM, content-addressable memory, used to make Layer 2 forwarding decisions, 00:27:53.000 --> 00:27:55.000 contains our MAC address to port mappings. 00:27:55.000 --> 00:28:02.000 CAM is our table at the hardware layer that has our MAC addressing information in it. 00:28:02.000 --> 00:28:06.000 When you type in show MAC address table, what you're seeing is information 00:28:06.000 --> 00:28:09.000 that would be in the CAM, in your hardware tables, 00:28:09.000 --> 00:28:14.000 or in RAM in your MAC address table. 00:28:14.000 --> 00:28:17.000 Think about your MAC address table that's in RAM, 00:28:17.000 --> 00:28:22.000 for hardware tables stored in CAM, it would essentially be a duplicate of it. 00:28:22.000 --> 00:28:23.000 What do we have? 00:28:23.000 --> 00:28:26.000 We have our VLAN information, our MAC address information, the port, 00:28:26.000 --> 00:28:30.000 so the forwarding decisions can be made that need to be made 00:28:30.000 --> 00:28:32.000 as fast as they possibly can. 00:28:32.000 --> 00:28:34.000 If we didn't have CAM, then it would be in RAM, 00:28:34.000 --> 00:28:37.000 and that would be a lot slower and we'd have to get the CPU involved. 00:28:37.000 --> 00:28:42.000 But because CAM is part of our application-specific integrated circuits, 00:28:42.000 --> 00:28:45.000 we can do this at the hardware layer as opposed to relying on what? 00:28:45.000 --> 00:28:49.000 Software control plane layer making our decisions. 00:28:49.000 --> 00:28:53.000 So, used to make Layer 2 forwarding decisions and recording the MAC address, 00:28:53.000 --> 00:28:57.000 port MAC was learned on, VLAN of the port, so on and so forth, 00:28:57.000 --> 00:29:02.000 at the hardware layer to make fast, efficient, effective forwarding lookups, 00:29:02.000 --> 00:29:04.000 to make our switches as fast as possible. 00:29:04.000 --> 00:29:08.000 And in TCAM, ternary content addressable memory. 00:29:08.000 --> 00:29:10.000 Now, T means ternary. 00:29:10.000 --> 00:29:13.000 It really stands for three when it's all said and done. 00:29:13.000 --> 00:29:17.000 And the way to best understand ternary is to go back and say, 00:29:17.000 --> 00:29:20.000 well, CAM is based on two possible options, 00:29:20.000 --> 00:29:26.000 meaning the answer we're looking for is either in the table or it's not in the table. 00:29:26.000 --> 00:29:32.000 It's either in the table as an exact match, I should say, or it's not in the table at all. 00:29:32.000 --> 00:29:35.000 And you know that from your CCNA days, 00:29:35.000 --> 00:29:40.000 when you're learning about how the switch makes Layer 2 forwarding decisions for frames. 00:29:40.000 --> 00:29:42.000 It looks in the MAC address table. 00:29:42.000 --> 00:29:43.000 Are you there? 00:29:43.000 --> 00:29:45.000 If it is, forward it out the very specific port. 00:29:45.000 --> 00:29:47.000 If you're not in there, then what? 00:29:47.000 --> 00:29:49.000 Flood it out all ports except the port it came in on. 00:29:49.000 --> 00:29:50.000 There you go. 00:29:50.000 --> 00:29:53.000 Those are your two options. 00:29:53.000 --> 00:29:55.000 That is CAM. 00:29:55.000 --> 00:30:00.000 Ternary CAM, ternary content, means we have another option that exists. 00:30:00.000 --> 00:30:02.000 And just think about the routing table. 00:30:02.000 --> 00:30:06.000 So here's an example of the FIB, the Forwarding Information Base, SOAR IPSEF. 00:30:06.000 --> 00:30:10.000 What I want you to realize here is that we could have three possible options, 00:30:10.000 --> 00:30:19.000 either an exact match or a match that's not exact but still works or no match at all. 00:30:19.000 --> 00:30:22.000 And if there's no match at all, what happens? 00:30:22.000 --> 00:30:26.000 You get dropped, right? 00:30:26.000 --> 00:30:30.000 If there's no match at all, you get dropped when it comes to routing. 00:30:30.000 --> 00:30:32.000 If there's an exact match, what does it mean? 00:30:32.000 --> 00:30:38.000 Do exactly what it says. 00:30:39.000 --> 00:30:44.000 And then based on the fact that we could have those multiple matches, 00:30:44.000 --> 00:30:48.000 then we can get as close as possible without being exact. 00:30:48.000 --> 00:30:52.000 That is our third possible option there. 00:30:52.000 --> 00:30:58.000 So if it is in the table, let's say, for example, 10.40.23.A, I'm just going to use that number, for example. 00:30:58.000 --> 00:31:00.000 10.40.23.A, is it in there? 00:31:00.000 --> 00:31:01.000 Yes. 00:31:01.000 --> 00:31:03.000 Do exactly what it says. 00:31:03.000 --> 00:31:08.000 If you're not in the table at all, then drop. 00:31:08.000 --> 00:31:09.000 So then what's the other option? 00:31:09.000 --> 00:31:12.000 The other option is everything in between. 00:31:12.000 --> 00:31:17.000 So think about something like 10.40.12.70. 00:31:17.000 --> 00:31:23.000 10.40.12.70, where is that? 00:31:23.000 --> 00:31:25.000 That would match here. 00:31:25.000 --> 00:31:26.000 Nope, wrong one. 00:31:26.000 --> 00:31:28.000 That would match here. 00:31:28.000 --> 00:31:32.000 That's what that would match. 00:31:32.000 --> 00:31:37.000 So based on it matching that, oh, but also matching that, right? 00:31:37.000 --> 00:31:43.000 Longest match rule comes into play, right? 00:31:43.000 --> 00:31:44.000 This is our winner. 00:31:44.000 --> 00:31:45.000 It's not a perfect match, right? 00:31:45.000 --> 00:31:51.000 It's not actually 10.40.12.70, but that is the best option we have. 00:31:51.000 --> 00:31:53.000 Ternary content and addressable memory. 00:31:53.000 --> 00:31:58.000 And you'll see here that we store not only things like our FIB, but ACL information, 00:31:58.000 --> 00:32:04.000 so we can have quick ACL lookups at the hardware layer instead of bugging the CPU. 00:32:04.000 --> 00:32:08.000 In the olden days, we had to bug the CPU for ACL processing, 00:32:08.000 --> 00:32:13.000 which really slowed down our routers, really slowed them down. 00:32:13.000 --> 00:32:14.000 And that's why we were always, 00:32:14.000 --> 00:32:20.000 always taking the time to create the smallest ACLs possible by combining 00:32:20.000 --> 00:32:24.000 together as many addresses as we possibly could. 00:32:24.000 --> 00:32:29.000 That way there's less lookups that have to happen. 00:32:29.000 --> 00:32:36.000 But now that we are dealing with ACLs in, what, TCAM, hardware layer, 00:32:36.000 --> 00:32:39.000 we don't have to be so perfect with our ACLs. 00:32:39.000 --> 00:32:46.000 If I wanted to create 32 entries for 32 different networks in my ACL, 00:32:46.000 --> 00:32:50.000 instead of one entry that matches them all, I could get away with that nowadays 00:32:50.000 --> 00:32:53.000 because of the fact that this is in the hardware layer now. 00:32:53.000 --> 00:32:58.000 Same thing with QoS information. 00:32:58.000 --> 00:33:01.000 Also hanging out here in TCAM. 00:33:01.000 --> 00:33:06.000 Even policy-based routing information, folks, in TCAM. 00:33:06.000 --> 00:33:08.000 So that way there we don't have to punt it to the CPU. 00:33:08.000 --> 00:33:12.000 Because if we punt it to the CPU, why would I ever want to do policy-based routing then? 00:33:12.000 --> 00:33:18.000 So nowadays, all these features, functions, have the ability to run in TCAM, 00:33:18.000 --> 00:33:21.000 so that way there we can take advantage of them 00:33:21.000 --> 00:33:25.000 and build the best possible networks we possibly can 00:33:25.000 --> 00:33:29.000 with the best, most efficient, fastest forwarding we possibly can. 00:33:29.000 --> 00:33:32.000 All right, so CAM tables found on switches, MAC to port to VLAN mapping, 00:33:32.000 --> 00:33:36.000 Layer 2 forwarding decisions, TCAM tables on multilayer switches and routers, 00:33:36.000 --> 00:33:42.000 ACLs, QoS, Layer 3 processing, and multiple TCAMs exist for better performance. 00:33:42.000 --> 00:33:44.000 So that way there we can do what type of lookups? 00:33:44.000 --> 00:33:46.000 We can do lookups in parallel. 00:33:46.000 --> 00:33:49.000 So while we're looking up the security information and the QoS information, 00:33:49.000 --> 00:33:54.000 we could be making a forwarding decision all at the exact same time. 00:33:54.000 --> 00:33:59.000 So there's a lot we covered, folks, more than many, 00:33:59.000 --> 00:34:03.000 much more than many of you may have hoped for. 00:34:03.000 --> 00:34:05.000 So what I want you to know, I want you to know things like what is the RIB, 00:34:05.000 --> 00:34:08.000 what is the FIB, what is CAM, what is TCAM, what is the control plane, 00:34:08.000 --> 00:34:13.000 what is the data plane, where do I find that ARP cache, that adjacency table, 00:34:13.000 --> 00:34:16.000 where do I find the RIB, where do I find the FIB, what is process switching, 00:34:16.000 --> 00:34:18.000 what is SEF switching. 00:34:18.000 --> 00:34:22.000 Make sure you can differentiate between all of those for the certification exam 00:34:22.000 --> 00:34:26.000 because those are more than likely going to be some of the easier questions you face. 00:34:26.000 --> 00:34:29.000 They're going to be like short one-liner questions, 00:34:29.000 --> 00:34:34.000 and if you don't know exactly what that one-liner is asking you about, 00:34:34.000 --> 00:34:39.000 then you're missing out on, I like to call some of the easier points that you can get 00:34:39.000 --> 00:34:41.000 on the certification exam. 00:34:41.000 --> 00:34:44.000 So make sure you review this, don't take that discussion lightly, 00:34:44.000 --> 00:34:48.000 and be able to differentiate between all of those as I have described them to you 00:34:48.000 --> 00:34:50.000 to get ready for the certification exam.