Skip to content

Conversation

@ArthiGovindaraj
Copy link

@ArthiGovindaraj ArthiGovindaraj commented Nov 22, 2022

  • Added SONIC yang for src mac, dst mac, vlan id, vlan pcp, vlan dei
  • This is updated for schema reference purpose.
    Added support for L2_TABLE related match fields for configuring rules to ACL L2 TABLE

sonic-net/sonic-swss#2554
[https://github.com/sonic-net/sonic-utilities/pull/2516

Why I did it

ACL supports only L3 and L3V6 table type. There is no support for matching L2 fields.
When user wants to match fields like SRC_MAC, DST_MAC, VLAN_ID, VLAN_PCP, VLAN_DEI we do not have support for these fields in sonic yang.
Added support for these fields in sonic-acl.yang.

How I verified it

Create L2 Table from CLICK
"config acl add table -s ingress -p <table_name> L2"
Add rules using CONFIG_DB format
add rules src mac, dst mac, ether type, pcp, dei & vlan id
"L2_TABLE|RULE_2": {
"SRC_MAC": "00:00:00:11:11:11/00:00:00:ff:ff:ff",
"DST_MAC": "00:00:00:22:22:22/00:00:00:ff:ff:ff",
"ETHER_TYPE": "0x0800",
"VLAN_ID": "100",
"VLAN_PCP": "5/7",
"VLAN_DEI": "1",
"PRIORITY": "5",
"PACKET_ACTION": "DROP"
}
Validate commands "show acl table"
Validate commands and fields in "show acl rule"
Validate commands "aclshow -a" /* Ensured that the counters are hitting the relevant rule */
Add rules using openconfig json format for supported fields "config acl update full/incremental <file.json>"
"source-mac": "00:00:00:11:11:12",
"source-mac-mask": "00:00:00:ff:ff:ff",
"destination-mac": "00:00:00:11:11:13",
"destination-mac-mask": "00:00:00:ff:ff:ff",
"ethertype": "ETHERTYPE_ARP"
All the rules are added for each field and combinations as well. and each field tested with traffic in Broadcom based platform.

  • 201811
  • 201911
  • 202006
  • 202012
  • 202106
  • 202111
  • 202205

* Added SONIC yang for src mac, dst mac, vlan id, vlan pcp, vlan dei
Copy link

@tomek-US tomek-US left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thovikeerthi
Copy link

Please inform are these changes merged to master branch ? Does master code base have support for L2 ACL for MAC address ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants