how does L3HW actually works?

RouterOS General
21

that can be ignored as I forgot the actual L3 action, which means a Router does its router-thing and works through the headers. Decapsulates the packet, looking at the ethernet header first which contains the VLAN ID. Using that VLAN ID it knows which of its own VLAN-Interfaces the traffic belongs to. It replaces the MACs according to the new destination and source.

In the case of DHCP current destination and source, the MACs would be just swapped, in the case of routing, the new source, is the MAC of the VLAN interface and the destination MAC, the MAC of the routing destination.
Can I expect that ROS does the same thing as well as when L3HW is happening?


The given examples are basically static and dynamic rules, where traffic can only be controlled by ACL Rules
If you have a CRS3xx with DX8000 or DX4000 Series, you can use the IP Firewall, as this allows you to define which routes are allowed to be FastTrack giving you the option to do L3HW them, all other routes will still go through the CPU.

For those, who don’t have CRS3xx with these chips, as for me (I have a CRS328), what would be configuration look like, if there are two Gateways, one on the Switch for Inter-VLAN-Routing and the second on the Route for IP-Firewall, WAN-Access etc.?
I want to use the CRS328 for Inter-VLAN-Routing only, anything else shall still go to my CCR1009-7G-1C-1S+, which is the exit to the WAN.

Would be there a default gateway configured per VLAN configured, what would redirect non-Inter-VLAN-traffic to the second gateway or shall that be solved by ACL rules?

22

Good read, is there a way to tweak the max amount of fasttrack connections? For instance less memory for l3hw offload but more memory for fasttrack?

23

not to date but, there are some things you have to keep in mind


When the HW limit of Fasttrack or NAT entries is reached, other connections will fall back to the CPU. MikroTik’s smart connection offload algorithm ensures that the connections with the most traffic are offloaded to the hardware.

3 Fasttrack connections share the same HW memory with ACL rules. Depending on the complexity, one ACL rule may occupy the memory of 3-6 Fasttrack connections.

4 MPLS shares the HW memory with Fasttrack connections. Moreover, enabling MPLS requires the allocation of the entire memory region, which could store up to 768 (0.75K) Fasttrack connections otherwise. The same applies to Bridge Port Extender. However, MPLS and BPE may use the same memory region, so enabling them both doesn’t double the limitation of Fasttrack connections.

quoted from

https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOffloading-L3HWDeviceSupport

24

I got answers from support:

VLAN ID is

  1. stripped off when routing from VLAN tagged Subnet to non VLAN tagged Subnet / Gateway
  2. is replaced, when routing from one VLAN to another VLAN?

would be great if some could help me on

the best strategy for CRS328 is when the routing to www happens on the router and only inter-VLAN-routing shall happen on the CRS328?

25

But isn’t quite inefficent to try to store millions of routes in a HW FIB ?

Cisco once solved it many years ago with caching “active traffic” in the hardware, but letting “unused” routes just reside in regular memory until needed.

It’s not likley that you will communicate with the whole world simultaneously.

26

It may be inefficient, but it’s the measuring stick by which “real” DFZ routers are measured.

27

bump

28

Stacking multiple CCR2x16 for full BGP table offloading wouldn’t be cost-efficient. On the other hand, CRS317 is reasonably cheap for its switch chip capabilities.

For example, get four CRS317 and bridge them together. Create routing filters to accept dynamic routes only within the 0.0/2 range on the first router. Add a static route to route 64.0/2 traffic to router #2, 128.0/2 - to R3, and 192.0/2 - to R4. The second router accepts dynamic routes in 64.0/2, route 0.0/2 to R1, etc. As a result, you split the full BGP table into four hardware routers (switch chips). Well, route count in different subnets is uneven, and you need to fine-tune the ranges or maybe introduce the fifth CRS317, but I hope you got the idea.

29

L3 Hardware Offloading or Offloading Fasttrack Connections works for vlans ? Testing CCR2216-1G-12XS-2XQ but not working for vlans.

30

Which RouterOS version are you using? VLAN FastPath/FastTrack support has been introduced in RouterOS v7.2.

31

I am using v7.2.1. If works please help to configure it.

32

Show me your setup:

/interface export
/ip export
33

[admin@2216-1] >

/interface/export 
# apr/27/2022 18:18:35 by RouterOS 7.2.1
# software id = 13BN-J2X6
#
# model = CCR2216-1G-12XS-2XQ
# serial number = HCA07HJM7WW
/interface vlan
add interface=qsfp28-1-1 name=vlan101 vlan-id=101
add interface=qsfp28-1-1 name=vlan102 vlan-id=102
add interface=qsfp28-1-1 name=vlan103 vlan-id=103
add interface=qsfp28-2-1 name=vlan201 vlan-id=201
add interface=qsfp28-2-1 name=vlan202 vlan-id=202
add interface=qsfp28-2-1 name=vlan203 vlan-id=203
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface ethernet switch port
set 0 l3-hw-offloading=no
set 4 l3-hw-offloading=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik


[admin@2216-1] > /ip/export 
# apr/27/2022 18:21:45 by RouterOS 7.2.1
# software id = 13BN-J2X6
#
# model = CCR2216-1G-12XS-2XQ
# serial number = HCA07HJM7WW
/ip address
add address=192.168.11.1/24 interface=qsfp28-1-1 network=192.168.11.0
add address=192.168.21.1/24 interface=qsfp28-2-1 network=192.168.21.0
add address=192.168.22.1/24 interface=vlan202 network=192.168.22.0
add address=192.168.12.1/24 interface=vlan102 network=192.168.12.0
/ip dhcp-client
add interface=ether1
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes protocol=tcp
add action=accept chain=forward connection-state=established,related
/ip smb shares
add comment="default share" directory=/pub name=pub
/ip smb users
add name=guest
[admin@2216-1] >
34

3 CCR2216 connected with QSFP28

35

Hardware Inter-VLAN Routing requires a Hardware Bridge for VLAN tagging. More info here.

36

Configuration will be same as switch?

37

L3 Hardware Offloading working with below configuration. VLAN interface doesn’t show any bandwidth. Now what to do for Offloading Fasttrack Connections?

[admin@2216-1] > /interface/export 
# apr/27/2022 19:05:55 by RouterOS 7.2.1
# software id = 13BN-J2X6
#
# model = CCR2216-1G-12XS-2XQ
# serial number = HCA07HJM7WW
/interface bridge
add ingress-filtering=no name=bridge1 vlan-filtering=yes
/interface vlan
add interface=bridge1 name=vlan101 vlan-id=101
add interface=bridge1 name=vlan102 vlan-id=102
add interface=bridge1 name=vlan103 vlan-id=103
add interface=bridge1 name=vlan201 vlan-id=201
add interface=bridge1 name=vlan202 vlan-id=202
add interface=bridge1 name=vlan203 vlan-id=203
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=bridge1 interface=qsfp28-1-1
add bridge=bridge1 interface=qsfp28-2-1
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,qsfp28-1-1 vlan-ids=100-110
add bridge=bridge1 tagged=bridge1,qsfp28-2-1 vlan-ids=200-210
[admin@2216-1] > 
[admin@2216-1] > /ip/export 
# apr/27/2022 19:06:14 by RouterOS 7.2.1
# software id = 13BN-J2X6
#
# model = CCR2216-1G-12XS-2XQ
# serial number = HCA07HJM7WW
/ip address
add address=192.168.11.1/24 interface=vlan101 network=192.168.11.0
add address=192.168.21.1/24 interface=vlan201 network=192.168.21.0
add address=192.168.22.1/24 interface=vlan202 network=192.168.22.0
add address=192.168.12.1/24 interface=vlan102 network=192.168.12.0
38

VLAN interfaces do not show bandwidth because Inter-VLAN routing is fully offloaded to the hardware, and the traffic never enters the CPU. To redirect initial traffic to CPU (e.g., to use IP Firewall), disable l3-hw-offloading of the respective switch ports:

/interface/ethernet/switch/port
set qsfp28-1-1 l3-hw-offloading=no
set qsfp28-2-1 l3-hw-offloading=no
39

When WAN has vlans & LAN has vlans. How to configure Fasttrack Connections Offloading + NAT ?
Below configurations are not working properly

/interface bridge
add ingress-filtering=no name=bridge1 vlan-filtering=yes
/interface vlan
add interface=bridge1 name=vlan101 vlan-id=101
add interface=bridge1 name=vlan102 vlan-id=102
add interface=bridge1 name=vlan103 vlan-id=103
add interface=bridge1 name=vlan201 vlan-id=201
add interface=bridge1 name=vlan202 vlan-id=202
add interface=bridge1 name=vlan203 vlan-id=203
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface ethernet switch port
set 0 l3-hw-offloading=no
set 1 l3-hw-offloading=no
set 2 l3-hw-offloading=no
set 3 l3-hw-offloading=no
set 4 l3-hw-offloading=no
set 5 l3-hw-offloading=no
set 6 l3-hw-offloading=no
set 7 l3-hw-offloading=no
set 8 l3-hw-offloading=no
set 9 l3-hw-offloading=no
set 10 l3-hw-offloading=no
set 11 l3-hw-offloading=no
set 12 l3-hw-offloading=no
set 13 l3-hw-offloading=no
set 14 l3-hw-offloading=no
set 15 l3-hw-offloading=no
set 16 l3-hw-offloading=no
set 17 l3-hw-offloading=no
set 18 l3-hw-offloading=no
set 19 l3-hw-offloading=no
/interface bridge port
add bridge=bridge1 interface=qsfp28-1-1
add bridge=bridge1 interface=qsfp28-2-1
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,qsfp28-1-1 vlan-ids=100-110
add bridge=bridge1 tagged=bridge1,qsfp28-2-1 vlan-ids=200-210
/ip address
add address=192.168.11.1/24 interface=vlan101 network=192.168.11.0
add address=192.168.21.1/24 interface=vlan201 network=192.168.21.0
add address=192.168.22.1/24 interface=vlan202 network=192.168.22.0
add address=192.168.12.1/24 interface=vlan102 network=192.168.12.0
add address=192.168.13.1/24 interface=vlan103 network=192.168.13.0
add address=192.168.23.1/24 interface=vlan203 network=192.168.23.0
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes protocol=tcp
add action=accept chain=forward connection-state=established,related
/ip firewall nat
add action=masquerade chain=srcnat out-interface=vlan101
add action=masquerade chain=srcnat out-interface=vlan102
add action=masquerade chain=srcnat out-interface=vlan103
40

try this

http://forum.mikrotik.com/t/no-route-from-lan-to-wan/157213/2