I found that the switch chip in CRS and Routerboard supports packet forwarding based on IP matching rule[1][2]. It seems that I can use ACL rule to match IP address and route packets. It can potentially achieve wire-speed routing by doing routing in the switch chip.
Have anyone successfully configured the switch chip to do routing?
Access Control List contains of ingress policy and egress policy engines and allows to configure up to 512 policy rules. It is advanced tool for wire-speed packet filtering, forwarding, shaping and modifying based on Layer2, Layer3 and Layer4 protocol header field conditions.
though i did not try this myself yet, i’ll grab a crs226 and give it a go this week. my thoughts on that:
you have to create the policies in both direction. so this will not be the connected routing you got used to
you will not have connection tracking/firewall/etc which normally happens outside the switch chip.
you will still need a “default gateway” like operation, so a mac address, where the connected hosts will need
to send their packets, so they actually arrive to the switch. packets with DST IP addresses which are not reachable in the connected network segment will not be sent out, but silently dropped by the host.
this can happen using DHCP or statically configured. you will need a VLAN interface configured in the router part, and it’s mac address should be visible in the appropriate VLAN in the switch where the ports are assigned to.
basically what you will do is to catch the packets whose DST IP address matches the addresses in VLAN X before it is normally forwarded to the L3 VLAN interface to the CPU, and you will do a “send-to-new-dst-ports” action.
but there will be no DST mac address rewrite, so it will be passed like unknown unicast traffic (will be flooded). and the target hosts will not process it unless you are using promiscuous mode i think because the DST mac address is not local.
so i guess it will have some shortages. and the rules themselves will not be too easy to maintain.
I am wondering if MikroTik team has considered to make use of switch chip on CRS to do wire speed L3 switching. It can make the CRS a real L3 switch as others understand, not just a L2 switch plus limited speed L3 switching.
In Mikrotik newsletters #57, #58 (April-May 2014) they wrote about features of CRS switches: “IP Routing • Wire-speed static IP routing (Coming soon)”. So, we must wait and hope.
Unfortunately, it seems that we will have to wait long for this feature in MikroTik switches.
In response to my request about this option ([Ticket#2015092666000301], Janis M.), support told me that “the Marketing Department does not understand the Fastpath feature. Now implementation of hardware IP routing is not planned”
What I understand from the theory of operation of real L3 routing switches is that it is always a co-operation between a small router CPU device and the switch hardware.
By default the traffic is sent to the CPU router, so that receives the first packet and acts as a default gateway by answering ARP requests.
When an IP packet is received it normally routes it, but it also dynamically creates an entry in the switch hardware that will forward trafic to this same IP dst address along the same path as the software routing decided.
So, the next packet will be hardware routed.
It is similar to normal switch operation where an L2 table is maintained by the CPU and the switch hardware is programmed to forward packets to ports based on MAC address. Only in this case the IP address is used as a key.
And because of the always limited capacity of the hardware, there has to be some algorithm to clear out old entries to make room for new ones. That could destroy performance when there are more sessions than the actual hardware can support.
So to do real practical IP routing I think there has to be functionality like this in RouterOS, and probably that is what was planned and pre-announced, but not yet written (and maybe never to be written).
I can understand that it is a nice an challenging task for the engineers but they fear that marketing will go through the roof and announce routing performance that in real situations may not be achievable, with the resulting storm of bad comments.