Does anyone know if it is possible to enable both Hardware Offload forwarding and software forwarding (bridge) in a CRS3xx switch?
Here's what I'm trying to do:
Hardware offload every packets on a interface, except for some with special characteristics, say every TCP packets, just for simple testing.
For that, I tried to:
- Bridge with vlan filtering and ingress filtering enabled
- Bridge port with hardware offload enabled
- Switch rule to "Redirect to CPU" packets that match MAC protocol IP, protocol tcp
/interface bridge add ingress-filtering=yes name=bridge vlan-filtering=yes /interface bridge port add bridge=bridge ingress-filtering=yes interface=ether13 pvid=1 /interface ethernet switch rule add mac-protocol=ip ports=ether13 protocol=tcp redirect-to-cpu=yes switch=switch1
The thing is, after I do this, tcp traffic on that interface gets black-holed.. I created a forward accept+log bridge filter rule and nothing gets there.
I also created a nat log bridge rule in order to see what gets there:
/interface bridge filter add action=accept chain=forward in-interface=ether13 log=yes /interface bridge filter add action=accept chain=forward log=yes out-interface=ether13 /interface bridge filter add action=accept chain=input in-interface=ether13 log=yes /interface bridge nat add action=log chain=srcnat out-interface=ether13 /interface bridge nat add action=log chain=dstnat in-interface=ether13
And I can only see traffic in the dstnat chain: Return traffic that just does not knows where to go:
dstnat: in:ether13 out:(unknown 0), src-mac 00:xx:xx:xx:xx:xx, dst-mac c4:xx:xx:xx:xx:xx, eth-proto 0800, TCP (SYN,ACK), 10.0.0.20:80->10.0.0.2:10275, len 52
If I remove the hardware offload from the bridge port, the bridge rule counters increment, logs and traffic starts to flow (via CPU).
So, maybe I'm doing something wrong with the switch rule, or maybe hardware offloading is disabling software forwarding on that interface. Does anyone knows this?
I'm running v6.47.10 (long term) on a CRS328
I apologize if this was already answered elsewhere. I searched for in the forum, but couldn't find any similar question/answer.