diff options
| author |   Maciek Konstantynowicz <mkonstan@cisco.com> | 2020-10-05 14:06:18 +0100 |
|---|---|---|
| committer |   Tibor Frank <tifrank@cisco.com> | 2020-10-14 09:53:21 +0000 |
| commit | 20ff48814382aba8ea963c771d2f341471a7aa8a (patch) | |
| tree | d638122dff30f8ad0517d79d6b530c698c3a8c9d /docs/report/introduction/methodology_acls.rst | |
| parent | 7d1c2367786a05274d7e478136e3446dc466f705 (diff) | |
report: updates to methodology section including nat44, acl, ipsec
Change-Id: I13464728d903cba14feedd3cfb78226d50f3d4a1
Signed-off-by: Maciek Konstantynowicz <mkonstan@cisco.com>
(cherry picked from commit ef9bab0a1b87871a8365e766a19971f0ec0b7ed8)
Diffstat (limited to 'docs/report/introduction/methodology_acls.rst')
| -rw-r--r-- | docs/report/introduction/methodology_acls.rst | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/docs/report/introduction/methodology_acls.rst b/docs/report/introduction/methodology_acls.rst new file mode 100644 index 0000000000..512532fead --- /dev/null +++ b/docs/report/introduction/methodology_acls.rst @@ -0,0 +1,68 @@ +Access Control Lists +-------------------- + +VPP is tested in a number of data plane feature configurations across +different forwarding modes. Following sections list features tested. + +ACL Security-Groups +~~~~~~~~~~~~~~~~~~~ + +Both stateless and stateful access control lists (ACL), also known as +security-groups, are supported by VPP. + +Following ACL configurations are tested for MAC switching with L2 +bridge-domains: + +- *l2bdbasemaclrn-iacl{E}sl-{F}flows*: Input stateless ACL, with {E} + entries and {F} flows. +- *l2bdbasemaclrn-oacl{E}sl-{F}flows*: Output stateless ACL, with {E} + entries and {F} flows. +- *l2bdbasemaclrn-iacl{E}sf-{F}flows*: Input stateful ACL, with {E} + entries and {F} flows. +- *l2bdbasemaclrn-oacl{E}sf-{F}flows*: Output stateful ACL, with {E} + entries and {F} flows. + +Following ACL configurations are tested with IPv4 routing: + +- *ip4base-iacl{E}sl-{F}flows*: Input stateless ACL, with {E} entries + and {F} flows. +- *ip4base-oacl{E}sl-{F}flows*: Output stateless ACL, with {E} entries + and {F} flows. +- *ip4base-iacl{E}sf-{F}flows*: Input stateful ACL, with {E} entries and + {F} flows. +- *ip4base-oacl{E}sf-{F}flows*: Output stateful ACL, with {E} entries + and {F} flows. + +ACL tests are executed with the following combinations of ACL entries +and number of flows: + +- ACL entry definitions + + - flow non-matching deny entry: (src-ip4, dst-ip4, src-port, dst-port). + - flow matching permit ACL entry: (src-ip4, dst-ip4). + +- {E} - number of non-matching deny ACL entries, {E} = [1, 10, 50]. +- {F} - number of UDP flows with different tuple (src-ip4, dst-ip4, + src-port, dst-port), {F} = [100, 10k, 100k]. +- All {E}x{F} combinations are tested per ACL type, total of 9. + +ACL MAC-IP +~~~~~~~~~~ + +MAC-IP binding ACLs are tested for MAC switching with L2 bridge-domains: + +- *l2bdbasemaclrn-macip-iacl{E}sl-{F}flows*: Input stateless ACL, with + {E} entries and {F} flows. + +MAC-IP ACL tests are executed with the following combinations of ACL +entries and number of flows: + +- ACL entry definitions + + - flow non-matching deny entry: (dst-ip4, dst-mac, bit-mask) + - flow matching permit ACL entry: (dst-ip4, dst-mac, bit-mask) + +- {E} - number of non-matching deny ACL entries, {E} = [1, 10, 50] +- {F} - number of UDP flows with different tuple (dst-ip4, dst-mac), + {F} = [100, 10k, 100k] +- All {E}x{F} combinations are tested per ACL type, total of 9. |