7.3 Flow Masks
7.3.1 Flow mask overview
One of the best features of MLS is that it supports access lists. Both standard and extended IP access lists are available. This support relies on three mechanisms:
  • The assumption is made that if a candidate packet fails an access list, the router never sends an enable packet to complete the shortcut.
  • The MLSP protocol notifies the MLS-SE to flush all shortcut entries if the access list is modified.
  • A flow mask.

The MLS-SE uses flow mask modes to determine how packets are compared to MLS entries in the MLS cache. The flow mask mode is based on the access lists configured on the MLS router interfaces. The MLS-SE learns the flow mask through MLSP messages from each MLS-RP for which the MLS-SE is performing Layer 3 switching.

MLS-SE supports only one flow mask for all MLS-RPs that are serviced by the MLS-SE. If the MLS-SE detects different flow masks from different MLS-RPs for which the MLS-SE is performing Layer 3 switching, the MLS-SE changes its flow mask to the most specific flow mask detected. However, if a more specific flow mask is in effect, then a less specific flow mask is applied.

The MLS-SE supports three flow mask modes:

  • Destination-IP
  • Source-Destination-IP
  • IP-Flow

When the MLS-SE flow mask changes, the entire MLS cache is purged.