7.1 MLS Processes
7.1.6 Step 3: The MLS-SE identifies enable packets
The router receives and routes the packet as normal. Recognizing the destination address as being directly connected on subinterface Fast Ethernet1/0.2, the router sends the packet back across the ISL link encapsulated as a VLAN 2 frame, as illustrated in Figure .

Figure shows the relevant fields contained in the packet as it crosses the ISL link between the router and the switch.

The router has rewritten the Layer 2 header. Not only has it changed the VLAN number in the ISL header, it has also modified both MAC addresses. The source MAC address is now equal to 00-00-0C-22-22-22, the MAC address used on the Fast Ethernet1/ 0.2 subinterface of the router, and the destination address is set to Host-B. Although the IP addresses have not been changed, the router must modify the IP header by decrementing the Time-To-Live (TTL) field and update the IP checksum.

As the packet traverses the Catalyst Switch on its way from the router to Host-B, five functions are performed:

  1. The destination MAC address is used to Layer 2 switch the packet out Port 3/1.
  2. The MLS-SE recognizes the source MAC address as one of the entries created in Step 1 via the hello process.
  3. The MLS-SE uses the destination IP address to look up the existing partial shortcut entry created in Step 2.
  4. The MLS-SE compares the XTAG values associated with the source MAC address of this packet and the partial shortcut entry. Because they match, the MLS-SE knows that this is the enable packet coming from the same router targeted by the candidate packet.
  5. The MLS-SE completes the shortcut entry. This entry will contain all the information necessary to rewrite the header of future packets (in other words, the fields shown in Figure ).