The Default Route Source Address utility allows you to specify an interface in which the address should be used as the source hint on Linux's default route.

This source hint is used for traffic where:

• The application is not bound to a specific address.

• The traffic is destined over a nonconnected route. This is commonly seen as Rx-inject traffic and represents most of the traffic that is sent by Linux.

Ensure that the interface is synchronized to Linux, to qualify as a valid source hint interface.

• Its VRF must not be disabled.

• On XR platforms, it must not be the East-West interface.

• It is a supported interface type.

• If explicitly configured, it must be in the specified VRF.

The following configuration parameters are used to select the interface to be used:

• If an interface is specified explicitly and valid, it is used.

• If active-management is specified, the lowest-numbered valid management interface on the active RP is used. The identity of this interface will change after RP switchover.

• If no configuration is specified, the lowest-numbered valid loopback interface in the VRF is used.

The address that is chosen from the selected source hint interface depends on the address family:

• IPv4: The primary address is used, when present. Secondary addresses are not considered.

• IPv6: The IP address that is numerically the lowest is used.

vrf blue
!
linux networking
 vrf blue
  east-west Loopback3
  address-family ipv4
   source-hint default-route interface Loopback2
  !
  address-family ipv6
   source-hint default-route interface Loopback2
  !
 !
!
interface Loopback2
 vrf blue
 ipv4 address 192.0.2.1 255.255.255.255
 ipv6 address 2001:db8::1/128
!
interface Loopback3
 vrf blue
 ipv6 address 2001:db8::ea57/128
!

Use the following show command to verify whether the default source hint interface address is configured:

RP/0/RP0/CPU0:ios#show linux networking vrfs vrf blue
VRF blue (Linux network namespace vrf-blue):
  Status:                         active
  IPv4 default route source hint: 192.0.2.1
  IPv6 default route source hint: 2001:db8::1
  IPv4 XR East-West:              none
  IPv6 XR East-West:              2001:db8::ea57

tpa
  vrf < vrf-name >
    address-family { ipv4 | ipv6 }
      update-source dataports { < interface > | active-management }

The East-West Communication utility allows you to specify a Cisco IOS XR interface that should be used for communication between Linux and Cisco IOS XR applications.

Configuring an interface as East-West for a virtual routing and forwarding (VRF) ensures that all listed addresses are reserved for East-West communication, with the following behaviour:

• Traffic cannot be routed from Linux to other devices using this IP address.

• Traffic destined to the listed addresses cannot be received by Linux applications.

• The IP addresses will not appear in Linux.

• For Linux applications: Traffic might be sourced from any local IP address present in Linux. Traffic must be sent to one of the reserved East-West IP addresses.

• For Cisco IOS XR applications: Traffic must be sourced from one of the reserved East-West IP addresses. Traffic might be sent to any local IP address present in Linux.

Ensure the following, for the interface to be qualified as a valid East-West interface:

• Be in a VRF that is not disabled.

• Have one or more IP addresses.

• The following configuration is used to select the interface to be used:

  • If an interface is specified explicitly and valid, it is used.

  • If no configuration is specified, Loopback1 is used.

• All IP addresses on the interface are reserved for East-West.

vrf blue
!
linux networking
 vrf blue
  east-west Loopback3
  address-family ipv4
   source-hint default-route interface Loopback2
  !
  address-family ipv6
   source-hint default-route interface Loopback2
  !
 !
!
interface Loopback2
 vrf blue
 ipv4 address 192.0.2.1 255.255.255.255
 ipv6 address 2001:db8::1/128
!
interface Loopback3
 vrf blue
 ipv6 address 2001:db8::ea57/128
!

Use the following show command to verify whether the east-west communication is configured:

RP/0/RP0/CPU0:ios#show linux networking vrfs vrf blue
VRF blue (Linux network namespace vrf-blue):
  Status:                         active
  IPv4 default route source hint: 192.0.2.1
  IPv6 default route source hint: 2001:db8::1
  IPv4 XR East-West:              none
  IPv6 XR East-West:              2001:db8::ea57

tpa
  vrf < vrf-name >
    east-west < interface >

The Hardware Local Packet Transport Services (LPTS) Support for Traffic Protection utility allows you to specify traffic protection rules to be factored into as an LPTS programming that is done by the Linux Packet I/O. This is in addition to the existing method where the rules were implemented using the Linux kernel's software-based nftables firewall. The nftables firewall is a subsystem of the Linux kernel, and provides filtering and classification of network packets. The nftables firewall is retained as a fallback, but augmented by higher performance LPTS rules.

Linux Packet I/O programs the LPTS in response to Linux socket operations, to ensure that Linux clients can receive traffic from other devices. When traffic protection rules are configured, this feature applies filtering to the programmed LPTS rules to allow a restricted subset that matches the traffic protection rules.

tpa
  vrf < vrf-name >
    address-family { ipv4 | ipv6 }
      protection
        allow protocol { tcp | udp } local-port < local-port >                                           
          {  remote-address < remote-address >/< prefix-len >
           | local-address  < local-address >/< prefix-len >
           | interface      < interface-name > }

The Management Route Export utility allows for a subset of Cisco IOS XR static routes that resolve over the active management interfaces to be replicated to Linux. This avoids the need for a line card NPU inject and FIB lookup for routing Linux traffic matching these management routes.

In order for the routes to be exported from Cisco IOS XR to Linux, you must ensure that the routes:

• Resolve over the management interface.

• Are static.

• Not recursive.

• Not the default XR route.

A specified source hint interface is qualified only if:

• Its VRF is not disabled.

• The interface is in the same VRF as the management interface.

• On Cisco IOS XR platforms, it is not the East-West interface.

• It is a supported interface type.

If the specified interface is valid, then the address that is chosen from it depends on the address family:

• IPv4: The primary address is used, when present. Secondary addresses are not considered.

• IPv6: The IP address that is numerically the lowest is used.

linux networking
 vrf default
  address-family ipv4
   source-hint management-route interface Loopback2
  !
 !
!
interface Loopback0
ipv4 address 192.0.2.128 255.255.255.255
!
interface Loopback2
 ipv4 address 192.0.2.200 255.255.255.255
!
interface MgmtEth0/RP0/CPU0/0
 ipv4 address 192.0.2.1 255.255.255.240
!
router static
 address-family ipv4 unicast
  192.0.2.16/28 192.0.2.2
  192.0.2.32/28 192.0.2.2
 !
!

Use the following show command to verify whether the east-west communication is configured:

Note	The management ethernet is directly connected to a device with the unicast route IP address.

RP/0/RP0/CPU0:ios#bash vrf default ip route
default dev to_xr scope link src 192.0.2.128 metric 2048 mtu 1500 advmss 1460 
192.0.2.1/30 dev Mg0_RP0_CPU0_0 proto static scope link src 192.0.2.200 
192.0.16.0/24 via 192.0.2.2 dev Mg0_RP0_CPU0_0 proto static src 192.0.2.200 metric 2048 
192.0.17.0/24 via 192.0.2.2 dev Mg0_RP0_CPU0_0 proto static src 192.0.2.200 metric 2048

The verification for source hint config is to check that all Linux routes resolving via the management ethernet interface are using the source address from the configured device. The verification for management route export is to check that all static routes resolving via the management ethernet interfaceare exported to Linux.

tpa
  vrf < vrf-name >
    address-family { ipv4 | ipv6 }
      update-source destination < management-interface > source < interface >

The Automatic Mapping of Deprecated TPA Configuration utility supports seamless migrations from a Cisco IOS XR environment to Linux, with the Packet I/O functionality. The configuration is translated from the deprecated TPA configuration (under tpa) to Linux, with the Packet I/O configuration (under linux networking).

The configuration will be automatically translated to the equivalent Linux Packet I/O configuration, after installation.

The following scenarios are relevant for this utility:

• Applying deprecated TPA configuration on a Cisco IOS XR device that supports Linux Packet I/O.

• Upgrading a Cisco IOS XR device from a version that does not support Linux Packet I/O, to a version that supports Linux Packet I/O.

• Downgrading a Cisco IOS XR device from a version that supports Linux Packet I/O, to a version that does not support Linux Packet I/O.

• The deprecated configuration is available until all Cisco XR platforms are migrated to support Linux Packet I/O.

Note	Downgrading to an unsupported version of Linux Packet I/O cannot be done automatically. The definitions required to support Linux Packet I/O configuration does not exist on releases earlier to Cisco IOS XR Release 7.9.1.

The Software Forwarding utility allows you to choose software forwarding over hardware forwarding. Software forwarding is provided primarily for compatibility with Cisco IOS XR networking stack, where hardware forwarding could not route packets over the management interface.

When software forwarding is configured, the Net I/O will be used for forwarding packets. The packet path might be slow, although no change to Linux reachability is noticeable. You can use software forwarding to avoid injecting traffic toward line card NPUs in scenarios where the Linux traffic in a VRF will be sent over management interfaces.

linux networking
 vrf default
  address-family ipv6
   default-route software-forwarding
  !
 !
!

tpa
  vrf < vrf-name >
    address-family { ipv4 | ipv6 }
      default-route mgmt

The Statistics Synchronization utility allows you to specify the intervals when interface statistics for all interfaces are synchronized to Linux, when using the Linux ethtool interface, to gather interface statistics.

For supported configurations, Cisco IOS XR's statsd infra is polled at specified intervals to retrieve cached interface statistics for all interfaces that are exposed to Linux, as an exposed Cisco IOS XR interface (those visible to the Linux ip link command).

However, statistics are not gathered for interfaces in disabled VRFs, or for those interfaces which are not synchronized to Linux as an exposed interface.

This example shows how the bundle-ether interface packet statistics are synchronized between Cisco IOS XR and Linux. The packet and byte counters that are maintained by Linux for Cisco IOS XR interfaces display only the traffic that is sourced in Linux. You can configure to periodically synchronize these counters with the Cisco IOS XR statistics for the interfaces.

1. Following is the configure for statistics synchronization, including the direction and synchronization interval.

   linux networking
     statistics-synchronization from-xr every { 30s | 60s | 2m | 3m | 4m | 5m | 6m | 7m | 8m | 9m | 10m }

   The following example shows statistics synchronization in global configuration:

   Router(config)#linux networking statistics-synchronization from-xr 
   every 30s
   

   The following example shows statistics synchronization in exposed-interface configuration:

   Router(config)#linux networking exposed-interfaces interface 
   bundle-ether 1 statistics-synchronization from-xr every 10s
   

   where—

   • from-xr: The direction indicating that the interface packet statistics will be pushed from Cisco IOS XR to the Linux kernel.

   • every: Shows the frequency at which to synchronize statistics. The intervals that are supported for global configuration are 30s and 60s. The intervals that are supported for exposed interfaces are 5s, 10s, 30s, or 60s. The interval s is in seconds.

2. Verify that the statistics synchronization is applied successfully on Cisco IOS XR.

   Router#show run linux networking 
   linux networking
    vrf default
     address-family ipv4
      protection
      protocol tcp local-port all default-action deny 
       permit interface bundle-ether 1  
       !
      !
     ! 
    !
   exposed-interfaces
    interface bundle-ether 1 linux-managed
     statistics-synchronization from-xr every 10s
     !
    !
   !
   

   You can use the show tech-support linux networking command to display debugging information, with regard to statistics synchronisation.

tpa
  statistics update-frequency < 1 - 99999999 >

Note	The integer values here are mapped to the nearest matching value in supported configuration: For values not exceeding 600 seconds, it is corrected to the nearest matching interval. For values exceeding 600 seconds, it is corrected to 10 minutes.

The VRF Disable utility enables you to specify the virtual routing and forwarding (VRF) that should not be synchronized to Linux, and will not be used by applications using the Linux packet path. This configuration improves performance. Communication using Linux Packet I/O (including East-West communication) will not be functional in the VRF or network namespace which was disabled.

The usage of the VRF Disable utility depends on whether you are using the Cisco IOS XR default VRF or the nondefault VRF:

• For the default VRF, no interfaces, routes, or addresses are synchronized to Linux, but a network namespace called "vrf-default" still exists.

• For nondefault VRFs, the corresponding network namespace is deleted.

vrf green
!
linux networking
 vrf green
  disable
 !
!

Use the following show command to verify whether the VRF is disabled:

RP/0/RP0/CPU0:ios#show linux networking vrfs vrf green
VRF green (Linux network namespace not created):
  Status:                         VRF disabled

tpa
  vrf < vrf-name >
    disable