Policy Enforcement Engine

The ProVision ASICs on each line interface module contain the Policy Enforcement Engine. This engine provides fast packet classification to be applied to ACLs, QoS, Rate Limiting, and some other features through an onboard TCAM. Some of the variables that can be used include source and destination IP addresses (can follow specific users), TCP/UDP port numbers, and ranges (apply ACLs to an application that uses fixed port numbers or ranges). Over 14 different variables can be used to specify the packets to which ACL and QoS rules, rate limiting counters, and others are to be applied.

Partially implemented in the initial software release, the Policy Enforcement Engine will provide a common front end for the user interface to ACLs, QoS, rate limiting, and some other services. In subsequent software releases for the switches, more features can take advantage of the Policy Enforcement Engine to provide a powerful, flexible method for controlling the network environment. For example, traffic from a specific application can be raised in priority for some users, blocked for some other users, and limited in bandwidth for yet other users. After the Policy Enforcement Engine, the header is then forwarded to the programmable section of the network switch engine.

Network switch engine programmability

Each ProVision ASIC switch engine contains multiple programmable units, making them truly Network Processor Units (NPUs). One of the functions of the NPU is to analyze the header of each packet as it comes into the switch. The packet’s addresses can be read with the switch making forwarding decisions based on this analysis. For example, if a packet’s 802.1Q tag needs to be changed to re-map the packet priority, the ProVision ASIC needs to look at each packet to see if any particular one needs to be changed. This packet-by-packet processing has to occur very quickly to maintain overall wire-speed performance – a capability of the ProVision ASICs.

To broaden the flexibility of the ProVision ASICs, a programmable function is included for its packet processing. This NPU function allows the HP ProCurve designers the opportunity to make some future changes or additions in the packet processing features of the ASIC by downloading new software to it. Thus, new features needing high-performance ASIC processing can be accommodated, extending the useful life of the switch without the need to upgrade or replace the hardware. In the first release of the HP ProCurve Switch 5400zl, 3500yl, and 6200yl series, the NPU function within the ProVision ASICs is totally unused, awaiting future upgrades.

The concept of adding the programmable functionality of the NPU within a switching ASIC was originally designed and implemented in the popular HP ProCurve Switch 4000M family introduced in 1998. The programmable capability of the HP ProCurve Switch 5300xl was a second-generation design based on the original HP ProCurve Switch 4000M implementation. The programmable capability was used to give both the HP ProCurve Switch 4000M and Switch 5300xl new ASIC-related features well after initial release of those products. The customers’ investments in the HP ProCurve Switch 4000M and 5300xl are preserved by new functionality not otherwise possible without the ASIC NPU programmability.

Being based on the HP ProCurve Switch 4000M and 5300xl implementations, the NPU capabilities of the ProVision ASICs used in the HP ProCurve Switch 5400zl, 3500yl, and 6200yl series are a third- generation design.

Fabric Interface

After the packet header leaves the programmable section, the header is forwarded to the Fabric Interface. The Fabric Interface makes final adjustments to the header, based on priority information, multicast grouping, etc., and then uses this header to modify the actual packet header as necessary.

The Fabric Interface then negotiates with the destination ProVision ASICs for outbound packet buffer space. If congestion is present on the outbound port, WRED (weighted random early detection) can be applied at this point as a congestion-avoidance mechanism. Finally, the ProVision ASICs Fabric Interface forwards the entire packet through the Fabric-ASIC to an awaiting output buffer on the ProVision ASICs that controls the outbound port for the packet. Packet transfer from the ProVision ASICs to the Fabric-ASIC is accomplished using the 28.8 Gbps full-duplex backplane connection, also managed by the Fabric Interface.