Tunnel Interface

The following steps outline how to configure the rules on tunnel interface:

1. Create a dummy tunnel on PF like the tunnel created in VF and bring up the interface.

   This configuration informs the specific tunnel information to the driver and allows the hardware rules to be added.

   For example:

   # ip link add name vxlan100 type vxlan id 100 dstport 4789 dev ens9f1 # ip netns exec ns1 ip link add vxlan100 type vxlan id 100 remote $PEER_TNL_IP dstport 4789 dev ens9f1v0 # ip link set vxlan100 up
2. Enable hardware offload on the interface.

   The hardware offload feature must be enabled through ethtool on the PF and VF (VF_​PR) like the non-tunnel interface configuration.

   ethtool -K $<PF1> hw-tc-offload on ethtool -K $<VF_PR> hw-tc-offload on
3. Configure the TC-Flower rule.

   The TC-Flower rule configuration on the tunnel interface differs from the non-tunnel interface. Currently, hardware offload is supported on VXLAN, GRETAP, GENEVE, and GTP tunnels. However, the rule configuration on GTP tunnel varies from other tunnels. The following are the configurations with supported TC Match-Action fields for different types of tunnels.

   • VXLAN/GRETAP/GENEVE tunnel TC rule format: tc filter add dev <TNL_DEV> protocol { ip | ipv6 } parent ffff: flower [ enc_key_id <VNI/GRE Key> ] [ enc_dst_ip <outer_dst_ip> ] [ src_ip <inner_src_ip> ] [ dst_ip <inner_dst_ip> ] [ dst_mac <inner_dst_mac> ] [ ip_proto { tcp | udp } { src_port <src_port> | dst_port <dst_port>} ] action { drop | mirred egress redirect dev <VF_PR> }

     For example:

     # tc qdisc add dev vxlan100 ingress # tc filter add dev vxlan100 protocol ip parent ffff: flower enc_key_id 100 action mirred egress redirect dev eth0
   • GTP tunnel TC rule format: tc filter add dev <GTP_DEV> ingress priority 1 flower [ enc_key_id <teid> ] [ gtp_opts <pdu type>:<qfi>/<pdu mask>:<qfi mask> ] [ enc_dst_ip <outer_dst_ip> ] [ enc_src_ip <outer_src_ip> ] action { drop | mirred egress redirect dev <VF_PR> }

     For example:

     # tc qdisc add dev gtp100 ingress # tc filter add dev gtp100 ingress priority 1 flower enc_key_id 1234 gtp_opts 00:2b/00:ff action mirred egress redirect dev eth0
   Note:The TC-Flower rule offload on GTP tunnel is supported only when the role is SGSN.

   The following configuration can be used to delete the configured TC rules, and all the rules with same priority will be removed. tc filter delete dev <DEV> ingress [ priority <PRI> ]

4. Verify the offloaded flow in hardware using the following command. tc filter show dev $<TNL_DEV> ingress

   For example:

   # tc filter show dev gtp100 ingress filter protocol all pref 1 flower chain 0 filter protocol all pref 1 flower chain 0 handle 0x1 enc_key_id 1234 gtp_opts 00:2b/00:ff in_hw in_hw_count 1 action order 1: mirred (Egress Redirect to device eth0) stolen index 1 ref 1 bind 1