Octet

What is CEF polarization, and how do you avoid it?

Show the answer

Say this first

CEF picks one of several equal paths by hashing fields of the packet. If every router in a chain uses the same hash on the same fields, the next router only receives flows that already produced one hash result, and it splits them the same way again, so some of its links get almost nothing. That is polarization. IOS avoids it with the universal algorithm, which mixes a per-router ID into the hash. Adding layer 4 ports or using different hash inputs per tier helps too.

Go deeper

How it happens

CORE1 has two equal paths, to DSW1 and DSW2. The hash on source and destination sends flow set A to DSW1 and set B to DSW2. DSW1 also has two equal paths onward. If DSW1 runs exactly the same hash, all of set A gives the same result again and lands on one of DSW1's links. The other link sits idle.

Fixes on IOS

It is one global setting, so pick one of these:

Cisco IOS
! addresses plus a per-router ID (the default on current releases)
ip cef load-sharing algorithm universal
! addresses plus layer 4 ports
ip cef load-sharing algorithm include-ports source destination
  • universal adds a per-router identifier (random unless you set one) to the hash, so neighbors split differently.
  • include-ports adds layer 4 ports, which spreads many flows between the same two hosts.

Checking one flow

Output
R1# show ip cef exact-route 10.10.1.5 10.20.1.9
10.10.1.5 -> 10.20.1.9 =>IP adj out of GigabitEthernet0/0/2, addr 10.0.13.2

Limits that remain

  • A single elephant flow still lives on one link.
  • Few flows (for example two backup servers talking to one target) hash unevenly however good the algorithm is.
  • Data center platforms and EtherChannels have the same problem and their own hash seed settings.

Traps

  • Blaming the routing protocol when ECMP paths are uneven. The control plane installed equal paths; the hash decides the split.
How did you do?Book 3.5 Implementation