VLAN tags substitution

The BRAS native termination mode can be quite resource-consuming for the fastDPI. The fact is that the fastDPI is optimized primarily for the packets filtering, rather than for modifying them, especially if these modifications cause the packets size changing. The required copying of the packet content which occurs when deleting/adding VLAN tags can significantly reduce the fastDPI performance by 25-30%.

The DPDK version of SSG on VEOS is practically devoid of this drawback - there is almost no decrease in fastDPI performance due to optimizations of packet processing

Therefore the fastDPI BRAS has one more traffic termination mode - the VLAN tag substitution mode (bras_vlan_terminate=2). In this mode, L2 VLAN tags remain in the packet, but their value is replaced by the constant specified by the bras_vlan_subst configuration option. It is assumed that there is some hardware behind the fastDPI BRAS that can effectively cut VLAN tags from outgoing traffic and add VLAN tags to the incoming one. For outgoing traffic, the fastDPI BRAS substitutes the same VLAN value(specified by the bras_vlan_subst option) for all the packets it handles; for incoming traffic the fastDPI BRAS replaces VLAN tags with tags extracted from the destination IP address properties (from the internal UDR database). The fastDPI BRAS does not care about the value of the VLAN tags being added by external equipment in case of incoming (WAN→LAN) traffic - the important thing is that the place is reserved for tags and the correct EtherType are set.

The bras_vlan_subst option is specified in the fastdpi.conf as:

for single VLAN: bras_vlan_subst=711 is represented by an integer
for Q-in-Q (double VLAN): bras_vlan_subst=711.23 is represented by two numbers separated by dots.

It should be taken into account that the substitution mode means that all outgoing traffic is homogeneous in terms number of VLAN tags: all the packages have either one VLAN tag or two ones. If the number of VLAN tags in the packet does not match the specified one in the bras_vlan_subst option, then such a package is forwarded outside without any modifications. If in your network traffic is heterogeneous in terms of the number of VLANs, then you should consider the transformation mode.