[doc] Add HLD for Private Link Redirect Map #664

jimmyzhai · 2025-01-28T03:43:21Z

No description provided.

mssonicbld · 2025-01-28T03:43:24Z

/azp run

azure-pipelines · 2025-01-28T03:43:30Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

mssonicbld · 2025-01-28T04:20:13Z

/azp run

azure-pipelines · 2025-01-28T04:20:19Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

mssonicbld · 2025-01-28T04:58:47Z

/azp run

azure-pipelines · 2025-01-28T04:58:54Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

mssonicbld · 2025-01-28T05:10:20Z

/azp run

azure-pipelines · 2025-01-28T05:10:26Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

mssonicbld · 2025-01-28T05:13:37Z

/azp run

azure-pipelines · 2025-01-28T05:13:42Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

mssonicbld · 2025-01-28T05:17:35Z

/azp run

azure-pipelines · 2025-01-28T05:17:41Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

r12f · 2025-01-29T07:40:21Z

documentation/private-link-service/private-link-redirect-map.md

+
+#### 5.1.1 Private Link
+1. **VNI Lookup**: First, we will look up the VNI to determine the packet direction. In this case, we consider all the packets from on-premises network as outbound direction from the floating NIC perspective.
+```json


it will be better to describe the things in the form of SAI API in DASH, and leaving the SONiC dash tables into the SONiC-DASH HLD as DB schema and etc.

r12f · 2025-02-06T04:19:52Z

documentation/private-link-service/private-link-redirect-map.md

+## 4. Resource modeling, requirement, and SLA
+### 4.1 Scaling requirement
+The scaling requirement for PL redirect map are listed as below. The metrics are based on a 200Gbps DPU:
+| Metric | Requirement |


Update to refer to SONiC DASH HLD.

mssonicbld · 2025-02-11T15:20:35Z

/azp run

azure-pipelines · 2025-02-11T15:20:42Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

mssonicbld · 2025-02-11T16:05:13Z

/azp run

azure-pipelines · 2025-02-11T16:05:23Z

Commenter does not have sufficient privileges for PR 664 in repo sonic-net/DASH

KrisNey-MSFT · 2025-02-13T00:43:54Z

hi @jimmyzhai and @r12f - is this one ready to go?

r12f · 2025-02-26T02:18:03Z

documentation/private-link-service/private-link-redirect-map.md

+
+The only difference is that the IP address used in underlay routing and 4to6 action will be specified by a port-based service mapping – for a specified port range, different IP or destination port can be used for crafting the packet.
+
+![PL Redirect VM-to-PLS direction](images/private-link-redirect-vm-to-pls.svg)


will be better to export svg using this setting:

r12f · 2025-02-26T02:21:27Z

documentation/private-link-service/private-link-redirect-map.md

+When PL NSG is enabled, the extra encap for tunneling the packet to NSG will still be added on top the original PL encap. And the return packet will be exactly the same as the regular case without PL NSG.
+
+### 3.3 Redirect map with fast path
+The Fast Path here is not ER Fast Path, but the fast path that required by PLS. Fast path ICMP flow redirection will still take effect when redirect map is used.


The Fast Path here is not ER Fast Path, but the fast path that required by PLS.

We have defined LB fast path in DASH, we can add link and refer to the doc.

r12f · 2025-02-26T02:24:55Z

documentation/private-link-service/private-link-redirect-map.md

+
+| Attribute name | Type | Description |
+| --- | --- | --- |
+| SAI_OUTBOUND_PORT_MAP_ATTR_COUNTER_ID | sai_object_id_t | Attach a counter. |


what does this counter actually do?

r12f · 2025-02-26T02:25:55Z

documentation/private-link-service/private-link-redirect-map.md

+| --- | --- | --- |
+| SAI_OUTBOUND_PORT_MAP_ATTR_COUNTER_ID | sai_object_id_t | Attach a counter. |
+
+NOTE: More attributes could be added in the future for SNAT/DNAT scenarios.


this is not defined, so better removing it to avoid confusion.

r12f · 2025-02-26T02:26:19Z

documentation/private-link-service/private-link-redirect-map.md

+The Fast Path here is not ER Fast Path, but the fast path that required by PLS. Fast path ICMP flow redirection will still take effect when redirect map is used.
+
+- If PL NSG is not used, it changes the flow just like regular PL case.
+


install markdownlint extension and fix the format.

r12f · 2025-02-26T02:34:04Z

documentation/private-link-service/private-link-redirect-map.md

+   | --- | --- | --- |
+   | entry.port_map_id | `sai_object_id_t` | (SAI object ID of the port map) |
+
+Later in the stage of outbound port map, the port map id and inner packet destination port consists of a match key to look up table outbound_port_map_port_range, the matched table entry contains a rewrite info for the redirect map.


will be better to split the section into 2:
6.1.1. Mapping - VNET
6.1.2. Mapping - Port Mapping

r12f · 2025-02-26T02:35:59Z

documentation/private-link-service/private-link-redirect-map.md

+### 6.1  VM-to-PLS direction (Outbound)
+
+**Mapping - VNET**:
+Each mapping will be associated with a port map object:


here, it will be better to add a bit more context on what mapping it is.

r12f · 2025-02-26T02:37:05Z

documentation/private-link-service/private-link-redirect-map.md

+   | entry_attr.SAI_OUTBOUND_PORT_MAP_PORT_RANGE_ENTRY_ATTR_BACKEND_PORT_BASE | `sai_uint16_t` | `11000` |
+
+### 6.2. PLS-to-VM direction
+None of changes.


Missing the PL NSG case explanation here, although it works the same way.

r12f · 2025-02-26T02:39:59Z

documentation/private-link-service/private-link-redirect-map.md

+    SAI_OUTBOUND_PORT_MAP_PORT_RANGE_ENTRY_ACTION_SKIP_MAPPING,
+    SAI_OUTBOUND_PORT_MAP_PORT_RANGE_ENTRY_ACTION_MAP_TO_PRIVATE_LINK_SERVICE,
+} sai_outbound_port_map_port_range_entry_action_t;
+```


if the packet is not hit any mapping, it should be skipped the mapping by default.

r12f · 2025-02-26T02:40:42Z

documentation/private-link-service/private-link-redirect-map.md

+| SAI_OUTBOUND_CA_TO_PA_ENTRY_ATTR_OUTBOUND_PORT_MAP_ID | sai_object_id_t | Outbound port map id. |
+
+## 6. DASH pipeline behavior
+Following [DASH pipeline behavior of private link service](https://github.com/sonic-net/DASH/blob/main/documentation/private-link-service/private-link-service.md#6-dash-pipeline-behavior), it adds updates for redirect map.


need to explain more clearly where the redirect map is added.

after CA-PA mapping stage.

r12f · 2025-02-26T02:42:34Z

documentation/private-link-service/private-link-redirect-map.md

+| ER   | [ExpressRoute]( https://learn.microsoft.com/en-gb/azure/expressroute/expressroute-introduction)|
+| MSEE | Microsoft Enterprise Edge |
+| CE   | Customer Edge |
+| MSEE/CE routers | Microsoft Enterprise Edge / Customer Edge routers. CE and MSEE routers are directly connected and forming pairs. |


MSEE/CE are not required here for PL redirect map doc

ER is the same.

r12f · 2025-02-26T02:46:31Z

documentation/private-link-service/private-link-redirect-map.md

+
+| Attribute name | Type | Description |
+| --- | --- | --- |
+| SAI_OUTBOUND_PORT_MAP_ATTR_COUNTER_ID | sai_object_id_t | Attach a counter. |


svc rewrite info is missing in the port map attributes, such as src prefix, dst prefix.

r12f · 2025-02-26T03:07:33Z

documentation/private-link-service/private-link-redirect-map.md

+   | entry_attr.SAI_OUTBOUND_PORT_MAP_PORT_RANGE_ENTRY_ATTR_BACKEND_IP | `sai_ip_address_t` | `3.3.3.1` |
+   | entry_attr.SAI_OUTBOUND_PORT_MAP_PORT_RANGE_ENTRY_ATTR_MATCH_PORT_BASE | `sai_uint16_t` | `2000` |
+   | entry_attr.SAI_OUTBOUND_PORT_MAP_PORT_RANGE_ENTRY_ATTR_BACKEND_PORT_BASE | `sai_uint16_t` | `11000` |
+


better add a clarification of metering. it follows the CA-PA mapping one, and currently doesn't have any special action in port map.

Initial pl redirect map hld

c3fc3e1

jimmyzhai force-pushed the pl_redirect_map_hld branch from 7ef1f8e to deb4fc3 Compare January 28, 2025 04:58

jimmyzhai force-pushed the pl_redirect_map_hld branch from deb4fc3 to 4b2a85d Compare January 28, 2025 05:10

jimmyzhai force-pushed the pl_redirect_map_hld branch from 4b2a85d to ba72c71 Compare January 28, 2025 05:13

Fix spell check

0fb019e

jimmyzhai force-pushed the pl_redirect_map_hld branch from ba72c71 to 0fb019e Compare January 28, 2025 05:17

r12f reviewed Jan 29, 2025

View reviewed changes

r12f mentioned this pull request Jan 29, 2025

[DASH SAI] Add dash outbound portmap opencomputeproject/SAI#2137

Open

jimmyzhai mentioned this pull request Feb 5, 2025

[dash-p4] Update P4 to support PL redirect map #663

Open

r12f reviewed Feb 6, 2025

View reviewed changes

updated per comments

0f872fc

jimmyzhai force-pushed the pl_redirect_map_hld branch from 1bf5eca to 0f872fc Compare February 11, 2025 16:05

r12f reviewed Feb 26, 2025

View reviewed changes


		The only difference is that the IP address used in underlay routing and 4to6 action will be specified by a port-based service mapping – for a specified port range, different IP or destination port can be used for crafting the packet.

		![PL Redirect VM-to-PLS direction](images/private-link-redirect-vm-to-pls.svg)

		The Fast Path here is not ER Fast Path, but the fast path that required by PLS. Fast path ICMP flow redirection will still take effect when redirect map is used.

		- If PL NSG is not used, it changes the flow just like regular PL case.

[doc] Add HLD for Private Link Redirect Map #664

Are you sure you want to change the base?

[doc] Add HLD for Private Link Redirect Map #664

Conversation

jimmyzhai commented Jan 28, 2025

mssonicbld commented Jan 28, 2025

azure-pipelines bot commented Jan 28, 2025

mssonicbld commented Jan 28, 2025

azure-pipelines bot commented Jan 28, 2025

mssonicbld commented Jan 28, 2025

azure-pipelines bot commented Jan 28, 2025

mssonicbld commented Jan 28, 2025

azure-pipelines bot commented Jan 28, 2025

mssonicbld commented Jan 28, 2025

azure-pipelines bot commented Jan 28, 2025

mssonicbld commented Jan 28, 2025

azure-pipelines bot commented Jan 28, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mssonicbld commented Feb 11, 2025

azure-pipelines bot commented Feb 11, 2025

mssonicbld commented Feb 11, 2025

azure-pipelines bot commented Feb 11, 2025

KrisNey-MSFT commented Feb 13, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment