How FDB (Filtering Database) is filled out

Question

I would like to understand what is used as a VLAN column in the FDB. For ACCESS port it is PVID if frame untagged or frame VID if frame is tagged, for TRUNK it is allowed VLANs?

We can represent the CAM record of the FDB in a table as the following structure:

type FdbEntry struct {
    Port    uint16
    Address MACAddr
    Type    uint8
    Vlan    []uint16
    TTL     Duration
}

But if the frame came to the trunk port, the trunk port can have several VLANs, respectively we set in the Vlan field an array of VLANs specified on the trunk interface. If the port is ACCESS we use PVID. Since the fastest option along with the CAM table to get the record is via hash-map, the key must be unique and as a key we use MAC address of the sender. That's why the Vlan field is an array.

When frame was came, we must find an entry in FDB (because we're supporting 802.1Q) If an entry is found, we make sure to check the entry port ID with the ingress port ID, because the device may be reconnected to another port, so the port ID must be changed accordingly. If the entry was not found, we have to create an entry in the table (FDB) with the PVID of the ingress port as the Vlan field. Or if ingress frame tagged, we must set a frame VID as the Vlan field instead of ingress PVID?

t = FdbEntry{
    Port:    ingressPort.Id,
    Address: ingressFrame.srcAddr,
    Type:    DYNAMIC,
    Vlan:    ingressPort.Vlans(),
    TTL:     60 * Second,
}

Checking for "MAC movement moment"

isMoved = fdbEntry.Port != ingressPort.Id
if isMoved {
    // Be sure to check if a frame came to us, but from under a different port,
    // we must necessarily overwrite the port in the table.
    t = FdbEntry{
        Port:    ingressPort.Id,
        Address: fdbEntry.Address,
        Type:    fdbEntry.Type,
        Vlan:    fdbEntry.Vlan,
        TTL:     fdbEntry.TTL,
    }
    fdbTable.Update(ingressFrame.srcAddr, t) // update hash-map 
}

See illustartion below:

Also, do we add the entry as soon as the frame arrives (after only ingress filtering (if enabled)), or do we add the entry only when the ingress, egress filtering, forwaring process will be successful?

Answer 1

Each VLAN is treated as a separate L2 segment, or forwarding domain.

You cannot forward by destination MAC address alone as that would violate those domains. Also, MAC address learning needs to be limited to the current domain as a MAC may be located on different ports in different VLANs.

In relation to your other question it's efficient to handle both VLAN filtering and forwarding at the same time. It is reasonable to treat the VLAN ID (or the index to the VLAN table) as an extension to the MAC address. On frame ingress, you need to check whether the inbound port is allowed access with the tagged VLAN. Also, on a trunk port untagged frames may not be defined/allowed. Illegal frames are dropped.

Legal frames are matched to the CAM table, the destination MAC possibly extended by the VLAN ID, depending on implementation - remember that a switch is doing all forwarding in hardware.

Note that with a combined VLID-MAC address you can only match the destination MAC on the indicated VLAN - if the MAC isn't present there, it's treated as unknown and the frame is flooded to all VLAN ports.

On egress, the tag needs to be removed when that VLAN is untagged (access port, or native VLAN on a trunk port).