Hey Osamoz,
I normally use this command for MPLS to see my actual path that CEF is using. This is your actual path your data flow (source/destination) is taking. So what is CEF? Basically CEF is like the difference between accessing data on the harddrive verses accessing data in RAM.
Now understand that there is CEF and dCEF. CEF is the line card per line card version and dCEF is distributed CEF and is used on the big daddy routers like the GSR's. Just focus on CEF and you'll be golden. When you think of CEF think L3.
Most high-end Cisco routers on the Internet run either CEF or dCEF. Before CEF we used ?fast switching? CEF has many benefits over fast switching, including a more reliable and sturdy method for building the forwarding table. CEF is not that tough to config, however, if you have asymmetric data flows in your network, do your homework first. CEF is a global command.
CEF is how we put stuff into the L3 switching engine. The L3 switching engine does not use the routing table to do lookups because the routing table is kept in regular memory and is too slow for doing lookups, and contains way more information that is needed to L3 switch the packet. CEF is a method that used to program the hardware L3 ASICs from the routing table. This is key, the ASIC?s do the forward and flow control here. This means that I can also use CEF with Netflow to offer a one two punch that is second to none. For example: try the command:
- Sh ip-route cache flow
Pretty darn cool stats for planning and analysis! Now toss a little CEF in the mix and now with commands like:
- sh ip cef
I compare both tables and ones that do not match up then that could be a possible spoofed route! How cool is that!!
If you are going to troubleshoot/monitor CEF some useful commands I use are:
- Sh cef: Displays which packets the line cards dropped or displays which packets were not express forwarded.
- Sh cef int: Interface CEF info and stats
- show ip cef adjacency: Displays CEF recursive and direct prefixes resolved through an adjacency. Big time helpful for MPLS.
- show ip cef events: Displays all recorded CEF FIB and adjacency events.
- show ip cef traffic prefix-length: CEF Traffic
This is because CEF offers some security benefits, such as RPF (Reverse Path Forwarding). RPF provides a means of blocking packets that claim to originate from within your network, but present themselves on an external interface.
I like CEF almost as much as I like cornbread and Moonpies. I almost always recommend CEF due to the massive performance gains. Of course if this is a MPLS network then you have to run CEF to resolve the recursion and resolution operations.
Jimmy ray
