# Using a virtual iproute2 port as an egress port on the device

**URL:** <https://forum.p4.org/t/using-a-virtual-iproute2-port-as-an-egress-port-on-the-device/1180>\
**Category:** P4 Dev\
**Created:** [April 24, 2024, 10:27am UTC](https://forum.p4.org/t/using-a-virtual-iproute2-port-as-an-egress-port-on-the-device/1180 "2024-04-24T10:27:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nebulator0](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@nebulator0](https://forum.p4.org/u/nebulator0)\
**Post date:** [April 24, 2024, 10:27am UTC](https://forum.p4.org/t/using-a-virtual-iproute2-port-as-an-egress-port-on-the-device/1180/1 "2024-04-24T10:27:16Z")

</div>

I am trying to implement a basic Mininet scenario for testing purposes, where I’d like demonstrate how a switch would encapsulate macsec frames for a legacy device that is incapable doing so on their own. I originated my project using [p4lang’s ‘basic’ excercise](https://github.com/p4lang/tutorials/tree/master/exercises/basic)

For now, I don’t want to use an RPC controller for Macsec, and would like to take advantage of _iproute2’s macsec implementation_ on switch s1.

Here is a drawing of the network setup that i’m trying to achieve: [Imgur](https://imgur.com/a/cXyAnE1)

My issue is, that the packets coming from h1 don’t reach the _macsec1_ interface.  
_macsec1_ is set up by a script that i currently run manually once Mininet is up and running, using `xterm s1` then `./scripts/s1_macsec.sh`.

This is my `./scripts/s1_macsec.sh` file:

```auto
#!/bin/sh
 
ip link add link s1-eth2 macsec1 type macsec validate strict
 
ip macsec add macsec1 tx sa 0 pn 1 on key 01 12345678901234567890123456789012
 
 
ip link set dev macsec1 up
ifconfig macsec1 10.0.1.3

```

Trying the set the switch up with setting the egress port in runtime.json to port#2 is successful, and forwards the incoming frame to s1-eth2.

Below is the corresponding part of my s1-topology.json file:

```auto
    {
      "table": "MyIngress.mac_exact",
      "match": {
        "hdr.ethernet.dstAddr": "01:0c:cd:04:00:01"
      },
      "action_name": "MyIngress.mac_forward",
      "action_params": {
        "dstAddr": "01:0c:cd:04:00:01",
        "port": 2
      }

```

The p4 program running on thsi switch is simply forwarding ethernet frames based on their dstAddr.

I can’t seem find the port number associated with the macsec port of the mininet host which is created by the script after mininet is up and running.  
I’ve tried changing the egress port number to different numbers, but none of them worked.

I confirmed that the Macsec port is working by sending forged frames from s1 mininet host through it’s macsec1 interface.

Is there any way of solving this? Does p4 have to have an interface already set up when the configuration data is recieved from the Controller in order for the interface to recieve a port number? Can ports that are later added to the switch recieve an egress port number too?

Thank you for your help in advance!

---

<div class="post-metadata">

**Author:** ![DavideS](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.p4.org/davides/32/120_2.png) [@DavideS](https://forum.p4.org/u/DavideS)\
**Post date:** [April 24, 2024, 12:15pm UTC](https://forum.p4.org/t/using-a-virtual-iproute2-port-as-an-egress-port-on-the-device/1180/2 "2024-04-24T12:15:18Z")

</div>

Hi @nebulator0,

Could you please show us which command do you use to run the switch and how the flowrules are defined?

---

<div class="post-metadata">

**Author:** ![nebulator0](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@nebulator0](https://forum.p4.org/u/nebulator0)\
**Post date:** [April 25, 2024, 10:27am UTC](https://forum.p4.org/t/using-a-virtual-iproute2-port-as-an-egress-port-on-the-device/1180/3 "2024-04-25T10:27:34Z")

</div>

Certainly!

My environment runs using the exercise environment created in [p4lang tutorials repository.](https://github.com/p4lang/tutorials)

I created a new sub-folder in the _exercises_ directory, duplicating the _basic_ directory.  
The only modification in my p4 code compared to the basic exercise solution is that the forwarding decisions are based on the mac addresses and are using exact matches.

After issuing the `make` command in the project folder, my flowrules defined in the runtime.json files are compiled into _p4info.txt_ and _json_ files that the P4Runtime uses to configure the switches using `p4c-bm2-ss`.

```auto
p4c-bm2-ss --p4v 16 --p4runtime-files build/macsec-test-3_1.p4.p4info.txt -o build/macsec-test-3_1.json macsec-test-3_1.p4

```

The run-exercise.py file then creates the mininet topology:

```auto
sudo python3 ../../utils/run_exercise.py -t pod-topo/topology.json -j build/macsec-test-3_1.json -b simple_switch_grpc

```

Finally, the environment uses simple\_switch\_grpc commands to start the grpc servers.

```auto
simple_switch_grpc -i 1@s1-eth1 -i 2@s1-eth2 --pcap /home/p4/devenv/exercises/macsec-test-3_1/pcaps --nanolog ipc:///tmp/bm-0-log.ipc --device-id 0 build/macsec-test-3_1.json --log-console --thrift-port 9090 -- --grpc-server-addr 0.0.0.0:50051
 
simple_switch_grpc -i 2@s2-eth2 -i 1@s2-eth1 --pcap /home/p4/devenv/exercises/macsec-test-3_1/pcaps --nanolog ipc:///tmp/bm-1-log.ipc --device-id 1 build/macsec-test-3_1.json --log-console --thrift-port 9091 -- --grpc-server-addr 0.0.0.0:50052

```

Finally, P4Runtime inserts the table entries into the switches.  
I’ve uploaded my whole [s1-topology.json file here ( Pastebin )](https://pastebin.com/NBPgQ4eB)

---

<div class="post-metadata">

**Author:** ![DavideS](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.p4.org/davides/32/120_2.png) [@DavideS](https://forum.p4.org/u/DavideS)\
**Post date:** [April 25, 2024, 12:30pm UTC](https://forum.p4.org/t/using-a-virtual-iproute2-port-as-an-egress-port-on-the-device/1180/4 "2024-04-25T12:30:50Z")

</div>

From what I’m understanding you want to manage the s1 switch interfaces via the script

> s1\_macsec.sh

So you cannot do that because the interfaces assigned to the the switch are in promiscuous mode, so they simply pass the packets to the bmv2 switch without applying any network configuration.

---

<div class="post-metadata">

**Author:** ![nebulator0](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@nebulator0](https://forum.p4.org/u/nebulator0)\
**Post date:** [May 6, 2024, 8:44am UTC](https://forum.p4.org/t/using-a-virtual-iproute2-port-as-an-egress-port-on-the-device/1180/5 "2024-05-06T08:44:05Z")

</div>

Well in short term yes, this is my case.

When I instantiate the switch using `run_ exercise.py`, the simple\_switch\_grpc won’t find the macsec interface that is created using the `s1_macsec.sh` script, which is included in the topology file `topology.json` that is created for configuring mininet.