Unanswered Question
Feb 6th, 2009

Hi all, Can anyone tell me in simple turns what cef does? and is it enabled by default, is it used on l3 devices ?



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Giuseppe Larosa Fri, 02/06/2009 - 07:11

Hello Carl,

CEF= Cisco Express Forwarding is the current and best switching method for routers and multilayer switches.

It is a form or routecaching.

CEF works using the routing table (topology driven) to build a FIB Forwarding Information Table.

By using more memory the device tries to prepare complete forwarding rules to be used to forward traffic.

So for example if a packet with destination net A has to be sent out a LAN interface the source and destination MAC addresses to be used are placed in the table together with the outgoing interface ID, L2 header fields to be used.

the destination MAC address is that of the next hop.

A neighbors table is kept for convenience.

More powerful devices that can perform CEF in a distributed manner have a copy of CEF tables on each linecard and the main cpu work is that of updating and keeping in sync all the tables.

Software based routers have a single cpu but they take advantage from having the job prepared in advance.

Hope to help


carl_townshend Mon, 02/09/2009 - 09:00

Hi there

I dont quite understand what you say, by prepare the forwarding rule etc, can you explain, ie tell me the packet flow between 2 routers and what cef will do to make it faster ?

Giuseppe Larosa Tue, 02/10/2009 - 05:51

Hello Carl,

>> what cef will do to make it faster ?

It stores in a specialized table all the information needed to forward packets that have the same destination (or the same source and destination if doing load balancing).

This avoids to process all packets as stand alone.

To forward packets that belong to a flow certain operations has to be done only once:

for example an ARP request to resolve the IP address of next-hop in a valid MAC address.

fast switching that is traffic driven does this operations on first packet of the flow

CEF that is topology based does this even before seeing the first packet of the flow (it keeps a table of Neighbors and resolves all of them).

So a packet rewrite operation can be done efficiently:

the IP packet is extracted from the received frame, IP header is modified accordingly (TTL decremented IP header checksum recomputed) and the the packet is encapsulated in the resulting outgoing frame and queued to the outgoing interface

Hope to help


carl_townshend Tue, 02/10/2009 - 08:54

hi there, im still a little confused here?

sorry about this, so you say it wont have to re-write everypackets layer 2 destination address when routing, will it just od it for the first packet? if so how does the router know they are part of the same flow ?

Giuseppe Larosa Tue, 02/10/2009 - 10:01

Hello Carl,

I simply mean that everything is stored and ready to perform packet rewrite for each packet in the flow.

Packet rewrite needs to be performed on all packets that go through a router or multilayer switch.

The router does ARP request only once: the MAC address of the prefix next hop ip address is not going to change until that NIC breaks, isn't it ?

Or until a better or different route for that prefix has to be used.

In that case some or all CEF entries have to be updated.

For this reason a separate small neighbor table is mantained.

I would suggest to take a look at tech page


packets are classified in the same flow if they have a destination that fit in the same prefix in the FIB.

Classification is L3 based.

Hope to help



This Discussion