Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

CEF operation

can anybody explain how cef operation works ?

difference betn router & L3 switch (cef enabled)

please explain brief....

  • LAN Switching and Routing
Hall of Fame Super Silver

Re: CEF operation

Hello Kaustubh,

CEF is a topology based switching method, an optimizated way to forward packets.

Topology based means that the CEF table is built before traffic is seen (this is different from older switching methods like Fast switching that were traffic driven: the entry in the cache was built by processing the first packet of a flow)

So CEF works by processing the routing table:

for each prefix present in the routing table a CEF entry has to be built.

The target is to be able to perform packet rewrite.

So the fields in the table include for example the destination MAC address (that is the MAC address of the ip next-hop to the route)

the source MAC address the outgoing interface.

CEF keeps also auxiliary tables for the neighbors (adjacent tables).

When a packet arrives it is classified in a FEC and processed according to the CEF entry.

For a multilayer switch the entry can include L2 information like the L2 switch port to be used to reach and end station.

The L3 information is the SVI vlan interface then the port on which the destination MAC address has been seen needs to be inserted too.

For a router only L3 information is needed

This is the basic difference for CEF on routers and multilayer switches

Hope to help


Hope to help


New Member

Re: CEF operation


in brief:

A CEF-enabled L3-Device has a FIB (Forward Information Base) which is populated from the routing table. The FIB contains Layer3-next-hop addresses for the corresponding destinations.

In the Adjacency Table, the Layer2-Next-Hop-Address for each FIB-entry is stored.

The CEF-Device handles an incoming packet as follows: If an entry in the FIB exists, the device looks in the Adjacency Table for the Layer2-Next-Hop-Address. The packet is forwarded to the correlating MAC-Address from the Adjacency Table.

To ensure that the packet looks like a routed packet, the IP-Header is rewritten like a normal router would do. Except that this rewriting happens in hardware when using CEF.

For a more detailed explanation, i would suggest you take the BCMSN course. It has a whole chapter about Multilayer Swtching, including CEF.



New Member

Re: CEF operation


There are mainly 4 types of switching...

1. Process

2. Fast

3. CEF (Cisco Only)

4. MPLS (Newer)


When PC Send fist packet to PC 2, and router get this packet it look into its routing table. If it find route for that ip, router replace soure and destination mac address. and send it to PC2 (Process Switching)

In Fast Switching first packet is reach on router, router send Recursive lookup or ARP and store it in its arp entry and send packet.

faster then process switching.

but bad if there are 1000's of usere connected.

CEF (Cisco express Forwarding) create FIB table (Forward Information Base) which contain copy of routing in cache(which is faster). and also create LFIB(called action table) which contain destination ip address and its mac. So it switch packet faster then tradionaly routing. or almost equlant to switch speed.but CEF only work with cisco router/switches.

thats why MPLS is introduced and it is open standard.

You can find it in more better way in MPLS first chapter or ISCW in MPLS portion.