A question about Multiple Routers with a Single MLS Catalyst

Hello,

In book, there is a paragraph about the "Using Multiple Routers with a Single MLS-Capable Catalyst". I don't understand how the "Double lookups" and "Double Rewrite" operate, could you take a look at this and give me a instruction?

Picture: Two MLS Routers and One MLS Switch

formatting link

Description in the book: Here, Host-A is still located in the Red VLAN and Host-B is still located in the Blue VLAN. However, a new VLAN has been created between the two routers (call it the Purple VLAN). Host-A still sends traffic destined to Host-B to its default gateway using the Red VLAN. As the first packet passes through the Catalyst, the NFFC recognizes it as a candidate packet and creates a partial shortcut entry (labeled Step 1 in the picture). Router-A then forwards the traffic over the Purple VLAN to Router-B. As the packet passes back through the Catalyst, the NFFC recognizes the packet as an enable packet and completes the shortcut entry (Step 2 in the picture). However, it also recognizes the destination MAC address as that of Router-B and therefore sees this packet as another candidate packet (Step 3 in the picture). Router-B then routes the packet normally and forwards it to Host-B over the Blue VLAN. As the packet passes back through the Catalyst for the third time, it is identified as an enable packet for the partial entry created in Step 3. A second shortcut entry is created (Step 4 the picture).

******When additional traffic flows from Host-A to Host-B (Step 5 in the picture), two sets of shortcut lookups and rewrite operations are performed. ******** As a result, the additional packets are not sent to either router.

I don't quite understand the above sentence besieged by asterisks. How the "two sets" work, please? If anyone comprehends very well, could you give me a detail explanation?

THANK YOU VERY MUCH.

The part between asterisks is easiest part - it's basics of MLS. When you have MLS-capable router, and MLS-capable switch, first packet goes through the router, and then router sends "instructions" to the switch how to handle remaining traffic in the same flow without "asking a router what to do". So, all remaining frames in the data flow between two hosts will be switched within a switch.

More tough part is the scenario they draw. Practically I see the only two "scenarios" when it's possible - PBR (Policy Based Routing), and two Supervisor modules working independently for load-balancing. In all other situations you have the only one "router", and you have one "lookup" and "rewrite".

Good luck,

Mike CCNP, CCDP, CCSP, Cisco Voice, MCSE W2K, MCSE+I, Security+, etc. CCIE R&S (in progress), CCIE Voice (in progress)

------ Headset Adapters for Cisco IP Phones

formatting link