administering cisco qos ip networks - chapter 5

Configuring Traffic ClassificationSolutions in this chapter: ■ Configuring Policy-based Routing PBR ■ Defining and Configuring Committed Access Rate CAR ■ Marking and Transmitting Web Tr

Trang 1

Configuring Traffic Classification

Solutions in this chapter:

■ Configuring Policy-based Routing (PBR)

■ Defining and Configuring Committed Access Rate (CAR)

■ Marking and Transmitting Web Traffic

■ Marking and Rate Limiting ISPs

■ Configuring Cisco Express Forwarding (CEF)

■ Configuring Basic Network-based Application Recognition (NBAR)

■ Configuring Complex NBAR

■ Integrating NBAR with Class-based Weighted Fair Queuing (CBWFQ)

■ Configuring System Network Architecture Type of Service (SNA ToS)

Chapter 5

181

Trang 2

182 Chapter 5 • Configuring Traffic Classification

Introduction

Enough with theory, I suppose Now it is time to show you how to configure all

of the things that we discussed in the last chapter.This chapter shows you how toput into practice all of the theories that were introduced in the last chapter, howyou would implement these technologies in your network

This chapter contains many configuration examples, but is by no means acomplete listing of all possible uses for the technologies presented

The configurations presented center on the Quality of Service (QoS) ration steps required Basic configuration of interfaces and devices is not discussed.Remember that the classification examples we show are only one part of the equa-tion After a packet is classified, an appropriate queuing mechanism must be config-ured on the devices to provide the required QoS For details on configuring thequeuing mechanisms required, please see the relevant chapters in this text

configu-We strongly encourage you to visit the Cisco configu-Web site at www.cisco.com toview more configuration examples, as new uses for these mechanisms are con-stantly being developed Cisco’s Web site has one of the best collections of con-figuration examples available

What we hope that we have done here is provide you with excellent ples for the most popular uses of these technologies By doing so, it is our hopethat you will use this book as a reference when you are configuring these mecha-nisms on your network

exam-Configuring Policy-based Routing (PBR)

Policy-based routing is one of the original methods of providing QoS markingwithin networks It provides a method of marking packets not by destination, butrather by originating source, be this address or port, and applying defined policymeanings to these packets.This functionality is the key to understanding PBR Itacts and makes decisions based on the SOURCE address or port number, not thedestination address or port as is most common in routing or QoS situations.PBR works in conjunction with access control lists (ACLs) to first select thetraffic to be marked After the traffic is selected, PBR can either direct all of thetraffic to certain networks or interfaces, or selectively mark the (Type of Service)ToS bit to indicate levels of service to be provided to that traffic As PBR works

by the use of ACLs, any traffic that can be differentiated by ACLs can be jected to PBR.This includes, but is not limited to:

sub-www.syngress.com

Trang 3

■ Source system address

■ Application

■ Protocol

■ Size of packetPBR has a fairly straightforward configuration that is based on the concept ofroute maps A route map is a list of accept or deny clauses against which everypacket that enters an interface is matched If a packet meets the accept clause(which is defined via ACLs), a set command is performed against the packet.Theset command specifies the routing behavior or QoS tagging that will be per-formed on the packet A key difference to remember is that in a normal ACL, if apacket is not matched it is dropped and not passed through the interface In aPBR route map ACL, the packet is not dropped; rather, it will not be subjected

to the PBR defined actions and will instead be forwarded by the normal tion-based best effort routing procedure

destina-An important caveat with PBR is to ensure that you are using at least IOS12.0 Prior to 12.0, all PBR was process switched, which limited the packetresponse rate to levels that may cause some applications to quit responding As of12.0 and later, PBR is fast switched with a correspondingly significant increase inpacket rates

Beginning in global config mode, first define a route map and enter the routemap configuration mode using the following command:

route-map map-tag [permit | deny]

Then, match a defined access list for an IP address or protocol on which theeroute map is to act

match ip address (access-list-number)

Next, you should set the action to be performed on the packet:

set ip precedence (number or name)

or

set ip next-hop ip-address

Either of these commands routes the packet to a defined address or sets theprecedence bit to a predetermined level.Then we will specify the interface onwhich the PBR is to be applied

interface interface-type interface-number

Configuring Traffic Classification • Chapter 5 183

Trang 4

Finally, apply the route map to the interface

ip policy route-map map tag

Using PBR to Route Specific Packet Types

PBR can be used to specifically direct certain traffic types to required tions.This example network (Figure 5.1) is composed of a core 6509 with anMSFC doing core layer-three switching.There are two WAN connections One isvia the firewall out to the Internet.The second is to a corporate network.Therequirement is that all HTTP traffic, which is proxied as port 8080, is to bedirected to the firewall In addition, all RDP traffic (port 1330) is to be assigned ahigher priority level for premium service levels

destina-The following shows the MSFC configuration to send all HTTP traffic onport 8080 to the firewall, which has an internal IP address of 10.20.218.17 AllRDP traffic on port 1330 is being increased in precedence to a level of 5 toallow for priority service

Router 1 User

User

Trang 5

service timestamps log datetime

no service password-encryption

! hostname router1

!

ip route-cache policy

! interface Vlan1

ip address 10.20.10.1 255.255.255.0

ip policy route-map outgoing

! route-map outgoing permit 10 match ip address 101

set ip next-hop 10.20.218.17

! route-map outgoing permit 20 match ip address 102

set ip precedence priority

! access-list 101 permit tcp any any eq 8080 access-list 102 permit tcp any any eq 1330

In this example, the ip route-cache policy statement enables PBR fast

cache processing Any traffic that matches access list 101 that specifies traffic onport 8080 (this network is using translation to hide the inside addresses and ports)

will be directed to IP address 10.20.218.17 by the outgoing route map

state-ment Any RDP traffic on port 1330 will have its precedence bit set to priority

to ensure proper QoS processing within the network

Defining Committed Access Rate (CAR)

CAR is the most widely used method in a Cisco environment to mark packets atthe network edge ingress and egress points CAR can perform, in general terms,one of two functions: rate limiting, and packet classification through IP prece-dence and QoS group setting

With CAR’s rate limiting mechanism, you can control the base rate of trafficreceived or transmitted on an interface.Typically, classification and marking occur

Trang 6

on the ingress, and rate limiting occurs on the egress CAR defines traffic for ratelimitation in one of three ways

■ Average rate Average rate determines long-term average transitionrate Any traffic that falls under this parameter is transmitted

■ Normal burst This determines how large a burst can be before some

of the traffic exceeds the rate limit

■ Excess burst size This determines how large bursts can be before alltraffic exceeds the rate limit

Concerning bursts, it is important to note that CAR does no traffic shaping

or smoothing It has no burst buffer capabilities Because of this, CAR does add

to interpacket delay; however, this also means that CAR’s greatest benefits occur

on high-speed links of DS3 speed or greater Low-speed links that must contendwith a significant amount of buffering to deal with bursty traffic will not see thebenefits of CAR as would higher-speed links

CAR’s rate limiting feature works on the principle of a token bucket.Thebucket depth is indicative of the burst size that is configured for the link.Trafficrate capabilities can be configured in 8 k segments up to the physical capacity ofthe link If a packet arrives and there exists enough tokens within the bucket, thepacket is allowed to pass If, however, there is a shortage of tokens, the packet isallowed to borrow tokens up to the Excess burst size.This Excess packet depth is

a loan against future traffic and must be rebuilt from periods of low traffic.Theidea is to allow for a gradual reduction in packet traffic using a WRED-type pro-cedure rather than a tail drop in packets that may occur If the cumulative burstsize exceeds the excess burst size, packets will be dropped.When traffic has beenclassified as belonging to a specific rate, one of several actions will occur,

depending on how the network administrator has configured the response

■ Transmit the packet

■ Drop the packet

■ Set precedence and transmit.The packet may have a lower precedenceset and be transmitted with a lower QoS

■ Continue If there are further CAR statements, the packet will continue

to be processed At the end of the chain, it will be transmitted

If the router is a VIP-based platform (7000 series or better), there are twoother options available

www.syngress.com

Trang 7

■ Set QoS group and transmit.The packet is assigned to a specific QoSgroup and transmitted

■ Set QoS Group and continue.The packet is assigned a QoS group andfurther processing is continued If no further rate policies exist, thepacket is transmitted

It is important to note that, for rate limiting procedures, only packets that are

in burst mode are subjected to changes in the precedence or QoS Packets thatare within the average rate are not modified and transmitted as specified by theirQoS parameters

Concerning QoS, the marking capabilities of CAR are of prime importance

CAR has the ability to mark packets by setting the IP Precedence bits.Whilethere do exist eight differing possible levels of IP Precedence (0–7) it is stronglyrecommended that the network administer only use the first six levels.The twohighest levels are to be reserved for critical network control and routing protocolsthat must pass from device to device to ensure proper internetwork functioning

CAR can mark traffic based on physical port, source or destination IPaddress, MAC address, IP protocol type, or any other differentiation that can bespecified by normal or extended IP access lists.The key is that CAR will onlyfunction on IP-based traffic Non-IP traffic is switched normally and is unaf-fected by CAR rate limiting or marking features

As of IOS 12.04, CAR is available on all Cisco router platforms from the

1720 series and up However, CAR does require that Cisco Express Forwarding(CEF) is enabled, and not all line cards support CEF It is recommended that youcheck the exact model number of all interface cards to ensure that CEF, and cor-respondingly CAR, can be deployed

CAR does have a number of significant limitations in design and tation of network services

implemen-■ CAR will only affect IP traffic Non-IP traffic is not rate limited ormarked.This may cause issues on a legacy network; however, as mostnetworks are being migrated to pure IP, this will become less of a con-cern

■ CAR is not supported on EtherChannel,Tunnel, or ISDN PRI faces

inter-■ On ATM interfaces, CAR only supports aal5snap, aal5mux, or aal5nlpidinterfaces

Trang 8

■ There is no support for BECN or FECN in Frame Relay (backwardand forward express congestion notification)

Configuring Distributed CAR (DCAR)

DCAR is found on the Cisco 7500 or 12000 series router platforms In theserouters, each card has the ability to handle processing by maintaining an indi-vidual copy of the routing database and thereby offloading processor load fromthe central processor.The VIPs serve as unique processors for all packets In thismanner, with DCEF enabled, DCAR is enabled and functions autonomously oneach VIP, rather than being a processor-based operation.This architecture providessignificant improvements in base efficiencies compared to the standard processorbounded CAR functionality

To configure CAR, follow these steps in order First, enter the interface figuration mode

con-interface con-interface-type con-interface-number

Next, specify the rate policy for each class of traffic and the action to betaken if the rate is exceeded

rate-limit {input | output} [access-group [rate-limit]

acl-index]bps burst-norma lburst max 3) conform action action

access-list acl-index {deny | permit}

Marking and Transmitting Web Traffic

In this initial example,Web traffic is allowed access to a network via a token ringinterface on a 7513 router.This Web traffic is to be assigned a precedence of 5 up

to a bandwidth of 4MB Anything over 4MB is to be assigned to a best-effortdelivery class Enter the incoming token ring interface and configuration mode

Trang 9

Int Tok 2/0

Next, use the following command to define that all traffic that meets accesslist 101 will have a precedence setting of 5 if has 4MB or under in bandwidth

Anything over 4MB will be delivered, but will be only best-effort QoS

Rate-limit input access-group 101 16000000 4000 4000 conform-action set prec-transmit 5 exceed action set-prec-transmit 0

Now, enable the access list that will define that we will be matching on Webtraffic only

Access-list 101 permit tcp any any eq www

The following illustrates the exact router interface configuration for this figuration

con-router#Show run

! interface TokenRing2/0 description web in

ip address 207.48.198.1 255.255.255.0 Rate-limit input access-group 101 16000000 4000 4000 conform- action set prec-transmit 5 exceed action set-prec-transmit 0

no ip directed-broadcast ring-speed 16

hold-queue 500 in

! Access-list 101 permit tcp any any eq www

Remarking the Precedence Bit and Transmitting Web Traffic

CAR provides the ability to sort on the precedence bit of packets and reassignthis precedence bit to better fit the current network model In this example, wewill be using the same token ring interface as we did previously, but will remarkall precedence level 0,1, and 2 bits as precedence level 4

First, enter the configuration mode and input the incoming token ring

Int Tok 2/0

Trang 10

Next, set the rate command to set any packets that match our rate limitedaccess list to have their precedence level reset to 4

rate-limit input access-group rate-limit 25 conform-action set

prec-transmit 4:

The following access list uses a binary mask to match the precedence levels 0,

1, and 2 only

access-list rate-limit 25 mask 07

The following illustrates the interface configuration for this required ration

Access-list rate-limit 25 mask 07

The access-list command that is used is different from that of the standardaccess list CAR defines the access-list rate-limit special format access list.This list

has the format access-list rate-limit acl-index {precedence | mac-address |

mask prec-mask}.While normal access lists and extended access lists allow us

to permit by port numbers, services, and source and destination addresses, thisformat allows filtering on specific properties of the ToS bit Specifically, this willfilter by existing precedence bit; if the mask is used, it will filter on a range ofprecedence bits that are converted to binary, or it will filter on individual MACaddresses.This addition provides for further fine-tuning and granularity in CAR

Marking and Transmitting Multilevels of CAR

CAR allows for up to 100 levels of precedence marking and action per interface

or subinterface As such, extremely fine differentiation can be achieved with imal delay and processor utilization In this configuration, we are using a three-

min-www.syngress.com

Trang 11

level marking and transmitting differentiation on a 12MB IMA connection RDPtraffic is allowed 8MB with a burst capacity of 10MB If traffic conforms, thePrecedence bit is to be set to 5 If traffic does not conform, it is delivered as besteffort only

FTP traffic is to be allowed 4MB of the bandwidth with a precedence of 5 Itcan burst to 5MB, but exceeding traffic will be delivered only with best effort

Any remaining traffic is to be serviced as best effort only.The configuration

of this interface follows exactly in pattern the configuration used in the previoustwo examples.The Final interface and access list configuration is shown here:

protocol ip 192.168.160.1 broadcast encapsulation aal5snap

rate-limit output access-group 101 8000000 8000 10000 action set-prec-

conform-transmit 5 exceed-action set-prec-conform-transmit 0 rate-limit output access-group 102 4000000 5000 5000 conform- action

set-prec-transmit 5 exceed-action set-prec-transmit 0 rate-limit output 4000000 4000 4000 conform-action set-prec- transmit 5

exceed-action drop

! access-list 101 permit tcp any any eq RDP access-list 102 permit tcp any any eq ftp

Marking and Rate Limiting ISPs

In this example, an ATM OC3 connection joins the two remote sites.The routersare managed and the customer has paid for an OC0 (25MB) connection.The ISP

Trang 12

has implemented CAR with a drop all service action when the maximum tracted bandwidth is reached However, the customer is allowed to burst up to30MB if needed Figure 5.2 illustrates this concept

con-Enter the ATM interface configuration mode

Interface atm2/0

Next, enter the PVC to be configured; in this case:

Pvc 1/42

Limit the inbound traffic so that it drops all traffic bursts over 30MB

Rate-limit input 25000000 30000 30000 conform-action transmit

Rate-limit input 25000000 30000 30000 conform-action transmit exceed-action drop

Trang 13

Rate-limit output 25000000 30000 30000 conform-action transmit exceed-action drop

Rate Limiting by Access List

In this example, a 12MB IMA connection joins two 3640s FTP traffic is to beallowed up to 4MB of the link with a priority of 6 Any FTP traffic in excess of4MB is to be assigned a priority of 1 All HTTP traffic is to have a precedence of

3 for the second policy If it exceeds this, it will be dropped.The router tion is shown in Figure 5.3

orienta-Enter the interface configuration mode

interface atm1/ima0

Next, we will need to enter the PVC configuration mode

pvc ip 1/42

Then, set the FTP traffic to have a capacity of 4MB and a precedence level of

6 if in bound Any traffic over 4MB has a precedence value set to 1

rate-limit output access-group 101 12000000 4000 4000 conform -action set-prec-transmit 6 exceed action set-prec-transmit 1

Next, set the HTTP traffic to have 3 MB of capacity and a precedence level

of 3 if inbound Any traffic over 3MB is dropped

rate-limit output access-group 102 6000000 3000 3000 action set-prec-transmit 3 exceed action drop

conform-Use the following FTP protocol access list:

access-list 101 permit tcp any any eq ftp

Finally, enter the following to enable the HTTP access list:

Figure 5.3Rate Limiting by Access List Network Configuration

Router 1 Router 2

192.168.160.2 192.168.160.1

IMA

Trang 14

access-list 102 permit tcp any any eq www

The following is the actual Router1 configuration for the interface and accesslist

rate-limit output access-group 101 12000000 4000 4000 conform-action set-prec- transmit 6 exceed action set- prec-transmit 1

rate-limit output access-group 102 6000000 3000 3000 action set-prec-transmit 3 exceed action drop

conform-!

access-list 101 permit tcp any any eq ftp

access-list 102 permit tcp any any eq www

Using CAR to Match and Limit by MAC Address

CAR also has the ability to match by MAC Address In this example, all packetsthat are from the MAC address 0090.27d1.2917 on the FDDI ring are to bedropped by the CAR interface.This type of network is illustrated in Figure 5.4.Enter the interface configuration mode for the FDDI interface

Int FDDI11/0

Then, define that all traffic that meets the access list MAC will be dropped

rate-limit input access-group rate-limit 100 conform-action

drop

Trang 15

Next, specify that all traffic matching the MAC will be matched

access-list rate-limit 100 0090.27d1.2917

The following output is the Final Interface configuration on the 7513 Alltraffic that matches the MAC address configured will be dropped All other trafficreceives the standard best-effort delivery service

! interface Fddi11/0 description FDDI Backbone

! access-list rate-limit 100 0090.27d1.2917

Figure 5.4Car Packet MAC Match Network Diagram

Token-ring FDDI Ring

Trang 16

Monitoring CAR

To monitor CAR, the primary command within the Cisco IOS is show

inter-faces rate-limit.This command shows all of the rate limiting interfaces and thecurrent packet drop and match/exceed statistics.The following output shows thiscommand applied to a 7513 router running rate limiting on one interface In thisexample, nine packets exceeded the Web rate limit of 10MB and were dropped

7513#show int rate-limit

TokenRing1/0 remote

Input matches: access-group 102 params: 6000000 bps, 8000 limit, 10000 extended limit conformed 81751 packets, 10713419 bytes; action: set-prec- transmit 3

exceeded 9 packets, 5030 bytes; action: drop last packet: 313748ms ago, current burst: 0 bytes last cleared 00:08:34 ago, conformed 166000 bps, exceeded

0 bps

Configuring Cisco Express Forwarding

CAR (and other functions such as NBAR, to be discussed later) requires thatCEF be enabled on the router.Therefore, before we get into CAR configura-tions, we must have a firm knowledge of CEF functionality

CEF is, as of IOS 12.0, the default switching mode in Cisco 7500 routers Infact, in the 8500 and 12000 series, it is the only available mode CEF uses what isknown as a fast cache that is composed of two basic structures, the CEF table andthe adjacency table

The CEF table can be best viewed as a stripped down version of the routetable that is implemented as a 256-way mtrie data structure.This is known as aForwarding Information Base (FIB).This means that each node in the structurecan have up to 256 children In the CEF table, each child represents one octet in

an IP address Each final node in the CEF table contains a pointer to a uniqueentry in the adjacency table.The adjacency table is what actually contains theMAC information needed to switch the packet.The CEF table is built from therouting table; the adjacency table is constructed from the ARP table, Frame Relaymap table, or other table types

Trang 17

In comparison to fast switching, where the first packet must be routed toestablish a path, in CEF the tables are constructed before any packets areswitched.This allows for a considerable increase in efficiency.Therefore, everypacket can be routed via a known route and can be switched using IOS inter-rupts rather than process switching.This can significantly improve router pro-cessor utilization

The other major advantage of CEF is that as of IOS 12.0, CEF load sharing

is enabled by default in the Cisco 7500 series.This allows for a network withmultiple paths to implement automatic load-sharing capabilities over those equal

or unequal path links

CEF entries never age As they are linked directly to their routing table, anychanges in the dynamic routing tables are immediately propagated to the CEFtables

NOTE

IF you are running a 7500, 8500, or 12000 series router, CEF is the default (in two of these cases the only mode), so no configuration is needed However, CEF must be enabled manually on all other routers If you wish to use NBAR or CAR, CEF must be enabled

Enabling CEF

Use the IP CEF command at the global configuration prompt to enable CEF on

a router.The effect of CEF on a router’s processor load can be significant.Thefollowing outputs show processor utilization before CEF and after CEF isenabled for the same traffic load on a 7513 router with an RSP4 Five-secondutilization dropped from 54 percent to 16 percent, with a corresponding decrease

in peak utilization CEF is extremely useful even with the caveats that must beobserved

Trang 18

The following is the processor utilization with IP CEF-enabled output

Monitoring CEF

Use the show IP cef command on the router to monitor the current CEF

database for general details on which routes are formed via which destinationinterface.The following shows a partial output of this command on a Cisco 7513router.This result is essentially a mirror of the current router table

PID QTy PC Runtime (ms) Invoked uSecs Stacks TTY Process

1 Csp 602E87D8 896 30142 2 2600/3000 0 Load Meter

2 M* 0 9508 1690 5626 9804/12000 2 Virtual Exec

3 Lst 602CCA50 115592 18056 6401 5636/6000 0 Check heaps

4 Cwe 602C4248 0 1 0 5568/6000 0 Chunk Manage

7513#show proc

CPU utilization for five seconds: 18%/16%; one minute: 39%; five

minutes: 24%

PID QTy PC Runtime (ms) Invoked uSecs Stacks TTY Process

1 Csp 602E87D8 896 30153 29 2600/3000 0 Load Meter

2 M* 0 11128 1802 6175 9804/12000 2 Virtual Exec

3 Lst 602CCA50 115644 18063 6402 5636/6000 0 Check heaps

4 Cwe 602C4248 0 1 0 5568/6000 0 Chunk Manage

Trang 19

10.0.0.0/23 10.20.10.2 GigabitEthernet8/0/0

10.20.10.3 GigabitEthernet8/0/0 10.0.0.101/32 10.20.10.2 GigabitEthernet8/0/0

You can obtain detailed CEF FIB information by using the show ip cefdetailed command from enable mode.This result can be extremely lengthy, so bewarned that you may have a significant amount of detail to look through.Thefollowing shows the output of a show IP CEF detailed

7513#show ip cef detail

IP CEF with switching (Table Version 2083), flags=0x0

1974 routes, 0 reresolve, 0 unresolved (0 old, 0 new)

1974 leaves, 244 nodes, 531688 bytes, 2086 inserts, 112 invalidations

733 load sharing elements, 240424 bytes, 750 references

3 CEF resets, 24 revisions of existing leaves refcounts: 66423 leaf, 62720 node

Adjacency Table has 1026 adjacencies 0.0.0.0/0, version 1960, cached adjacency 10.20.10.5

0 packets, 0 bytes via 10.20.10.5, GigabitEthernet8/0/0, 0 dependencies next hop 10.20.10.5, GigabitEthernet8/0/0

valid cached adjacency 0.0.0.0/32, version 0, receive

Trang 20

Troubleshooting Cisco Express

Forwarding Caveats and Bugs

While CEF does significantly reduce router utilization and improve packet

switching efficiency, there are several bugs and caveats that one must be aware ofbefore using CEF (and the corresponding dependent QoS services).The moresevere ones are listed next Remember that CEF is a fairly new technology, and assuch is constantly being improved If you wish to use QoS services in your net-work, you will be required to use CEF on your routers Keeping up to date withcurrent code revisions will mediate much, if not all, of the issues that are cur-rently found in CEF implementations.The load reduction on core routers is con-siderable with IP CEF enabled As such, this alone makes this technology

extremely worth considering on supported hardware, as long as the caveats areconsidered regarding current network traffic and configurations

CSCdr56112 Voice traffic is dropped when you use compression, and acall cannot be resumed If an error appears at the decompressor whenyou use Voice over IP over Frame Relay (VoIPoFR) and fast switching

or CEF switching, all subsequent packets in the flow are dropped, andvoice connection is never regained

CSCdr68372 When Multilink PPP and fast switching or CEFswitching are configured, Real Time Protocol (RTP) packets are notcompressed.When you use Multilink PPP for link fragmentation and

interleaving (LFI) in a voice and data environment, the ip rtp

header-compressioncommand has no effect on most platforms and may cause

a Cisco 7200 series router to reload

Trang 21

CSCdr97427 A Cisco 7500 series router that runs on the r7k processor(RSP8 and possibly others) may reload if all of the following conditionsare true:

■ It is configured as a Multiprotocol Label Switching (MPLS) Router

■ It is running Cisco IOS Release 12.1(3)T or later

■ It has serial/hssi interfaces that are either VIP (Versatile Interface

Processors) or non-VIP, but the router is running the ip cef

com-mand in non-distributed mode

■ The serial/hssi links receive MPLS packets

CSCds21333 Some Quality of Service (QoS) features may not perform

as expected when CEF is enabled

CSCds53550 When rate limiting with CAR, Cisco CEF does not droppackets as intended

Configuring Basic Network-based Application Recognition (NBAR)

NBAR was discussed in considerable detail in Chapter 4, so we will not be cussing the inner workings of NBAR at this point Rather, we will be concen-trating on configuration of NBAR, and its interaction with Random EarlyDetection (RED) and Class-based Weighted Fair Queuing (CBWFQ) to provideQoS within the network Remember that NBAR is a protocol discovery tooland a classification engine only.While it can provide the intelligence to look into

dis-a network to discern whdis-at is occurring dis-at dis-a pdis-acket lodis-ad level, it requires othertools to create and enforce a QoS policy

The first step in NBAR configuration is to enable NBAR protocol discovery

on an interface or interfaces that will be used to monitor traffic.The caveat is thatthe use of NBAR will increase CPU utilization by up to 15 percent, so it shouldnot be used on heavily loaded routers Be sure to check your CPU utilization

using the show proc command before implementing NBAR.The discovery

fea-ture supports any protocol supported by NBAR.To enable NBAR on a port:

7206(config)#int faste0/0 7206(config-if)#ip nbar protocol-discovery

Trang 22

To view the results of the NBAR discovery on a specific interface, the show

ip nbar protocol-discoveryinterface is given from enable mode.The following

is partial output of this command for the interface

7206#show ip nbar protocol-discovery int Fast0/0

!

FastEthernet0/0

Input Output

Protocol Packet Count Packet Count

Byte Count Byte Count

5 minute bit rate (bps) 5 minute bit rate (bps) - - -

Creating an NABR Class Map

The class-map command is used to define a matching traffic class and define allidentifiers that will be used to classify traffic as belonging to the class For NBARclassification, the matching parameter must be a protocol supported by NBAR.The following illustrates the structure of this command as applied to a 7206router for matching on PcAnywhere traffic

Trang 23

Configuring Traffic Classification • Chapter 5 203 7206(config)#class-map PCanywhere

7206(config-cmap)#match protocol pcanywhere

Creating a Policy Map

The Policy-Map configuration command is used to define what QoS are to beapplied to a traffic class that was defined by the class-map statement.To accom-plish this, first create a policy name, then define the class to which this policy is

to be applied, and finally, define the QoS features that will be used.The exactcommands are shown next In this command, we are defining our policy to allowPCAnywhere traffic 50 percent of the available bandwidth However, while thisuses a simple rate limiting bandwidth statement, the QoS can be any CAR con-figured statement, weighted fair queuing, random early detection, or precedencemodification as required

7206(config)#policy-map traffic 7206(config-pmap)#class PCanywhere 7206(config-pmap-c)#bandwidth percent 50

Applying the Policy Map to an Interface

The final step is to apply the defined policy map to a specific interface so thatrate controlling can occur.This is done by using the service-policy command toattach a policy to a specific interface and specify the direction of the traffic con-trol.The following shows the Service Policy applied in the input direction

7206(config)#int faste0/0 7206(config-if)#service-policy input PCAnywhere 7206(config-if)#exit

The preceding configuration is the bare minimum to configure NBAR on aninterface Next will be the configuration of complex NBAR settings that aremore likely to be encountered in commercial settings Remember that NBAR is

a logical extension of CAR and uses much the same principles.While CAR andPBR use access lists and rate limited lists that must define specific protocols,NBAR is not bounded by simple port definitions or IP addresses Rather, NBARallows the network administrator to detect and configure on a broad range ofdefined IP- and not IP-based protocols by use of a simple work definition.Thisfeature alleviates the need for expense and complex network probes, and allowsflexibility and intelligence to be built into each network routing device

Trang 24

Configuring Complex NBAR

In real-world scenarios, simple situations such as the one illustrated previouslywould not be used Rather, NBAR would be deployed to provide mission-crit-ical levels of service to a wide range of applications in disparate environments.The next scenario involves using NBAR on an ATM OC0 WAN interface of a

7206 VXR router Citrix traffic is priority, as is Cu-SEEME for video encing X Windows is used for remote work, and SQL*NET is used All Webtraffic on port 8080 is to be directed to the Internet firewall with an IP address

confer-of 10.20.218.17

The first step is to classify all of the differing traffic types using individualclass-map commands

To classify Citrix traffic:

7206(config)#class-map match-all Citrix

7206(config-cmap)#match protocol Citrix

To classify Cu-SEEME traffic:

7206(config)#class-map match-all Video

7206(config-cmap)#match protocol Cu-SeeMe

To classify X Windows traffic:

7206(config)#class-map match-all Xwindows

7206(config-cmap)#match protocol X Windows

To classify SQL traffic:

7206(config)#class-map match-all SQL

7206(config-cmap)#match protocol SQL.Net

To classify Web proxy traffic:

7206(config)#class-map match-all Internet

7206(config-cmap)#match protocol 8080

The next step is to configure the policies to be used to assign QoS Citrix is

to be assigned 20 percent of the available bandwidth; video is to have 30 percent;

X Windows will receive 20 percent; and SQL will receive 20 percent All Internettraffic is allowed 2MB of bandwidth; any exceeding this is to be dropped

7206(config)#policy-map WAN

7206(config-pmap)#class Citrix

Trang 25

Configuring Traffic Classification • Chapter 5 205 7206(config-pmap-c)#bandwidth 20

7206(config-pmap-c)#class Video 7206(config-pmap-c)#bandwidth 30 7206(config-pmap-c)#class Xwindows 7206(config-pmap-c)#bandwidth 20 7206(config-pmap-c)#class SQL 7206(config-pmap-c)#bandwidth 20 7206(config-pmap-c)#class internet 7206(config-pmap-c)#police 2000000 conform transmit exceed drop

The last step is to attach this policy to the provisioned WAN link

7206(config)#interface ATM2/0 7206(Config-if)# pvc 1/42 ip 7206(config-if-atm-vc)#service-policy output wan

The final router configuration is summarized in the following output

Current configuration:

! version 12.15 service timestamps debug uptime service timestamps log uptime

! hostname 7206

!

ip cef

! class-map match-all Citrix match protocol Citrix

! class-map match-all Video match protocol Cu-SeeMe

! class-map match-all Xwindows match protocol X Windows

!

Trang 26

encapsulation aal5snap

!

Integrating NBAR with Class-based

Weighted Fair Queuing

Class-based Weighted Fair Queuing (CBWFQ) is an extension of normal

weighted fair queuing to allow for user-defined classes of protocols In this tionality, the integration of NBAR, which is a classification mechanism, withCBWFQ provides for an extremely flexible and configurable QoS mechanism

func-www.syngress.com

Trang 27

NBAR provides the classification steps that would normally be using ACL ports,

or IP addresses However, these classification procedures are not exclusionary.Youcan still use NBAR with ACLs or interface classifications if needed By the use ofweighted fair queuing mechanisms, it is possible to accommodate the burstynature of current network traffic, while still providing adequate networkresources and response for required services.The configuration of CBWFQ withNBAR is very similar to normal queuing configuration, with the differencebeing conceptually that NBAR is performing the classification instead of manu-ally entering the required classifications

Creating a Class Map to Identify NBAR

The initial configuration is to define a class map that will identify the NBARspecific protocol or protocols that will be subject to CBWFQ.This is done with

the class-map command In normal CBWFQ, we would be using ACL

inter-faces or port protocols to perform the matching.With NBAR, we use theNBAR defined protocol settings to establish matching criteria

7206(config)#class-map match-any Priority 7206(config-cmap)#match protocol FTP 7206(config-cmap)#match protocol Telnet

7206(config)#class-map match-all Citrix 7206(config-cmap)#match protocol Citrix

Configuring Class Policy in the Policy Map

This configuration step defines the service policy that will be used to service theclasses that were defined in the first step A combination of queuing and band-width limitation may be used here to define levels of expected service.The max-imum number of policies that may be configured on the router is equivalent tothe number of class maps that were defined, up to a maximum level of 64 In thefollowing policy map configuration, the policy map has been named “quality.”

The Citrix class is assigned a bandwidth of 6000 Kbps (6MB) with a servicedqueue depth of 100 packets to allow for burst.The priority class is assigned abandwidth of 3000 Kbps (3MB) Remember that CBFWQ is a tail-drop func-tionality, as it limits the packets available in the token buffer via the queue-limitcommand Any traffic that does not match a class map and a correspondingpolicy is treated as best-effort delivery by the router and is required to use onlythe available non-allocated link bandwidth

Trang 28

Attaching the Policy to an Interface

The final step involves attaching a policy to an interface.This process activatesCBWFQ for either inbound or outbound traffic as defined for that interface.While you can assign the same policy to multiple interfaces, each interface canhave only one policy assigned at the inbound and outbound directions

class-map match-all citrix

match protocol citrix

Trang 29

! policy-map Quality class Citrix bandwidth 6000 queue-limit 100 class priority bandwidth 3000

! interface TokenRing2/1

ip address 10.20.198.1 255.255.255.0 service input quality

custom-queue-list 2 ring-speed 16

ip address 10.20.202.1 255.255.255.0 service output quality

to calculate packet drops

7206(config)#policy-map Quality 7206(config-pmap)#class Citrix 7206(config-pmap-c)#bandwidth 6000

Trang 30

The following output is similar to the previous example, except that NBAR

is configured with WRED instead of CBFWQ

class-map match-all citrix

match protocol citrix

Trang 31

custom-queue-list 2 ring-speed 16

ip address 10.20.202.1 255.255.255.0 service output quality

pro-However, the issue is that SNA is a connection-oriented protocol SNA may notrequire much bandwidth, but what it does require must be there in a constant,low latency, guaranteed, and invariant manner.This is at significant odds with theconnectionless model of the normal TCP/IP network (however, it fits in withthe new demands being placed on IP networks by applications such as voice)

SNA is characterized by true class of service (CoS) functionality that is used todifferentiate between interactive and batch mode traffic.The key is to be ableprovide the low latency service that is expected by SNA Cisco developedDLSw+ to address the need to carry SNA traffic across today’s predominantly IPnetworks DLSw+ encapsulates the SNA packet within an IP packet by adding a56-bit header to the SNA packet.The key benefit of DSLw+ is that it providesfor SNA to automatically receive the required level of service from the IP net-work

Mapping SNA CoS to IP ToS

So, how does DLSw+ maintain the connection-oriented nature of SNA trafficacross an IP network? APPN is the prime method for setting COS within theSNA world DSLw+ automatically creates four TCP port values that are mapped

to respective APPN values.This mapping is seen in Table 5.1

Trang 32

Table 5.1Port to APPN to IP Precedence Values

TCP Ports Priority Queue IP Precedence APPN IP Precedence DLSw+

DSLw+ will automatically map APPN marked COS values to the sponding ports and set the IP ToS bit to represent the required IP service require-ment In the absence of APPN and DLSw+ on the same router, DSLw+ willassign all SNA traffic to port 2065 with a network control ToS field.This maypose a problem if you are running an IP precedence aware network, as networkcontrol traffic is treated before all other traffic If a significant amount of SNAtraffic exists, starvation for all other traffic types may occur

corre-Prioritizing SNA Traffic

The key is how to prioritize SNA traffic over other kinds.There are several tions.The first and simplest if you have a ToS precedence enabled network is to

solu-do nothing and let DSLw+ take care of it DSLw+ automatically will set the ToSprecedence bit to network control, thereby guaranteeing that SNA traffic will beserviced before any other traffic.The downside of this is that bandwidth starva-tion could occur if a significant amount of SNA traffic exists, as the networkcontrol precedence level is serviced before all others

The second way is to use access lists and prioritize all traffic on port 2065 as

a high queue Priority queuing allows for four queuing levels with the highqueue receiving priority treatment over all others.This solution itself is not thatsufficient, as the same bandwidth starvation scenarios as were seen in using theprecedence bit can occur However, the best method for most interfaces is toconfigure no traffic shaping for SNA traffic.Weighted Fair Queuing (WFQ) isenabled by default on all Cisco WAN interfaces.WFQ will use the precedencebit that is set automatically by DLSw+ to compute the packet scheduling order

as a function of the frame length of the packet and its place within the tional queue.With the ToS precedence bit set to network, SNA packets willreceive priority service without starving existing network resources

conversa-www.syngress.com

Trang 33

This leaves the LAN and high-speed interfaces having the default tions as providing the best differentiation and service for SNA.This is not to saythat various methods such as WRED could not be used to guarantee service forSNA traffic However, a significant amount of SNA traffic is being asked to tra-verse WAN links; specifically, lower-speed Frame Relay connections that mayaccount for up to 90 percent of current WAN capabilities It is specifically onsuch connections with their slower propagation and entry times that SNA trafficcan encounter significant issues.The best way to provision SNA DSLw+ traffic is

configura-to direct it using PBR configura-to a separate Frame Relay DLCI In this manner, the ronment is mimicking the natural service environment of SNA with minimalqueuing delays Actual QoS is then left to negotiated parameters within theFrame Relay switch and service provider.The following is a simple PBR config-uration to send all DLSw+_ traffic out a subinterface

envi-Interface serial 2/0

Encap frame-relay Frame-relay lmi-type ansi Interface ser1/0.1 point-to-point

ip address 20.23.32.1 255.255.255.0 frame-relay interface-dlci 10

access-list 101 permit tcp any nay eq 2065 access-list 101 permit tcp any eq 2065 any

route-map sna permit 10 match ip address 101 set next-interface serial1/0.1

of its core traffic makes providing a guaranteed level of service extremely difficult

in today’s environment

Trang 34

Various queuing and classification schemes were developed to provide a level

of guaranteed service for mission-critical applications Normal destination-basedrouting parameters are frequently insufficient to meet today’s needs Policy-basedrouting (PBR) provides a means of differentiating traffic by source port or IPaddress, and directing such traffic to particular service interfaces or modify theservice level of these packets if they are deemed to be of lower priority.This fea-ture has been extremely useful when corporations are providing lower-speedlinks for nonessential Web traffic while wishing to maintain higher-speed dedi-cated links for mission-critical Citrix or other applications

To optimize both netowek and router resources, packets should be marked asclose as possible to the ingress points of a network CAR was created to meet thisneed CAR provides a guaranteed level of bandwidth and classification for

packets at the network ingress points (ideally, but can be anywhere) CAR vides the ability to limit the bandwidth that a data flow can have, and sets excep-tion behaviors for burst characteristics As such, while CAR will not shape traffic,

pro-it does provide a useful tool to guarantee bandwidth for mission-crpro-itical tions and prevent network saturation

applica-NBAR provides a ready-made tool that can quickly and easily provide fordifferentiation and classification of traffic within a network.When used in con-junction with queuing mechanisms, NBAR provides a simple and efficient

method to maintain optimal network application response times It provides thenetwork administrator a new tool to maintain and extend network services whilemaximizing current investments in infrastructure

The field of classification within network hardware and routers may be fairlyrecent—as is the use of new technologies to improve efficiencies, such as CEF—and does have a number of caveats and issues that must be closely monitored.However, the benefits that are gained from the use of these mechanisms and toolsfar outweigh the cost at this time Even with legacy protocols, such as SNA, theuse of recent advances such as DLSw+ allows for excellent traffic flows withminimal configuration

Trang 35

Q:What platforms support NBAR?

A:The 2600, 3600, and 7100,7200 series router platforms support NBAR

However, 12.2 IOS promises to support NBAR for the 1700 series, anddNBAR will soon be available for the 7500 series

Q:How much of a performance penalty is there with NBAR?

A:NBAR can have as much as a 15-percent processor hit, so make sure that youhave enough processor capacity

Q:I want to send all proxy Web traffic to a lower-speed dedicated link, whileallowing all other traffic to use my higher-speed link.What is the best proce-dure to use?

A:Policy-based Routing (PBR) ideal for such a situation

Q:I enabled PBR, but I have extremely slow response time.What can I do?

A:Enable fast switching using the IP route-cache policy command

Q:My core routers are showing constant high processor utilization.What can I

do to reduce this without buying new hardware?

A:Try enabling IP CEF on the core devices (but mind the caveats); you may seesignificant processor utilization drops

Q:Can I use NBAR on all protocols?

A:No NBAR, like CAR and CEF, will only function on IP-based traffic

FAQs Visit www.syngress.com/solutions to have your questions

about this chapter answered by the author

Trang 37

Configuring Border Gateway Protocol • Chapter 11 437

Here are the commands for Router 2:

router2(config)#router bgp 64901 router2(config-router)#bgp confederation identifier 649 router2(config-router)#neighbor 10.10.2.1 remote-as 64901 router2(config-router)#neighbor 10.10.1.1 remote-as 64901

router2(config-router)#neighbor 10.10.3.1 remote-as 64901

This is what Router 3 looks like:

router3(config)#router bgp 64901 router3(config-router)#bgp confederation identifier 649 router3(config-router)#neighbor 10.10.3.1 remote-as 64901 router3(config-router)#neighbor 10.10.1.1 remote-as 64901

router3(config-router)#neighbor 10.10.2.1 remote-as 64901

These are the commands for Router 4:

router4(config)#router bgp 64902 router4(config-router)#bgp confederation identifier 649

Figure 11.6Configuring Confederations

AS 64902

L0: 10.10.3.1/24 L0: 10.10.2.1/24

Router 1

Router 3 Router 2

Router 4

Router 5 Router 6 L0: 10.11.4.1/24 L0: 10.11.5.1/24

L0: 10.11.6.1/24 192.168.17.1/30

Router 7

Trang 38

438 Chapter 11 • Configuring Border Gateway Protocol

router4(config-router)#bgp confederation peers 64901

is usually the undocumented layers that affect us the most.These layers are

known as Layer 8–Finance, and Layer 9–Politics

Fully meshed networks are expensive to build and difficult to maintain.Reliability can be affected by routing flaps associated with unstable links, ineffi-cient IP addressing schemes, large routing tables, and interruption of servicescaused by Service Provider error Figure 11.7 shows the connections that would

Trang 39

Configuring Border Gateway Protocol • Chapter 11 439

be required to implement the Confederation example of Figure 11.6 using a fullymeshed network

This network would be expensive in terms of the number of circuits required

to create the full mesh, the amount of time necessary to maintain the network,and the unreliability inherent in such configurations (route flapping, slow conver-gence, and so on).We can use Route Reflectors and Confederations to mitigatethe influences of Layers 8 and 9, or to compensate when circuits have not beendelivered to complete the mesh of a remote site when required

Weight, MED, LOCAL PREF, and Other Advanced Options

BGP provides many advanced configuration options that allow network trators to implement path selection policies.These configuration options guideBGP speakers in determining and selecting a specific path, the best path, from

adminis-Figure 11.7A Fully Meshed IBGP Network (AS 649)

Router 1

Router 3 Router 2

AS 649

AS 650

192.168.17.2/30 EBGP

Router 4

Router 5

Router 6

Router 7

Trang 40

440 Chapter 11 • Configuring Border Gateway Protocol

among multiple paths to a network destination Once the BGP speaker has mined the best path to a destination network, it advertises its selection to itsneighbors

deter-Following are the attributes most often used by network administrators toconfigure routers for best path determination:

■ Weight attribute

■ Multiexit Discriminate (MED) attribute

■ Local Preference attributeThere are several other attributes that are involved in path selection:

■ AS_Path attribute

■ Origin attribute

■ Next_Hop attributeBGP goes through a multistep decision process to select the best path to adestination network It examines BGP attributes in the following order to deter-mine this path

1 Next Hop If next hop is unreachable, the path is discarded.

2 Weight From existing paths, select the path with the largest weight

attribute

3 Local Preference If multiple paths exist with equal weights, select the

path with the largest local-preference value

4 Originated Locally If everything so far is equal, select the path

origi-nated locally

5 AS_Path If everything so far is equal, select the path with the shortest

AS_Path field.The advertisement that passes through fewer ASs may beassumed to be the best

6 Origin Type All thus far being equal, select the lowest origin type.

7 MED If everything so far is equal, select the path with the lowest

MED value

8 External Path If everything so far is equal, select external paths over

internal paths

9 Nearest IGP Neighbor All thus far being equal, select the path with

the closest Internal Gateway Protocol (IGP) neighbor

Tiêu đề	Configuring Traffic Classification
Trường học	Unknown University
Chuyên ngành	Computer Networking
Thể loại	Textbook chapter
Năm xuất bản	2001
Thành phố	Unknown City

Định dạng
Số trang	136
Dung lượng	778,14 KB