cisco voip qos overview qos details autoqos ccnp ont quick reference...

58
CCNP ONT Quick Reference Sheets Exam 642-845 Network Architecture Cisco VoIP QoS Overview QoS Details AutoQoS Wireless Scalability Brent Stewart Denise Donohue ciscopress.com

Upload: others

Post on 11-Mar-2020

8 views

Category:

Documents


2 download

TRANSCRIPT

Page 1: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CCNP ONTQuick Reference SheetsExam 642-845

Network Architecture

Cisco VoIP

QoS Overview

QoS Details

AutoQoS

Wireless Scalability

Brent StewartDenise Donohue

ciscopresscom

ABOUT THE AUTHORS

[ 2 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

About the AuthorsBrent Stewart CCNP CCDP MCSE Certified Cisco Systems Instructor is a network administratorfor CommScope He participated in the development of BSCI and has seperately developed trainingmaterial for ICND BSCI BCMSN BCRAN and CIT Brent lives in Hickory NC with his wifeKaren and children Benjamin Kaitlyn Madelyn and William

Denise Donohue CCIE No 9566 is a Design Engineer with ATampT She is responsible for designingand implementing data and VoIP networks for SBC and ATampT customers Prior to that she was aCisco instructor and course director for Global Knowledge Her CCIE is in Routing and Switching

ICONS USED IN THIS BOOK

Icons Used in This Book

[ 3 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Si

WebBrowser

Internal Firewall IDS Database

Router 7507Router

Multilayer Switchwith Text

MultilayerSwitch

SwitchCommunication Server

IDC

App Server

Double-click to view image at full size in an external viewer

CHAPTER 1

Network ArchitectureModern converged networks include different traffic types each withunique requirements for security Quality of Service (QoS) transmissioncapacity and delay Some examples include

n Voice signaling and bearer

n Core application traffic such as Enterprise Resource Planning(ERP) or Customer Relationship Management (CRM)

n Database transactions

n Multicast multimedia

n Network management

n ldquoOtherrdquo traffic such as web pages e-mail and file transfer

Cisco routers are able to implement filtering compression prioritizationand policing (dedicating network capacity) Except for filtering thesecapabilities are referred to collectively as QoS

Although QoS is wonderful it is not the only way to address bandwidthshortage Cisco espouses an idea called the Intelligent InformationNetwork (IIN) IIN builds on standard network design models to enablethese new services to be reliable and layered on top of traditional datadelivery

[ 4 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

SONA and IINIIN describes an evolutionary vision of a network that integrates networkand application functionality cooperatively and allows the network to besmart about how it handles traffic to minimize the footprint of applicationsIIN is built on top of the Enterprise Composite Model and describesstructures overlaid on to the Composite design as needed in three phases

Phase 1 ldquoIntegrated Transportrdquo describes a converged network which isbuilt along the lines of the Composite model and based on open standardsThis is the phase that the industry has been transitioning The CiscoIntegrated Services Routers (ISR) are an example of this trend

Phase 2 ldquoIntegrated Servicesrdquo attempts to virtualize resources such asservers storage and network access It is a move to an ldquoon-demandrdquo model

By ldquovirtualizerdquo Cisco means that the services are not associated with aparticular device or location Instead many services can reside in onedevice to ease management or many devices can provide one servicethat is more reliable

An ISR brings together routing switching voice security and wirelessIt is an example of many services existing on one device A load balancerwhich makes many servers look like one is an example of one serviceresiding on many devices

VRFs are an example of taking one resource and making it look likemany Some versions of IOS are capable of having a router present itselfas many virtual router (VRF) instances allowing your company todeliver different logical topologies on the same physical infrastructure

CHAPTER 1

NETWORK ARCHITECTURE

Server virtualization is another example The classic example of takingone resource and making it appear to be many resources is the use of avirtual LAN (VLAN) and a virtual storage area network (VSAN)

Virtualization provides flexibility in configuration and management

Phase 3 ldquoIntegrated Applicationsrdquo uses application-oriented network-ing (AON) to make the network application-aware and to allow thenetwork to actively participate in service delivery

An example of this Phase 3 IIN systems approach to service delivery isNetwork Admission Control (NAC) Before NAC authenticationVLAN assignment and anti-virus updates were separately managedWith NAC in place the network is able to check the policy stance of aclient and admit deny or remediate based on policies

IIN allows the network to deconstruct packets parse fields and takeactions based on the values it finds An ISR equipped with an AONblade might be set up to route traffic from a business partner The AONblade can examine traffic recognize the application and rebuild XMLfiles in memory Corrupted XML fields might represent an attack(called schema poisoning) so the AON blade can react by blocking thatsource from further communication In this example routing an aware-ness of the application data flow and security are combined to allowthe network to contribute to the success of the application

[ 5 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Services-Oriented Network Architecture (SONA) applies the IIN idealto Enterprise networks SONA breaks down the IIN functions into threelayers

n Network InfrastructuremdashHierarchical converged network andattached end systems

n Interactive ServicesmdashResources allocated to applications

n ApplicationsmdashIncludes business policy and logic

IOS features such as Survivable Remote Site Telephony (SRST) andAutoQoS cooperate with centralized services to increase the resiliencyof the network by easily distributing network application logic to theedges of the enterprise so that the entire network participates in opera-tions instead of just the core

Figure 1-1 shows how IIN and SONA more specifically compare

Business Apps Collaboration Apps

Middleware Middleware

Phase 1 ndash Integrated Transport (converged network)

Phase 3 ndash Integrated Applications

(ldquoapplication awarerdquo)

Phase 2 ndash Integrated Services (virtualized resources)

SONA Framework LayersIIN Phases

Infr

astr

uctu

reLa

yer

App

licat

ion

Laye

rIn

tera

ctiv

e S

ervi

ces

Laye

r

Network

Servers StorageClients

Application Networking Services

Infrastructure Services

Col

labo

ratio

n La

yer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-1 IIN and SONA

[ 6 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Network ModelsCisco has developed specific architecture recommendations forCampus Data Center WAN branches and telecommuting Theserecommendations add specific ideas about how current technologiesand capabilities match the network roles within an enterprise

Each of these designs builds on a traditional hierarchical design andadds features such as security QoS caching and convergence

Hierarchical Design ModelThe traditional model provided a high-level idea of how a reliablenetwork could be conceived but it was short on specific guidance

Figure 1-2 is a simple drawing of how the three-layer model mighthave been built A distribution layer-3 switch is used for each buildingon campus tying together the access switches on the floors The coreswitches link the various buildings together

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-2 Three-Layer Hierarchical Design

[ 7 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The layers break a network in the following way

n Access layermdashEnd stations attach to the network using low-costdevices

n Distribution layermdashIntermediate devices apply policies

mdash Route summarization

mdash Policies applied such as

bull Route selection

bull Access lists

bull Quality of Service (QoS)

Core

Access

Distribution

n Core layermdashThe backbone that provides a high-speed pathbetween distribution elements

mdash Distribution devices are interconnected

mdash High speed (there is a lot of traffic)

mdash No policies (it is tough enough to keep up)

Enterprise Composite NetworkModelThe newer Cisco modelmdashthe Enterprise Composite Modelmdashis signifi-cantly more complex and attempts to address the shortcomings of theHierarchical Design Model by expanding the older version and makingspecific recommendations about how and where certain network func-tions should be implemented This model is based on the principlesdescribed in the Cisco Architecture for Voice Video and IntegratedData (AVVID)

The Enterprise Composite Model is broken into three large sections

n Enterprise Campus

n Enterprise Edge

n Service Provider Edge

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 2: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

ABOUT THE AUTHORS

[ 2 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

About the AuthorsBrent Stewart CCNP CCDP MCSE Certified Cisco Systems Instructor is a network administratorfor CommScope He participated in the development of BSCI and has seperately developed trainingmaterial for ICND BSCI BCMSN BCRAN and CIT Brent lives in Hickory NC with his wifeKaren and children Benjamin Kaitlyn Madelyn and William

Denise Donohue CCIE No 9566 is a Design Engineer with ATampT She is responsible for designingand implementing data and VoIP networks for SBC and ATampT customers Prior to that she was aCisco instructor and course director for Global Knowledge Her CCIE is in Routing and Switching

ICONS USED IN THIS BOOK

Icons Used in This Book

[ 3 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Si

WebBrowser

Internal Firewall IDS Database

Router 7507Router

Multilayer Switchwith Text

MultilayerSwitch

SwitchCommunication Server

IDC

App Server

Double-click to view image at full size in an external viewer

CHAPTER 1

Network ArchitectureModern converged networks include different traffic types each withunique requirements for security Quality of Service (QoS) transmissioncapacity and delay Some examples include

n Voice signaling and bearer

n Core application traffic such as Enterprise Resource Planning(ERP) or Customer Relationship Management (CRM)

n Database transactions

n Multicast multimedia

n Network management

n ldquoOtherrdquo traffic such as web pages e-mail and file transfer

Cisco routers are able to implement filtering compression prioritizationand policing (dedicating network capacity) Except for filtering thesecapabilities are referred to collectively as QoS

Although QoS is wonderful it is not the only way to address bandwidthshortage Cisco espouses an idea called the Intelligent InformationNetwork (IIN) IIN builds on standard network design models to enablethese new services to be reliable and layered on top of traditional datadelivery

[ 4 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

SONA and IINIIN describes an evolutionary vision of a network that integrates networkand application functionality cooperatively and allows the network to besmart about how it handles traffic to minimize the footprint of applicationsIIN is built on top of the Enterprise Composite Model and describesstructures overlaid on to the Composite design as needed in three phases

Phase 1 ldquoIntegrated Transportrdquo describes a converged network which isbuilt along the lines of the Composite model and based on open standardsThis is the phase that the industry has been transitioning The CiscoIntegrated Services Routers (ISR) are an example of this trend

Phase 2 ldquoIntegrated Servicesrdquo attempts to virtualize resources such asservers storage and network access It is a move to an ldquoon-demandrdquo model

By ldquovirtualizerdquo Cisco means that the services are not associated with aparticular device or location Instead many services can reside in onedevice to ease management or many devices can provide one servicethat is more reliable

An ISR brings together routing switching voice security and wirelessIt is an example of many services existing on one device A load balancerwhich makes many servers look like one is an example of one serviceresiding on many devices

VRFs are an example of taking one resource and making it look likemany Some versions of IOS are capable of having a router present itselfas many virtual router (VRF) instances allowing your company todeliver different logical topologies on the same physical infrastructure

CHAPTER 1

NETWORK ARCHITECTURE

Server virtualization is another example The classic example of takingone resource and making it appear to be many resources is the use of avirtual LAN (VLAN) and a virtual storage area network (VSAN)

Virtualization provides flexibility in configuration and management

Phase 3 ldquoIntegrated Applicationsrdquo uses application-oriented network-ing (AON) to make the network application-aware and to allow thenetwork to actively participate in service delivery

An example of this Phase 3 IIN systems approach to service delivery isNetwork Admission Control (NAC) Before NAC authenticationVLAN assignment and anti-virus updates were separately managedWith NAC in place the network is able to check the policy stance of aclient and admit deny or remediate based on policies

IIN allows the network to deconstruct packets parse fields and takeactions based on the values it finds An ISR equipped with an AONblade might be set up to route traffic from a business partner The AONblade can examine traffic recognize the application and rebuild XMLfiles in memory Corrupted XML fields might represent an attack(called schema poisoning) so the AON blade can react by blocking thatsource from further communication In this example routing an aware-ness of the application data flow and security are combined to allowthe network to contribute to the success of the application

[ 5 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Services-Oriented Network Architecture (SONA) applies the IIN idealto Enterprise networks SONA breaks down the IIN functions into threelayers

n Network InfrastructuremdashHierarchical converged network andattached end systems

n Interactive ServicesmdashResources allocated to applications

n ApplicationsmdashIncludes business policy and logic

IOS features such as Survivable Remote Site Telephony (SRST) andAutoQoS cooperate with centralized services to increase the resiliencyof the network by easily distributing network application logic to theedges of the enterprise so that the entire network participates in opera-tions instead of just the core

Figure 1-1 shows how IIN and SONA more specifically compare

Business Apps Collaboration Apps

Middleware Middleware

Phase 1 ndash Integrated Transport (converged network)

Phase 3 ndash Integrated Applications

(ldquoapplication awarerdquo)

Phase 2 ndash Integrated Services (virtualized resources)

SONA Framework LayersIIN Phases

Infr

astr

uctu

reLa

yer

App

licat

ion

Laye

rIn

tera

ctiv

e S

ervi

ces

Laye

r

Network

Servers StorageClients

Application Networking Services

Infrastructure Services

Col

labo

ratio

n La

yer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-1 IIN and SONA

[ 6 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Network ModelsCisco has developed specific architecture recommendations forCampus Data Center WAN branches and telecommuting Theserecommendations add specific ideas about how current technologiesand capabilities match the network roles within an enterprise

Each of these designs builds on a traditional hierarchical design andadds features such as security QoS caching and convergence

Hierarchical Design ModelThe traditional model provided a high-level idea of how a reliablenetwork could be conceived but it was short on specific guidance

Figure 1-2 is a simple drawing of how the three-layer model mighthave been built A distribution layer-3 switch is used for each buildingon campus tying together the access switches on the floors The coreswitches link the various buildings together

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-2 Three-Layer Hierarchical Design

[ 7 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The layers break a network in the following way

n Access layermdashEnd stations attach to the network using low-costdevices

n Distribution layermdashIntermediate devices apply policies

mdash Route summarization

mdash Policies applied such as

bull Route selection

bull Access lists

bull Quality of Service (QoS)

Core

Access

Distribution

n Core layermdashThe backbone that provides a high-speed pathbetween distribution elements

mdash Distribution devices are interconnected

mdash High speed (there is a lot of traffic)

mdash No policies (it is tough enough to keep up)

Enterprise Composite NetworkModelThe newer Cisco modelmdashthe Enterprise Composite Modelmdashis signifi-cantly more complex and attempts to address the shortcomings of theHierarchical Design Model by expanding the older version and makingspecific recommendations about how and where certain network func-tions should be implemented This model is based on the principlesdescribed in the Cisco Architecture for Voice Video and IntegratedData (AVVID)

The Enterprise Composite Model is broken into three large sections

n Enterprise Campus

n Enterprise Edge

n Service Provider Edge

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 3: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

ICONS USED IN THIS BOOK

Icons Used in This Book

[ 3 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Si

WebBrowser

Internal Firewall IDS Database

Router 7507Router

Multilayer Switchwith Text

MultilayerSwitch

SwitchCommunication Server

IDC

App Server

Double-click to view image at full size in an external viewer

CHAPTER 1

Network ArchitectureModern converged networks include different traffic types each withunique requirements for security Quality of Service (QoS) transmissioncapacity and delay Some examples include

n Voice signaling and bearer

n Core application traffic such as Enterprise Resource Planning(ERP) or Customer Relationship Management (CRM)

n Database transactions

n Multicast multimedia

n Network management

n ldquoOtherrdquo traffic such as web pages e-mail and file transfer

Cisco routers are able to implement filtering compression prioritizationand policing (dedicating network capacity) Except for filtering thesecapabilities are referred to collectively as QoS

Although QoS is wonderful it is not the only way to address bandwidthshortage Cisco espouses an idea called the Intelligent InformationNetwork (IIN) IIN builds on standard network design models to enablethese new services to be reliable and layered on top of traditional datadelivery

[ 4 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

SONA and IINIIN describes an evolutionary vision of a network that integrates networkand application functionality cooperatively and allows the network to besmart about how it handles traffic to minimize the footprint of applicationsIIN is built on top of the Enterprise Composite Model and describesstructures overlaid on to the Composite design as needed in three phases

Phase 1 ldquoIntegrated Transportrdquo describes a converged network which isbuilt along the lines of the Composite model and based on open standardsThis is the phase that the industry has been transitioning The CiscoIntegrated Services Routers (ISR) are an example of this trend

Phase 2 ldquoIntegrated Servicesrdquo attempts to virtualize resources such asservers storage and network access It is a move to an ldquoon-demandrdquo model

By ldquovirtualizerdquo Cisco means that the services are not associated with aparticular device or location Instead many services can reside in onedevice to ease management or many devices can provide one servicethat is more reliable

An ISR brings together routing switching voice security and wirelessIt is an example of many services existing on one device A load balancerwhich makes many servers look like one is an example of one serviceresiding on many devices

VRFs are an example of taking one resource and making it look likemany Some versions of IOS are capable of having a router present itselfas many virtual router (VRF) instances allowing your company todeliver different logical topologies on the same physical infrastructure

CHAPTER 1

NETWORK ARCHITECTURE

Server virtualization is another example The classic example of takingone resource and making it appear to be many resources is the use of avirtual LAN (VLAN) and a virtual storage area network (VSAN)

Virtualization provides flexibility in configuration and management

Phase 3 ldquoIntegrated Applicationsrdquo uses application-oriented network-ing (AON) to make the network application-aware and to allow thenetwork to actively participate in service delivery

An example of this Phase 3 IIN systems approach to service delivery isNetwork Admission Control (NAC) Before NAC authenticationVLAN assignment and anti-virus updates were separately managedWith NAC in place the network is able to check the policy stance of aclient and admit deny or remediate based on policies

IIN allows the network to deconstruct packets parse fields and takeactions based on the values it finds An ISR equipped with an AONblade might be set up to route traffic from a business partner The AONblade can examine traffic recognize the application and rebuild XMLfiles in memory Corrupted XML fields might represent an attack(called schema poisoning) so the AON blade can react by blocking thatsource from further communication In this example routing an aware-ness of the application data flow and security are combined to allowthe network to contribute to the success of the application

[ 5 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Services-Oriented Network Architecture (SONA) applies the IIN idealto Enterprise networks SONA breaks down the IIN functions into threelayers

n Network InfrastructuremdashHierarchical converged network andattached end systems

n Interactive ServicesmdashResources allocated to applications

n ApplicationsmdashIncludes business policy and logic

IOS features such as Survivable Remote Site Telephony (SRST) andAutoQoS cooperate with centralized services to increase the resiliencyof the network by easily distributing network application logic to theedges of the enterprise so that the entire network participates in opera-tions instead of just the core

Figure 1-1 shows how IIN and SONA more specifically compare

Business Apps Collaboration Apps

Middleware Middleware

Phase 1 ndash Integrated Transport (converged network)

Phase 3 ndash Integrated Applications

(ldquoapplication awarerdquo)

Phase 2 ndash Integrated Services (virtualized resources)

SONA Framework LayersIIN Phases

Infr

astr

uctu

reLa

yer

App

licat

ion

Laye

rIn

tera

ctiv

e S

ervi

ces

Laye

r

Network

Servers StorageClients

Application Networking Services

Infrastructure Services

Col

labo

ratio

n La

yer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-1 IIN and SONA

[ 6 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Network ModelsCisco has developed specific architecture recommendations forCampus Data Center WAN branches and telecommuting Theserecommendations add specific ideas about how current technologiesand capabilities match the network roles within an enterprise

Each of these designs builds on a traditional hierarchical design andadds features such as security QoS caching and convergence

Hierarchical Design ModelThe traditional model provided a high-level idea of how a reliablenetwork could be conceived but it was short on specific guidance

Figure 1-2 is a simple drawing of how the three-layer model mighthave been built A distribution layer-3 switch is used for each buildingon campus tying together the access switches on the floors The coreswitches link the various buildings together

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-2 Three-Layer Hierarchical Design

[ 7 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The layers break a network in the following way

n Access layermdashEnd stations attach to the network using low-costdevices

n Distribution layermdashIntermediate devices apply policies

mdash Route summarization

mdash Policies applied such as

bull Route selection

bull Access lists

bull Quality of Service (QoS)

Core

Access

Distribution

n Core layermdashThe backbone that provides a high-speed pathbetween distribution elements

mdash Distribution devices are interconnected

mdash High speed (there is a lot of traffic)

mdash No policies (it is tough enough to keep up)

Enterprise Composite NetworkModelThe newer Cisco modelmdashthe Enterprise Composite Modelmdashis signifi-cantly more complex and attempts to address the shortcomings of theHierarchical Design Model by expanding the older version and makingspecific recommendations about how and where certain network func-tions should be implemented This model is based on the principlesdescribed in the Cisco Architecture for Voice Video and IntegratedData (AVVID)

The Enterprise Composite Model is broken into three large sections

n Enterprise Campus

n Enterprise Edge

n Service Provider Edge

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 4: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 1

Network ArchitectureModern converged networks include different traffic types each withunique requirements for security Quality of Service (QoS) transmissioncapacity and delay Some examples include

n Voice signaling and bearer

n Core application traffic such as Enterprise Resource Planning(ERP) or Customer Relationship Management (CRM)

n Database transactions

n Multicast multimedia

n Network management

n ldquoOtherrdquo traffic such as web pages e-mail and file transfer

Cisco routers are able to implement filtering compression prioritizationand policing (dedicating network capacity) Except for filtering thesecapabilities are referred to collectively as QoS

Although QoS is wonderful it is not the only way to address bandwidthshortage Cisco espouses an idea called the Intelligent InformationNetwork (IIN) IIN builds on standard network design models to enablethese new services to be reliable and layered on top of traditional datadelivery

[ 4 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

SONA and IINIIN describes an evolutionary vision of a network that integrates networkand application functionality cooperatively and allows the network to besmart about how it handles traffic to minimize the footprint of applicationsIIN is built on top of the Enterprise Composite Model and describesstructures overlaid on to the Composite design as needed in three phases

Phase 1 ldquoIntegrated Transportrdquo describes a converged network which isbuilt along the lines of the Composite model and based on open standardsThis is the phase that the industry has been transitioning The CiscoIntegrated Services Routers (ISR) are an example of this trend

Phase 2 ldquoIntegrated Servicesrdquo attempts to virtualize resources such asservers storage and network access It is a move to an ldquoon-demandrdquo model

By ldquovirtualizerdquo Cisco means that the services are not associated with aparticular device or location Instead many services can reside in onedevice to ease management or many devices can provide one servicethat is more reliable

An ISR brings together routing switching voice security and wirelessIt is an example of many services existing on one device A load balancerwhich makes many servers look like one is an example of one serviceresiding on many devices

VRFs are an example of taking one resource and making it look likemany Some versions of IOS are capable of having a router present itselfas many virtual router (VRF) instances allowing your company todeliver different logical topologies on the same physical infrastructure

CHAPTER 1

NETWORK ARCHITECTURE

Server virtualization is another example The classic example of takingone resource and making it appear to be many resources is the use of avirtual LAN (VLAN) and a virtual storage area network (VSAN)

Virtualization provides flexibility in configuration and management

Phase 3 ldquoIntegrated Applicationsrdquo uses application-oriented network-ing (AON) to make the network application-aware and to allow thenetwork to actively participate in service delivery

An example of this Phase 3 IIN systems approach to service delivery isNetwork Admission Control (NAC) Before NAC authenticationVLAN assignment and anti-virus updates were separately managedWith NAC in place the network is able to check the policy stance of aclient and admit deny or remediate based on policies

IIN allows the network to deconstruct packets parse fields and takeactions based on the values it finds An ISR equipped with an AONblade might be set up to route traffic from a business partner The AONblade can examine traffic recognize the application and rebuild XMLfiles in memory Corrupted XML fields might represent an attack(called schema poisoning) so the AON blade can react by blocking thatsource from further communication In this example routing an aware-ness of the application data flow and security are combined to allowthe network to contribute to the success of the application

[ 5 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Services-Oriented Network Architecture (SONA) applies the IIN idealto Enterprise networks SONA breaks down the IIN functions into threelayers

n Network InfrastructuremdashHierarchical converged network andattached end systems

n Interactive ServicesmdashResources allocated to applications

n ApplicationsmdashIncludes business policy and logic

IOS features such as Survivable Remote Site Telephony (SRST) andAutoQoS cooperate with centralized services to increase the resiliencyof the network by easily distributing network application logic to theedges of the enterprise so that the entire network participates in opera-tions instead of just the core

Figure 1-1 shows how IIN and SONA more specifically compare

Business Apps Collaboration Apps

Middleware Middleware

Phase 1 ndash Integrated Transport (converged network)

Phase 3 ndash Integrated Applications

(ldquoapplication awarerdquo)

Phase 2 ndash Integrated Services (virtualized resources)

SONA Framework LayersIIN Phases

Infr

astr

uctu

reLa

yer

App

licat

ion

Laye

rIn

tera

ctiv

e S

ervi

ces

Laye

r

Network

Servers StorageClients

Application Networking Services

Infrastructure Services

Col

labo

ratio

n La

yer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-1 IIN and SONA

[ 6 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Network ModelsCisco has developed specific architecture recommendations forCampus Data Center WAN branches and telecommuting Theserecommendations add specific ideas about how current technologiesand capabilities match the network roles within an enterprise

Each of these designs builds on a traditional hierarchical design andadds features such as security QoS caching and convergence

Hierarchical Design ModelThe traditional model provided a high-level idea of how a reliablenetwork could be conceived but it was short on specific guidance

Figure 1-2 is a simple drawing of how the three-layer model mighthave been built A distribution layer-3 switch is used for each buildingon campus tying together the access switches on the floors The coreswitches link the various buildings together

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-2 Three-Layer Hierarchical Design

[ 7 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The layers break a network in the following way

n Access layermdashEnd stations attach to the network using low-costdevices

n Distribution layermdashIntermediate devices apply policies

mdash Route summarization

mdash Policies applied such as

bull Route selection

bull Access lists

bull Quality of Service (QoS)

Core

Access

Distribution

n Core layermdashThe backbone that provides a high-speed pathbetween distribution elements

mdash Distribution devices are interconnected

mdash High speed (there is a lot of traffic)

mdash No policies (it is tough enough to keep up)

Enterprise Composite NetworkModelThe newer Cisco modelmdashthe Enterprise Composite Modelmdashis signifi-cantly more complex and attempts to address the shortcomings of theHierarchical Design Model by expanding the older version and makingspecific recommendations about how and where certain network func-tions should be implemented This model is based on the principlesdescribed in the Cisco Architecture for Voice Video and IntegratedData (AVVID)

The Enterprise Composite Model is broken into three large sections

n Enterprise Campus

n Enterprise Edge

n Service Provider Edge

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 5: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 1

NETWORK ARCHITECTURE

Server virtualization is another example The classic example of takingone resource and making it appear to be many resources is the use of avirtual LAN (VLAN) and a virtual storage area network (VSAN)

Virtualization provides flexibility in configuration and management

Phase 3 ldquoIntegrated Applicationsrdquo uses application-oriented network-ing (AON) to make the network application-aware and to allow thenetwork to actively participate in service delivery

An example of this Phase 3 IIN systems approach to service delivery isNetwork Admission Control (NAC) Before NAC authenticationVLAN assignment and anti-virus updates were separately managedWith NAC in place the network is able to check the policy stance of aclient and admit deny or remediate based on policies

IIN allows the network to deconstruct packets parse fields and takeactions based on the values it finds An ISR equipped with an AONblade might be set up to route traffic from a business partner The AONblade can examine traffic recognize the application and rebuild XMLfiles in memory Corrupted XML fields might represent an attack(called schema poisoning) so the AON blade can react by blocking thatsource from further communication In this example routing an aware-ness of the application data flow and security are combined to allowthe network to contribute to the success of the application

[ 5 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Services-Oriented Network Architecture (SONA) applies the IIN idealto Enterprise networks SONA breaks down the IIN functions into threelayers

n Network InfrastructuremdashHierarchical converged network andattached end systems

n Interactive ServicesmdashResources allocated to applications

n ApplicationsmdashIncludes business policy and logic

IOS features such as Survivable Remote Site Telephony (SRST) andAutoQoS cooperate with centralized services to increase the resiliencyof the network by easily distributing network application logic to theedges of the enterprise so that the entire network participates in opera-tions instead of just the core

Figure 1-1 shows how IIN and SONA more specifically compare

Business Apps Collaboration Apps

Middleware Middleware

Phase 1 ndash Integrated Transport (converged network)

Phase 3 ndash Integrated Applications

(ldquoapplication awarerdquo)

Phase 2 ndash Integrated Services (virtualized resources)

SONA Framework LayersIIN Phases

Infr

astr

uctu

reLa

yer

App

licat

ion

Laye

rIn

tera

ctiv

e S

ervi

ces

Laye

r

Network

Servers StorageClients

Application Networking Services

Infrastructure Services

Col

labo

ratio

n La

yer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-1 IIN and SONA

[ 6 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Network ModelsCisco has developed specific architecture recommendations forCampus Data Center WAN branches and telecommuting Theserecommendations add specific ideas about how current technologiesand capabilities match the network roles within an enterprise

Each of these designs builds on a traditional hierarchical design andadds features such as security QoS caching and convergence

Hierarchical Design ModelThe traditional model provided a high-level idea of how a reliablenetwork could be conceived but it was short on specific guidance

Figure 1-2 is a simple drawing of how the three-layer model mighthave been built A distribution layer-3 switch is used for each buildingon campus tying together the access switches on the floors The coreswitches link the various buildings together

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-2 Three-Layer Hierarchical Design

[ 7 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The layers break a network in the following way

n Access layermdashEnd stations attach to the network using low-costdevices

n Distribution layermdashIntermediate devices apply policies

mdash Route summarization

mdash Policies applied such as

bull Route selection

bull Access lists

bull Quality of Service (QoS)

Core

Access

Distribution

n Core layermdashThe backbone that provides a high-speed pathbetween distribution elements

mdash Distribution devices are interconnected

mdash High speed (there is a lot of traffic)

mdash No policies (it is tough enough to keep up)

Enterprise Composite NetworkModelThe newer Cisco modelmdashthe Enterprise Composite Modelmdashis signifi-cantly more complex and attempts to address the shortcomings of theHierarchical Design Model by expanding the older version and makingspecific recommendations about how and where certain network func-tions should be implemented This model is based on the principlesdescribed in the Cisco Architecture for Voice Video and IntegratedData (AVVID)

The Enterprise Composite Model is broken into three large sections

n Enterprise Campus

n Enterprise Edge

n Service Provider Edge

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 6: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

Business Apps Collaboration Apps

Middleware Middleware

Phase 1 ndash Integrated Transport (converged network)

Phase 3 ndash Integrated Applications

(ldquoapplication awarerdquo)

Phase 2 ndash Integrated Services (virtualized resources)

SONA Framework LayersIIN Phases

Infr

astr

uctu

reLa

yer

App

licat

ion

Laye

rIn

tera

ctiv

e S

ervi

ces

Laye

r

Network

Servers StorageClients

Application Networking Services

Infrastructure Services

Col

labo

ratio

n La

yer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-1 IIN and SONA

[ 6 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Network ModelsCisco has developed specific architecture recommendations forCampus Data Center WAN branches and telecommuting Theserecommendations add specific ideas about how current technologiesand capabilities match the network roles within an enterprise

Each of these designs builds on a traditional hierarchical design andadds features such as security QoS caching and convergence

Hierarchical Design ModelThe traditional model provided a high-level idea of how a reliablenetwork could be conceived but it was short on specific guidance

Figure 1-2 is a simple drawing of how the three-layer model mighthave been built A distribution layer-3 switch is used for each buildingon campus tying together the access switches on the floors The coreswitches link the various buildings together

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-2 Three-Layer Hierarchical Design

[ 7 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The layers break a network in the following way

n Access layermdashEnd stations attach to the network using low-costdevices

n Distribution layermdashIntermediate devices apply policies

mdash Route summarization

mdash Policies applied such as

bull Route selection

bull Access lists

bull Quality of Service (QoS)

Core

Access

Distribution

n Core layermdashThe backbone that provides a high-speed pathbetween distribution elements

mdash Distribution devices are interconnected

mdash High speed (there is a lot of traffic)

mdash No policies (it is tough enough to keep up)

Enterprise Composite NetworkModelThe newer Cisco modelmdashthe Enterprise Composite Modelmdashis signifi-cantly more complex and attempts to address the shortcomings of theHierarchical Design Model by expanding the older version and makingspecific recommendations about how and where certain network func-tions should be implemented This model is based on the principlesdescribed in the Cisco Architecture for Voice Video and IntegratedData (AVVID)

The Enterprise Composite Model is broken into three large sections

n Enterprise Campus

n Enterprise Edge

n Service Provider Edge

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 7: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-2 Three-Layer Hierarchical Design

[ 7 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The layers break a network in the following way

n Access layermdashEnd stations attach to the network using low-costdevices

n Distribution layermdashIntermediate devices apply policies

mdash Route summarization

mdash Policies applied such as

bull Route selection

bull Access lists

bull Quality of Service (QoS)

Core

Access

Distribution

n Core layermdashThe backbone that provides a high-speed pathbetween distribution elements

mdash Distribution devices are interconnected

mdash High speed (there is a lot of traffic)

mdash No policies (it is tough enough to keep up)

Enterprise Composite NetworkModelThe newer Cisco modelmdashthe Enterprise Composite Modelmdashis signifi-cantly more complex and attempts to address the shortcomings of theHierarchical Design Model by expanding the older version and makingspecific recommendations about how and where certain network func-tions should be implemented This model is based on the principlesdescribed in the Cisco Architecture for Voice Video and IntegratedData (AVVID)

The Enterprise Composite Model is broken into three large sections

n Enterprise Campus

n Enterprise Edge

n Service Provider Edge

Double-click to view image at full size in an external viewer

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 8: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 1

NETWORK ARCHITECTURE

The first section the Enterprise Campus looks like the old HierarchicalDesign Model with added details It features six sections

n Campus Backbone

n Building Distribution

n Building Access

n Management

n Edge DistributionmdashA distribution layer out to the WAN

n Server FarmmdashFor Enterprise services

The Enterprise Edge details the connections from the campus to theWide Area Network and includes

n E-commerce

n Internet connectivity

n Remote access

n WAN

[ 8 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The Service Provider Edge is just a list of the public networks thatfacilitate wide-area connectivity These include

n Internet service providers (ISP)

n Analog phone dial up

n Frame Relay ATM and PPP which have private connectivity

Figure 1-3 shows the Campus Enterprise Edge and Service ProviderEdge modules assembled Security implemented on this model isdescribed in the Cisco SAFE (Security Architecture for Enterprise)blueprint

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 9: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 1

NETWORK ARCHITECTURE

FIGURE 1-3 Enterprise Design

[ 9 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remote Access

E-Commerce

Internet

WAN

Campus BackboneEdge

Distribution

Internal Router

DMZ Firewall

Web

DatabaseIDC

App Server

Internet Router

Corporate Router

Dial-In

Internal RouterDMZ Firewall

PublicServers

Internet Router

Internal Router VPN

IDS

PPP

Service Provider EdgeEnterprise Edge

Internet

PSTN

Frame Relay ATM

Internal Firewall

Internal Firewall

Caching

Firewall

Double-click to view image at full size in an external viewer

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 10: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

IPPhone

AnalogPhone

CCM

RouterWAN Router

VoiceGateway

PSTN

2) Packets

1) Sound

3) Analog

4) Sound

101011010 IP

101011010 IP 101011010 IP 101011010 IP 101011010 IP

CHAPTER 2

Cisco VoIP

IntroductionVoice over IP (VoIP) is a set of technologies that seeks toreplace traditional analog voice services There are threemain compelling benefits to VoIP

n VoIP makes better use of network capacity Traditionalvoice uses a 64-Kbps circuit even when it is not activebut VoIP can use much less and no capacity when theline is not in use

n VoIP allows new and revolutionary features such as thefollowing

mdash Integration of voice and data systems (so that opera-tors get customer information popped on to thescreen when a phone call arrives)

mdash Voice CODECs can improve sound quality (at theexpense of bandwidth)

mdash Integration with new clients Instead of an analogphone VoIP clients can include television boxesPersonal Digital Assistants (PDAs) cell phoneslaptops and so on

n VoIP can save money by avoiding toll calls

[ 10 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP telephony solutions include many pieces

n Internet Protocol (IP) phones

n Analog phones connected to IP by a Gateway

n Control and number resolution by a Gatekeeper

n Conferencing capabilities provided by a multipoint control unit (MCU)

n Applications such as directories and product information that interface withsmart IP phones

TransmissionFigure 2-1 shows a VoIP transmission scenario

FIGURE 2-1 Passing Voice Packets

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 11: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

Voice is passed over an IP network by packetization Example 2-1shows an IP phone communicating with an older analog phone but anycombination of the two is supported The numbered list below matchesthe steps involved in taking sound and converting it packets and thenback to sound

1 Incoming sounds are grouped into slices of sound (typically 20ms) sampled and digitized

2 Each slice of sound is fitted with headers (data link IP UserDatagram Proocol [UDP] and Reliable Transport Protocol [RTP])and transmitted across the IP network

3 Because the analog phone doesnrsquot understand packets a gateway(in this case it is housed in a router) translates the stream ofpackets into an analog electrical signal

4 The analog phone receives an analog electrical signal and sends itto a speaker where the recording is restored to audio

Cisco routers are commonly deployed as gateways Three types ofanalog connections are supported

n Foreign Exchange Station (FXS)mdashFXS ports connect analogphones FXS ports supply line voltage

n Foreign Exchange Office (FXO)mdashFXO ports connect to a PrivateBranch Exchange (PBX) or to the Public Switched TelephoneNetwork (PSTN) FXO ports receive line voltage

[ 11 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n EampMmdashEampM (which is alternately said to stand for Ear andMouth or Earth and Magneto) interfaces supply advanced signal-ing to a PBX using a separate set of wires

Three digital phone ports are supported

1 ISDNmdashISDN interfaces support advanced Q931 signaling

2 T1E1 CCS (Common Channel Signaling)mdashT1E1 CCS uses achannel for signaling ISDN PRI uses CCS

3 T1E1 CAS (Channel Associated Signaling)mdashRobs bits from theanalog waveform for signaling and is not as full-featured

Although Figure 2-1 focused on the flow of voice records signaling isequally important to understand Signaling is what tells the systemwhich phone to ring and when the line is hung up Phone companies inparticular are interested in this (and might write it $ignaling) becausesignaling is used in billing Figure 2-2 shows the types of signaling thatare expected

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 12: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

FIGURE 2-2 Signaling

[ 12 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Connect and disconnect times are kept for billing

In Figure 2-2 a Call Manager is shown receiving the signaling A CallManager allows centralized call control which provides oversight ofthe call and records of connections and quality Voice trunking may beaccomplished without such supervision (called distributed call control)but care must be taken to not overburden links and quality must bemanually maintained

PacketizationBefore voice may be transmitted over a network sound has to be capturedfrom a microphone and digitized The digital recording is then choppedinto sections (each is typically 20 ms) which are sent sequentially andreplayed in order out a speaker

Sound is captured at a microphone by sampling (periodically taking apower reading) The Nyquist theorem says that to reproduce a signalsampling must occur at twice the maximum frequency The phonesystem is designed to capture frequencies less than 4 kHz which aresamples of 8000 times per second

Pulse Amplitude Modulation (PAM) is used in the PSTN Samples arequantized to 8-bit numbers 8000 times per second (yielding a 64-kbpsDS0)

Two forms of quantization are used A linear scale is used in the USwhile abroad a logarithmic scale is used The US system (called micro-law) was developed earlier and it suffered from lower-powered

CCM

How do I reach 555-1234

Is there sufficient

capacity to carry the call

Transmitted1000B latency

30 ms dropped 1

Expect a call

Hung up

IPPhone

AnalogPhone

RouterWAN Router

VoiceGateway

PSTNFXO

FXS

Signaling plays several important roles

n Information about the receiver is obtained

n Capacity is checked before starting otherwise call quality suffers

n Call quality is monitored so that adjustments may be made tomaintain call quality

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 13: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

sampling systems A-law (logarithmic sampling) was developed later tobe different and give domestic opportunities to European companiesthat were still recovering from World War II A-law benefits fromgreater computing resources and the logarithmic scale does a better jobof reproducing sound

After captured Pulse Amplitude Modulation (PAM) samples areencoded using a coderdecoder (CODEC) Coders work using two maintechniques PCM which encodes the signal straight to bits and CELPwhich matches the waveform to a predefined library and sends a code

G711 and G726 use PCM G711 uses 8 bits per sample whereasG726 uses 7 6 or 5 depending on the desired quality G728 and 729use CELP Resulting voice quality is shown in Table 2-1 Rememberthat the figures for bandwidth do not include headers

TABLE 2-1 Details of Five CODECs

CoDec Technique Bandwidth 20 ms Sample Size Quality

G711 PCM 64 160 410

G726 ADPCM 32 24 16 80 40 20 385

G728 LDCELP 16 40 361

G729 CS-ACELP 8 20 392

G729A CS-ACELP 8 20 390

Voice quality is measured on a scale called Mean Opinion Score(MOS) MOS has been scored by averaging judgesrsquo scores a MOS of 5is perfect whereas 4 is toll quality and anything less gets less and lessacceptable Perceptual Speech Quality Measurement (PSQM) is a

[ 13 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

newer technique that compares wave forms pre- and post-transmissionand grades on a scale of 0 to 65 PSQM is repeatable and less arbi-trary but the non-traditional scale made it hard to compare to MOS soPerceptual Evaluation of Speech Quality (PESQ) is a version of PSQMthat uses an MOS scale

All the ideas discussed in this sectionmdashsampling quantization encod-ing and compressionmdashdepend on specialized processors called DigitalSignal Processors (DSP) DSPs are also used for translating CODECs(transcoding) and for conferencing

TransmittingVoIP depends on three pillars

n Signaling is used for call setup and teardown Common protocolsinclude H323 SIP and MGCP

n Packetization sends voice samples inside IP packets

n QoS prioritizes VoIP traffic

There are three reasons users will throw new VoIP phones at you andbeg for old analog headsets packet loss delay and echo The biggestreason for packet loss is tail-drop in queues which is solved throughQoS The biggest issue with delay is variation in delay (called jitter)which causes large de-jitter buffers to be used and causes more delayThe solution to jitter is QoS Echo is solved through a technique calledecho-cancellation (G168) which is on by default and compensates fordelay

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 14: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

Voice samples are encapsulated in Real Time Protocol (RTP) packetsVoice does not need the reliability provided by TCP by the time aretransmission happened the moment to play the sound would havepassed Voice does need a way to order samples and recognize the timebetween samples which UDP by itself doesnrsquot allow RTP is a protocolwithin UDP that adds the necessary features

A complete VoIP packet needs to include a data link header (Ethernethas a 14 Byte header and 4 Bytes CRC) an IP header (20 Bytes) an 8Byte UDP header and 12 Bytes for RTP Each 20ms sample thereforeincludes 58 Bytes of overhead G711 sends 8000 Bytes per second(20ms would therefore need 160 Bytes) so about a quarter of the trans-mission is headers

[ 14 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Voice SampleG711 20ms = 160B

Fra

me

CR

CE

ther

net (

4B)

Vo

ice

Sam

ple

G7

29 2

0ms

= 2

0B

IP Header(20B)

UD

P H

eade

r (8

B)

Fra

me

Hea

der

Eth

erne

t (14

B)

RTPHeader (12B)

Fra

me

CR

CE

ther

net (

4B)

Figure 2-3 shows the header overhead graphically and Table 2-1 showsthe bandwidth consumed by the various CODECs including headers Ifthe phone uses 20 ms samples (50 samples per second) then there willbe 50 headers G711 instead of being 64 Kbps turns out to be

(Headers + Sample) 50s=

(14B + 20B + 8B + 12B + 160B + 4B) 50s =

218 B 50s= 10900 Bs = 87200 bs = 872 Kbps

FIGURE 2-3 Protocol Layout for Voice Transmission over IP

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 15: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

Note that G729 uses 20-byte samples and so it needs only 312kbps

At this point you may have sticker shock If G729 is billed as 8 Kbpsper conversation 312 Kbps seems extreme There are ways to mitigatethe difference although the techniques do not completely erase theneed for headers

One way is to use RTP header compression Header compression isconfigured per link and remembers previous IP UDP and RTP headerssubstituting 2B- or 4B-labels subsequently By taking the header setfrom 40B to 4B cRTP delivers G729 using 22-B headers and aconsumption of 168 Kbps

Voice Activity Detection (VAD) is a technology that recognizes whenyou are not talking and ceases transmission thus saving bandwidth Innormal speech one person or the other is talking less than 65 percentof the time (there are those long uncomfortable silences right after yousay ldquoYou did whatrdquo) VAD can therefore dramatically reduce demandsfor bandwidth

The bad news with VAD is that it doesnrsquot help with music (such as holdmusic) and that it creates ldquodead airrdquo which can be mistaken for discon-nection Some phones in fact will play soft static to reinforce that theline is still live (this is called comfort noise)

[ 15 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Bandwidth RequirementsVarious tradeoffs go into selecting the parameters for a VoIP implemen-tation each of which affect voice quality and bandwidth Theseinclude

n Sample periodmdashEach packet represents a period of time Longerperiods mean that fewer headers have to be sent but add delaywhile accumulating samples Shorter periods mean more headeroverhead but less delay

n Packets per secondmdashOne second divided by the sample period

n CODECmdashEach coding protocol uses more or less bandwidth andoffers more or less quality See Table 2-1 for details

n IPUDPRTP overheadmdash40 B or 4 B if using cRTP with check-sum or 2B if using cRTP without checksum

n Data Link overheadmdashEthernet uses 18 B This varies by protocol

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 16: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

A Worksheet for Calculating VoIPBandwidthSample period =_____ Packets per second = _____

CODEC = _____ Sample size = _____

Header size (40 B without cRTP 4 B with) = _____

Data Link overhead = _____

Total packet = sample + header + data link = _____

Packets per second = times _____

_____

Multiply by 8 to get bs times 8

_____

Divide by 1000 to get kbs 1000

_____

[ 16 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

An Example for G711 No Compression overEthernet 20 ms SamplesSample period = 20 ms Packets per second = 50s

CODEC = G711 Sample size = 160B

Header size (40 B wo cRTP 4 B with) = + 40 B

Data Link overhead = + 18B

Total packet = sample + header + data link = 218B

Packets per second = times 50s

10900 Bs

Multiply by 8 to get bs times 8 bB

87200 bs

Divide by 1000 to get kbs 1000 Kbb

872 Kbs

Additionally allot 30ndash73 bytes for IPSec headers if used

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 17: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

Implementing IP TelephonyIn the enterprise IP telephony is deployed to replace a PBX A typical PBX contains a switchingfunction (the ldquobrainsrdquo) and cards that attach extensions (station cards) and connect to the outsideworld (line cards) Figure 2-4 shows the evolution from an old PBX to a modern distributed IPtelephony solution

FIGURE 2-4 Evolution from PBX to IP Telephony

[ 17 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

A Cisco Call Manager takes the place of the ldquobrainsrdquo and helps end stations understand how to reacheach other CCM also oversees the dial plan produces utilization reports and determines functionalityCCM is typically deployed in a cluster so that the system does not rely on one machine

Switching Engine

Network

Router with FXO

PC withSoftphone

Call Manager

Router with FXS

( )

( )

PBX

Other Resources

Station CardConnections to desktop phones

External Line CardConnections to PSTN

NOTECisco Call Manager Express runs on arouter and can be used for small officesRouters are also deployed as backup callmanagers (this is called SurvivableRemote Site Telephony or SRST) sobeing disconnected from a remote CCMdoes not disable a branch phone system

Double-click to view image at full size in an external viewer

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 18: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

FXSFXO

FXS

B

APSTN

CHAPTER 2

CISCO VOIP

IP phones and soft phones connect directly to the network whereaslegacy phones connect to the network through FXS ports on routersRouters operating this way are called gateways Think of the networkand gateways as being equivalent to the station cards in an old PBX

Routers with external connections such as FXO ports are also calledgateways In this scenario however the router takes the place of anexternal line card

Telephony deployments follow one of four models

n Single SitemdashOne office uses a CCM cluster to handle localphones

n Multisite with centralized call processingmdashOne CCM cluster atheadquarters handles local and remote phones Branch officestypically are set up with SRST

n Multisite with distributed call processingmdashEach site has a CCMcluster

n Clustering over WANmdashThe CCM cluster is distributed betweenlocations

One other piece not shown or discussed so far is Call AdmissionControl (CAC) Usually data is described as ldquobetter to degrade servicethan to deny servicerdquo which is to say that when more users need

[ 18 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

service everyone goes slower But the voice world has never said thatone more user would cause quality to go down In fact voice engineerswould say ldquoItrsquos better to deny service than to degrade servicerdquo

The problem is how do you limit the number of calls going across aVoIP network Intuitively there is nothing to prevent one more personfrom calling This is where CAC comes in CAC is a tool that tracksthe number of calls andmdashwhen it reaches a threshold valuemdashpreventsanother call CAC is an important part of an IP telephony solution

Configuring Cisco Routers to Support VoIPConsider Figure 2-5 as a precursor to reading about the configurationof a router with FXO FXS and VoIP neighbors

FIGURE 2-5 Voice over IP Network Topology

Double-click to view image at full size in an external viewer

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 19: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 2

CISCO VOIP

The configuration is shown in Example 2-1

EXAMPLE 2-1 Configuration of Router A

hostname router_Ainterface s00ip address 17221771 2552552550

dial-peer voice 1 voipdestination-pattern 720session-target ipv417221772

dial-peer voice 2 potsdestination-pattern 721port 100

dial-peer voice 3 potsdestination-pattern 9

port 200

In Example 2-1 the dial plan consists of three patterns Dialing 9 getsan outside line dialing 720 rings the phone on the other router and 721rings the pots line on the local router

All patterns need a destination-pattern statement to configure the dialplan Phones reached over IP also need a session target whereasdirectly attached analog phones are referenced by port

[ 19 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 20: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QoS OverviewQuality of service (QoS) configurations give special treatment tocertain traffic at the expense of others This helps make your networkperformance more deterministic and predictable for this traffic UsingQoS in the network addresses the following problems

n Lack of bandwidth for important applications

n Delay of sensitive data such as voice and video

n Jitter (variable delay)

n Packet loss due to data being dropped at a congested interface

BandwidthIn a network with several hops the available bandwidth is only asmuch as the smallest link When multiple applications and multipleflows use the same links the available bandwidth per application iseven smallermdashit equals the smallest link bandwidth divided by thenumber of flows Insufficient bandwidth especially affects time-sensi-tive and interactive traffic and traffic with large flows

You can increase link speeds to get more bandwidthmdashthat can beexpensive time-consuming and introduce technological difficultiesAlternatively QoS mechanisms can guarantee bandwidth to specificapplications

[ 20 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Compressing the traffic on slower links creates more useable band-width because each frame is smaller there are fewer bits to transmitHowever compressing data uses processor and memory resources andintroduces some latency while the compression is being done Becauseof this use compression only on T1 links or less You can compress thewhole payload or just compress the protocol headers with TCP or Real-time Protocol (RTP) header compression (cRTP) Cisco supports threepayload compression algorithms

n Stacker

n Predictor

n Microsoft Point-to-Point Compression (MPPC)

For voice use Low Latency Queuing (LLQ) and cRTP compressionand for data use Class-Based Weighted Fair Queuing (CBWFQ) andTCP compression LLQ and CBWFQ are discussed later in thischapter

Delay and JitterNetwork traffic experiences four types of delay

n Processing DelaymdashThe time it takes a packet to move from theinput interface of a router or Layer 3 switch to the output inter-face Processing delay depends on switching mode CPU speedand utilization the routerrsquos architecture and interface configura-tion This is a variable delay

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 21: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

n Queuing DelaymdashThe length of time a packet waits in the interfacequeue before being sent to the transmit ring Queuing delaydepends on the number and size of packets in the queue and thequeuing methods in place This is a variable delay

n Serialization DelaymdashThe length of time it take to place the bitsfrom the interface transmit ring onto the wire Serialization delaydepends on the bandwidth of the interfacemdashhigher bandwidthequals smaller serialization delay This is a fixed delay

n Propagation DelaymdashThe length of time it takes the packet tomove from one end of the link to the other Propagation delaydepends on the type of media such as fiber or satellite links Thisis a fixed delay

The total delay is the sum of all four delays on every link along thepath Because processing and queuing delay times can vary end-to-enddelay can vary from packet to packet This variation is called jitter

To decrease delay you can increase the link bandwidth prioritizeimportant packets (note that this increases the delay for non-prioritytraffic) or compress the packet headers or the payloads On links underT1 speed you can fragment large packets and interleave smaller inter-active packets between themmdashthis is called Link Fragmentation andInterleave (LFI)

When your traffic traverses an ISP network you might need to repriori-tize it to match the providerrsquos standards

[ 21 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Packet Loss IssuesPacket loss can cause jerky transmission of voice or video slow appli-cation performance or corrupt data By default when a software queueis full (congested) the switch or router drops all other traffic bound forthat queue This is called tail drop It can cause some problems

n TCP global synchronization

n TCP buffer starvation

n Delay and jitter

n High-priority traffic is dropped whereas low-priority traffic is sent

Congestion avoidance attempts to prevent tail drop To accomplish thisincrease link bandwidth use queuing to guarantee a certain amount oftraffic to each application or use Weighted Random Early Detection(WRED) WRED drops lower-priority traffic (based on DifferentiatedServices Code Point [DSCP] or IP Precedence values) as a queue startsto fill and drops high-priority traffic only when the queue is almost fullIf the queue fills completely however tail drop is used The dropthresholds and the drop ratios are configurable WRED works best withTCP traffic because TCP dynamically adjusts its sending rate whenpackets are dropped Do not use WRED for voice traffic TheldquoCongestion Avoidancerdquo section describes this more completely

Four other causes of packet drop are frame errors lack of buffer space(called an ignore) a CPU that is unable to assign a free buffer to it(called an overrun) or a CPU that is too busy to process inboundpackets so the inbound queue fills

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 22: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

Defining QOS Requirements for NetworkTrafficTo implement QoS you need to identify the types of network trafficdetermine the requirements for each divide the traffic into classes andthen set policies for those classes

A network audit helps identify the types of traffic on the network

The relative importance of each application is a business decisionaccomplished by a business audit Applications should be grouped intoclasses that have about the same QoS requirements Some commonclasses include Voice Interactive Mission-critical Transactional Best-effort and Scavenger

A QoS policy then can be created for each class of traffic You need todecide such things as allocated bandwidth (minimum andormaximum) prioritization and congestion avoidance

QOS ModelsThere are three QoS models

n Best effortmdashTraffic is sent with no guarantees of bandwidth orpriority

n Integrated Services (IntServ)mdashThe QoS parameters are signaledthroughout the path and guaranteed for the length of the session

n Differentiated Services (DiffServ)mdashQoS parameters are applied totraffic classes at each hop along the path

[ 22 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Best EffortBest-effort delivery is the default methodmdashtraffic is sent out in theorder it arrives with no differentiation between types of traffic and noguarantee of delivery Benefits of best effort include its scalability (theInternet is based on best-effort delivery) and its ease of deploymentDrawbacks include the fact that all traffic is given the same servicelevel

IntServIntServ is a QoS model that guarantees a specific level of service toeach flow of identified traffic throughout the entire network for thelength of the session This is done using Resource Reservation Protocol(RSVP) An RSVP-aware application or a router or CallManageracting in proxy for a nonRSVP-aware device requests a specific levelof service from its next-hop router A check is made along the pathbetween the two endpoints and each RSVP-enabled router along theway reserves bandwidth for that flow If the network cannot provide therequired bandwidth the session is not allowed or its service level isdowngraded

RSVP works for any type of traffic but it is usually used for real-timeapplications that are either rate-sensitive or delay-sensitive such asvoice and video Figure 3-1 shows a call between two IP phones

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 23: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

FIGURE 3-1 Using RSVP for Voice Calls

[ 23 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

per-flow admission control This can help with VoIP callsRSVP supports applications that use dynamic port numbersand static ones Some drawbacks include its overheadmdashsignaling is exchanged at the beginning of a flow so therecan be some delay It must continue to cross the networkfor the length of the flow to adjust for changes in path dueto network changes thus causing extra overheadAdditionally because you need to track each flow it is notscalable in a large enterprise

For more information on using RSVP with VoIP see theCisco Press book Cisco Voice Gateways and Gatekeepersby David Mallory Ken Salhoff and Denise Donohue

DiffServDiffServ groups network traffic into classes comprised oftraffic needing the same type of QoS treatment Forinstance voice traffic is separated from email trafficHowever e-mail might be placed in the same class as webtraffic The exact classes traffic and QoS policies used area business decision

These classes are distinguished from each other based onthe value of certain bits in the IP or ISL header or the8021Q tag Each hop along the way must be configured totreat the marked traffic the way you wantmdashthis is calledper-hop behavior (PHB)

GW1 - RSVP GW2 - No RSV GW3 - RSVP

RSVP reservation messages

= Interface configured for RSVP -

reservations will be made here

V V V

Two of the routers in the pathmdashGW1 and GW3mdashare configured with RSVPhowever GW2 is not When GW1 and GW3 receive the RSVP messages requestinga service level they reserve that amount of bandwidth on their WAN interface Theremust be some sort of QoS configured on the routers to implement the reservationWhen GW2 receives the RSVP messages it merely passes them on to the nexthop router unchanged Note that reservations are made in both directions becuasethis is a voice call

All routers in the path are not required to be configured with RSVP but reserva-tions are made only on those routers and those interfaces with it enabled Toensure end-to-end service configure RSVP on all router interfaces in the datapath

The path between endpoints is determined by the routing protocol not by RSVPIf there is a network change and the routing protocol changes the path thenRSVP reconverges also

Current applications use DiffServ to enact IntServ QoS policies such as guaranteedrate and controlled load One of the biggest benefits of IntServ is that it provides

Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 24: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

n In the Layer 3 IP header you use the 8-bit Type of Service (ToS)field You can set either IP Precedence using the top 3 bits orDSCP using the top 6 bits of the field The bottom 2 bits are notused for setting priority The default DSCP value is zero whichcorresponds to best-effort delivery

n At Layer 2 with ISL you can set 3 of the 4 bits in the ISL prior-ity field to reflect the class of service (CoS) With 8021Q you setthe 3 8021p bits to the CoS The values of these 3 bits correspondto the IP Precedence values

Benefits of DiffServ include the many classes of service possible andits scalability As a drawback it can be complex to configure It alsodoes not absolutely guarantee a level of service

QoS Implementation MethodsThe legacy method of configuring QoS was at each interface on eachrouter using the Command Line Interface (CLI) The current recom-mended method is to use the Modular QoS CLI (MQC) which allowsyou to create one configuration that can then be applied to many inter-faces Common QoS settings have been automated with AutoQoS Forthose who prefer a GUI interface there is the Cisco Router andSecurity Device Manager (SDM)

[ 24 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Legacy CLIThe traditional QoS configuration using legacy CLI involves accessingthe router via Telnet or console port Traffic classification and policyenforcement are combined in the configuration at each interface whichis time-consuming and can lead to errors

The types of QoS possible are limited also For example you can dosimple priority queuing custom queuing and compression Legacy CLIQoS might be used to tweak AutoQoS settings

MQCModular QoS CLI (MQC) is a method of classifying traffic markingthe traffic and setting policies for that traffic that can be used on mostdevices with most kinds of policies Itrsquos most important contribution isthe separation of traffic classification from policy implementation Hereare general steps for implementing MQC

Step 1 Create the necessary access control lists if classifyingtraffic by ACL or configure network-based applicationrecognition (NBAR) (Click here for an explanation ofNBAR)

Step 2 Create class maps that specify matching such items asACLs protocol DSCP or IP Precedence values

Step 3 Create a policy map that links to each class map anddefines the policy for each

Step 4 Apply the policy map to the appropriate interfaces

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 25: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

When access control lists (ACL) are used to classify traffic the way arouter or switch reacts to specific access control entries (ACE) is differentin a QoS context than with security-based ACLs In a QoS access list

n If the traffic matches a permit statement the designated QoSaction is taken

n If the traffic matches a deny statement the rest of the ACEs in thatACL are skipped and the switch goes to the next ACL

n If there are multiple ACLs in a policy applied to an interface theswitch stops reading them as soon as a permit statement match isfound for the traffic

n If the traffic does not match any ACL entry the switch just givesbest-effort delivery to the traffic

MQC ConfigurationFirst configure the ACLs if using them to identify traffic

Second configure a class map for each classification of traffic Classmap names are case-sensitive

(config)class-map [match-any | match-all] name

(config-cmap)match match options such as ACL

Third configure a policy map that calls the class maps and sets policiesor types of treatment for each class Policy map names are also casesensitive

[ 25 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

(config)policy-map name

(config-pmap)class class-map-name

(config-pmap-c)policy options such as set DSCP or bandwidth

Finally apply the MQC policy to the desired interface(s) eitherinbound or outbound

(config-if)service-policy output | input name

Verifying QoS ConfigurationUse the following commands to verify your QoS configurations andactions

n show class-map [name]mdashDisplays the configured class maps orjust the one named

n show policy-map [name]mdashDisplays the configured policy mapsor just the one named

n show policy-map [ interface [interface-number [input | output]]| [ class class-name]mdashDisplays the policy maps and statistics byinterface or class

n show queueing [interface interface-number]mdashShows the queuingstrategy and statistics for any queues configured on the interface

n show policy interface interface-numbermdashDisplays the policiesfor all classes applied to the interface along with statistics

n debug ip rsvpmdashIf using RSVP for voice shows informationabout packets received and sent

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 26: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

AutoQoSAutoQoS is a utility that automates and simplifies QoS configuration givinga consistent configuration across the network It discovers the applicationstraversing the router or switch and configures standard best practice QoSpolicies for them It can be used with both LAN and WAN interfacesAutomatic configurations can be tuned if necessary by using the MQCor with legacy CLI AutoQoS was originally only for VoIP applicationsbut recent versions can be used with data applications also

When configured on a WAN interface AutoQoS

n Detects and classifies VoIP and data traffic (typically using NBAR)

n Builds appropriate services policies including placing Real-TimeProtocol (RTP) traffic into a low-latency queue (LLQ) and guaran-teeing bandwidth to VoIP control traffic

n Sets up traffic shaping fragmentation or compression where needed

n Enables SNMP traps and syslog alerting for VoIP events

When configured on a LAN interface AutoQoS

n Sets up priorityexpedited queuing on the switch interface

n Configures the COS mapping to queues and adjusts queue sizeand weights

n Sets up trust boundaries on user access ports and links betweenswitches Trusts the incoming CoS only when an IP phone ispresent

[ 26 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

To use AutoQoS CEF must be enabled and the correct bandwidthconfigured on each interface then AutoQos is enabled as follows Thisexample enables AutoQoS for VoIP only Notice that after thecommands are given the router has created a policy map (not shown)and applied it to the interface

Router(config)int s1001

Router(config-if)bandwidth 1544

Router(config-if)auto qos voip

Routershow auto qos int s1001

Serial1001 -

interface Serial1001

service-policy output AutoQoS-Policy-UnTrust

SDM QoS WizardSDM allows GUI configuration of router interfaces firewall ACL featuresVPNs routing Network Address Translation (NAT) Intrusion PreventionNetwork Access Control (NAC) and QoS It helps nonexpert users toconfigure these router functions SDM comes preinstalled on the ISRrouters but to use the SDM Wizard the routerrsquos HTTP server functionmust be enabled

With the SDMrsquos QoS Wizard you can configure monitor and troubleshootQoS configurations Browse to http1010101mdashthe default IP addressfor SDM From the ldquoConfigurerdquo menu choose to configure QoS Thislaunches the QoS Wizard shown in Figure 3-2

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 27: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

FIGURE 3-2 SDM QoS Wizard

[ 27 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You can specify bandwidth allocation for these classes or use thewizardrsquos recommendations After the wizard is done it shows you thepolicies and loads them into the routerrsquos configuration You can editthem later as shown in Figure 3-3

FIGURE 3-3 Editing the QoS Wizard Policies

Notice that the wizard creates policies for two types of traffic

n Real-TimemdashVoIP and signaling packets

n Business-CriticalmdashThis has three subcategories

mdash TransactionalmdashDatabase interactive sessions and enterprise applications

mdash ManagementmdashNetwork management applications

mdash RoutingmdashRouting protocolsIf you select ldquoMonitorrdquo from the menu and then ldquoQoS Statusrdquo you canmonitor the amounts and types of traffic through each interface configuredfor QoS The interval traffic direction and type of statistics shown can beadjusted

Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer
Double-click to view image at full size in an external viewer

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 28: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 3

QOS OVERVIEW

QoS Methods ComparisonThus Cisco provides four ways for you to configure QoS in yournetwork They each have their strengths and weaknesses

n Legacy CLImdashHardest to use little capability to fine-tune takesthe longest to implement and is not modular

n MQCmdashEasier to use and takes less time to implement on multipleinterfaces than does legacy CLI Has excellent capability to fine-tune configurations and it is modular

n AutoQoSmdashEasy to use but it has limited inherent fine-tuningtakes the least time to implement and has excellent modularity

n SDM QoS WizardmdashSimple to use can do some limited fine-tuning is fast to implement and has good modularity

[ 28 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 29: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QoS DetailsThis chapter explores in detail ways of choosing and configuringquality of service The way you classify and mark traffic and the typeof QoS policies you implement will depend on the policy location andtypes of network traffic present

Classification and MarkingClassification is the most basic Quality of Service (QoS) stepmdashuntiltraffic is identified it cannot be provided a unique level of serviceTraffic is often classified by application source or destination IPaddress or inbound interface

After traffic is classified an appropriate marking can be applied to itThe location where traffic is marked defines a trust boundary If thedevice that marked the traffic is trusted then that marking is passedthrough the network and honored by each device If that device isuntrusted then some trusted network entity must re-mark the traffic

Classification and marking should be done as close to the traffic sourceas possible because they can be resource intensive Marking at the enddevice such as an IP phone is ideal Otherwise mark (or re-mark)traffic at the access switch or distribution switch if necessary

Layer 2 markings include 8021Q Class of Service (CoS) andMultiprotocol Label Switching (MPLS) experimental bits Frame relaymarkings are differentmdashthey include setting the Backward Explicit

[ 29 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Congestion Notification (BECN) bit the Forward Explicit CongestionNotification (FECN) bit or the Discard Eligible (DE) bit in the framerelay header Layer 3 markings include Differentiated Services CodePoint (DSCP) and IP precedence After traffic is classified and markedother routers and switches in the network can be configured to provideQoS to it

Using NBAR for Classifying TrafficThere are several ways to identify traffic so that it can be classifiedAccess lists are commonly used to identify application data but Ciscohas an IOS-based tool that provides more granularity and goes beyondstatic port numbers Network-Based Application Recognition (NBAR)is an IOS protocol discovery and classification mechanism It monitorsthe traffic going in and out of an interface identifies it by protocol portnumber or payload contents (up to 400 bytes) and provides trafficstatistics NBAR recognizes common applications even those that usedynamic ports For instance Real-Time Protocol (RTP) carries voiceand video traffic and uses dynamic port numbers within a large rangeAn access list can match traffic within that range of port numbers butNBAR can match on the following RTP characteristics

n Audio traffic (using payload types 0ndash23)

n Video traffic (using payload types 24ndash33)

n Payload type for a specific payload type value

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 30: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

NoteNBAR does not identify RTP control traffic just RTP bearer traffic

You can additionally configure NBAR to recognize custom applica-tions Cisco provides downloadable Packet Description LanguageModules (PDLM) that also add additional applications

CEF must be enabled on each interface where NBAR is used Toenable NBAR at an interface and then view the traffic that it discoversuse the commands

Router(config-if)ip nbar protocol-discovery

Routershow ip nbar protocol-discovery

You can download new PDLMs from the Cisco web sitehttpwwwciscocomcgi-bintablebuildplpdlm You must be a regis-tered user After the file is downloaded you should either save it in therouterrsquos flash or place it on a TFTP server reachable by the routerInstruct the router to load the PDLM with the following command

Router(config)ip nbar pdlm pdlm_name

The name is in URL format and points the router either to the file inflash or to the TFTP server For example you might use ip nbar pdlmflashbittorentpdlm to load the PDLM for Bit Torrent from flashmemory

Sometimes users map protocols to different ports than NBAR expectsTo tell NBAR to look for a protocol on additional ports and to thenverify your configuration use the commands

[ 30 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config)ip nbar port-map protocol [tcp | udp] port

Routershow ip nbar port-map

To use NBAR for classifying traffic with the MQC follow these steps

Step 1 Enable NBAR on all appropriate interfaces

Step 2 Create a class map that matches against one or more of theNBAR protocols using the match protocol option Repeatthis step for each class desired

Step 3 Create a policy that links to those class maps and assignsdesired service to it

Step 4 Apply the policy to an interface

Example 4-1 shows NBAR enabled on a GigEthernet interface andclass maps created to match three types of traffic discovered by NBARRTP any web traffic that has the word ldquoccnprdquo in its URL andeDonkey A policy map is created that marks this traffic and it isapplied inbound to the LAN interface

EXAMPLE 4-1 Using NBAR with the MQC

Router(config)int gi 00

Router(config-if)ip nbar protocol-discovery

Router(config)class-map VOIP

Router(config-cmap)match protocol rtp audio

Router(config-cmap)

Router(config-cmap)class-map Exams

Router(config-cmap)match protocol http url ccnp

Router(config-cmap)

Router(config-cmap)class-map eDonkey

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 31: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Router(config-cmap)match protocol edonkey

Router(config)policy-map NBAR

Router(config-pmap)class VOIP

Router(config-pmap-c)set ip dscp ef

Router(config-pmap-c)class Exams

Router(config-pmap-c)set ip dscp 31

Router(config-pmap-c)class eDonkey

Router(config-pmap-c)set ip dscp 13

Router(config-pmap-c)int gi 00

Router(config-if)service-policy input NBAR

This classifies and marks the traffic and uses NBAR to identify itClassification and marking needs to happen only oncemdashall otherdevices in the network can just look for the DSCP markings and setpolicies based on those Thus the next part must be to configure someway to treat this classified and marked traffic An example of thisconfiguration is the section on LLQ and CBWFQ Click here to reviewthat configuration Configure

For more detailed information on NBAR including a list of applications it currently is able to recognize see this linkhttpwwwciscocomenUSproductsps6616products_qanda_item09

186a00800a3dedshtml

[ 31 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 2CoS uses the three 8021p bits in the 8021Q trunking tag to marktraffic These three bits have eight possible values ranging betweenzero and seven IP Precedence uses three bits in the IP header so it hasthe same range of values as does CoS Table 4-1 lists the values andtheir standard meanings

TABLE 4-1 IP Precedence and CoS Values

IP PrecedenceCoS Name

7 Network

6 Internet

5 Critical

4 Flash-override

3 Flash

2 Immediate

1 Priority

0 Routine

When frames enter a switch the Layer 2 header is stripped off Theswitch maps the CoS value to an internal DSCP value as the packetmoves through it This DSCP value is then translated back to a CoSvalue if the packet is sent over another trunk link There are defaultvalues for the mappings between and CoS and DSCP but they can alsobe configured

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 32: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

MPLS labels have a three-bit field called the MPLS experimental(MPLS EXP) field which has the same eight possible values as CoSand IP Precedence By default any IP Precedence value is copied intothis field and becomes the Layer 2 marking for MPLS traffic Serviceproviders alternatively can set these bits independently thus markingthe traffic within their network without changing their customerrsquos Layer3 marking The value of MPLS EXP bits is preserved through theMPLS network

Table 4-2 lists the eight Layer 2 markings and some suggested applica-tions for them

TABLE 4-2 Layer 2 Markings and Applications

CoS Value Application

7 Reserved

6 Reserved

5 Voice Bearer

4 Video

3 Call Signaling

2 High-Priority Data

1 Medium-Priority Data

0 Best-Effort Data

[ 32 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Marking at Layer 3The concept behind DiffServ (DS) is to group traffic into classes andmark it once at the edge of the network DiffServ was created to behighly scalable by separating classification from policy creation and byservicing aggregate classes of traffic rather than individual flows

DiffServ uses Layer 3 markings setting the eight-bit ToS field in the IPheader Unlike the Layer 2 header this marking remains with thepacket as it traverses the network and changes only if some deviceoverwrites the value of these bits You can set either IP Precedenceusing the top three bits or Differentiated Services Code Points (DSCP)using the top six bits of the field The bottom two bits can be used forcongestion notification The default DSCP value is zero which corre-sponds to best-effort delivery When properly configured DSCP isbackward compatible with IP Precedence

Each hop in the network is provisioned to treat traffic differently basedon its markings this is called ldquoper-hop behaviorrdquo (PHB) RFC 2475defines PHB as ldquothe externally observable forwarding behavior appliedat a DS-compliant node to a DS behavior aggregaterdquo A behavioraggregate is a logical grouping of traffic that needs similar servicelevels It is also referred to as a service class Four PHBs are defined

n Default

n Assured forwarding

n Class selector

n Expedited forwarding

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 33: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Default PHBAll the bits in the TOS byte are set to ldquo0rdquo which gives best-effortdelivery Any unmarked traffic is mapped to this PHB

Assured Forwarding and Class Selector PHBFigure 4-1 shows the TOS byte in the IP header

FIGURE 4-1 The TOS Byte in the IP Header

[ 33 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AF classes 1ndash4 are defined and within each class 1 is low drop proba-bility 2 is medium and 3 is high (meaning that traffic is more likely toget dropped if there is congestion)

AF guarantees a specified amount of bandwidth to a class By defaultit allows the traffic to burst above that amount if there is extra band-width available although this can be policed

Table 4-3 lists the classes and their associated AF values

TABLE 4-3 Assured Forwarding Values

Low Drop Medium Drop High Drop

Class 1 AF11 AF12 AF13

Class 2 AF21 AF22 AF23

Class 3 AF31 AF32 AF33

Class 4 AF41 AF42 AF43

DiffServ Expedited Forwarding PHBAnother predefined DiffServ classification is Expedited Forwarding(EF) which is DSCP 46 This is equivalent to IP precedence 5 EFtraffic becomes a separate queue at the QoS-enabled router interfaceYou must configure each hop in the network for the type of service youwant EF traffic to receive EF is usually used to put traffic in a low-latency queue which results in low delay guarantees a specifiedamount of bandwidth and also polices the traffic to prevent it fromexceeding that bandwidth

Congestion Notification bitsIP Precedence or AF bits Class Selector bits

TOS Byte

The six DSCP bits can be broken down into two sections The highestthree bits define the DiffServ Assured Forwarding (AF) class (the areain green) and the next three bits are called the ldquoClass Selector (CS)rdquo(the area in yellow) When the three CS bits are all zero you have avalue that is equal to IP Precedence The lowest two bits (the area inwhite) are not used in DiffServ markingmdashthey allow the sending ofcongestion notification information

Each AF class becomes its own queue at the interface AF uses the firsttwo CS bits to define the drop probability within that queue The lastbit is always zero and is not used in calculating drop probability values

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 34: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Classifying and Marking in a VoIP NetworkFigure 4-2 shows what happens to the CoS and DSCP settings of a datapacket as it moves through a QoS-enabled LAN

n In the figure users with an 8021Q-enabled Network InterfaceCard (NIC) on their PC attempts to give their data higher prioritywithin the network They send a frame with an 8021Q tag inwhich they have set the 8021p bits to CoS of 7 They have alsoset the DSCP on the packet to 56 This animation shows just therelevant parts of the headers used

n The IP phone by default creates an 8021Q trunk between itselfand the Access switch It sets the 8021p CoS on data traffic tozero but it does not change any Layer 3 markings

[ 34 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n The Access switch gets the frame from the phone and strips theLayer 2 header By default it translates into an internal DSCP ofzero as it moves through the switch fabric however this switch isconfigured to classify and mark data traffic This particular appli-cation falls into a class that gets a Layer 3 marking of AF11 orDSCP 10 (binary value 001010) The switch remarks the DSCPvalue and then sets the CoS to 1 in the 8021Q tag when it sendsthe packet to the Distribution switch

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toAF11 traffic The switchrsquos interface to the router is a Layer 3interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

Trustboundary ifthe PC istrusted

(rarely done)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted butthe Distribution

switch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

PC with 8021Q-capable NICsends a packet through thephone PC user sets thepacketrsquos DSCP to 56 (IP

precedence 7) and CoS to 7

Data DSCP = 56IP Header

CoS = 78021p bits

Phone sets CoS on PCtraffic to 0 before

forwarding to Accessswitch Does not change

the DSCP value

Data DSCP = 56IP Header

CoS = 08021p bits

Switch is configured classifyand mark data traffic It setsboth DSCP and CoS on PCtraffic to 1 before forwarding

to Distribution switch

Data DSCP = 1IP Header

CoS = 18021p bits

Data DSCP = 1IP Header

Switch is configured to trustAccess switch It gives QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It givesQoS service to packet whennsending to WAN does not

change DSCP

Data DSCP = 1IP Header

Data DSCP = 1IP Header

ISP does not trust customerrouter leaves DSCP at 1 butsets MPLS EXP to 0 Trafficwill be given best-effort QoSthrough providerrsquos network

MPLS EXP = 0MPLS Label

FIGURE 4-2 CoS and DSCP Changes for a Data Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 35: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides thetype of QoS service it is configured to provide to AF11 trafficThis might include allocating a certain amount of bandwidth andusing Weighted Random Early Detection (WRED) in the queueThe router then forwards the packet to its ISP edge router

n The ISP is not configured to trust the customerrsquos markings Itcould overwrite all DSCP values with zero but in this case it justsets the MPLS Experimental Bits in the MPLS label to zero TheDSCP stays unchanged The packet receives only best-effortservice as it moves through the ISPs network but devices in thedestination network can use the unchanged DSCP values toprovide QoS service to the packet

[ 35 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 4-3 shows what happens to the CoS and DSCP settings of avoice packet as it moves through a QoS-enabled LAN In this examplethe ISP trusts the customerrsquos markings

n The Cisco IP phone creates an 8021Q trunk between itself and theAccess switch It sets the 8021p CoS on its own voice mediatraffic to 5 and it sets the Layer 3 marking to EF or DSCP 46(binary value 101110) If this were voice signaling traffic thephone would set a CoS of 3 and a Layer 3 marking of CS3 orDSCP 24 (binary value 011000)

Trustboundary if

the IP Phoneis trusted

Trustboundary if

the IP Phoneis untrusted

but the Accessswitch is trusted

Trustboundary ifthe Access

switch isuntrusted but

Distributionswitch is trusted

Trustboundary ifISP if the

customerrsquosmarkings arenot trusted

ISP Network

Phone sets CoS to 5 andDSCP to 46 on voice

traffic before forwardingto Access switch

Switch is configured to trustthe IP phone It leaves theDSCP value uncharged

and recreates the CoS of 5when forwarding toDistribution switch

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

CoS = 58021p bits

Data DSCP = 46IP Header

Switch is configured to trustAccess switch It give QoS

service to packet whensending to router does not

change DSCP

Router is configured to trustDistribution switch It gives

QoS service to packet wheresending to WAN does not

change DSCP

Data DSCP = 46IP Header

Data DSCP = 46

IP Header

ISP does trust customerrouter leaves DSCP

unchanged at 46 sets MPLSEXP to 5 MPLS network

provides QoS servicecontracted for the packet

MPLS EXP = 5

MPLS Label

FIGURE 4-3 CoS and DSCP Changes for a Voice Packet

Double-click to view image at full size in an external viewer

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 36: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

n The Access switch gets the frame from the phone and strips theLayer 2 header It is configured to trust the IP phone so it translatesthe CoS value into an internal DSCP as the packet moves throughthe switch fabric The switch then translates that internal DSCPvalue back to a CoS of 5 in the 8021Q tag when it sends thepacket to the Distribution switch The Access switch applies anyoutbound policies configured for this traffic such as putting it intoa priority interface queue as it sends it to the outbound interface

n The Distribution switch is configured to trust the Access switchrsquosmarkings It strips off the Layer 2 header looks at the DSCP valueand provides the type of QoS service it is configured to provide toEF traffic This typically includes placing the packet in a priorityqueue at the interface The switchrsquos interface to the router is a Layer3 interface so no trunk tag is used Instead it puts on a normalEthernet frame header and forwards the packet to the router

n The router is configured to trust the packetrsquos markings It strips offthe Layer 2 header looks at the DSCP value and provides the typeof QoS service it is configured to provide to EF traffic This typicallyincludes placing the packet in an LLQ and allocating a certain amountof bandwidth to that queue The router then forwards the packet toits ISP edge router

n The ISP is configured to trust the customerrsquos markings It translatesthe IP precedence value of 5 into an MPLS Experimental Bits valueof 5 The DSCP stays unchanged The packet receives prioritizedreal-time service as it moves through the ISPs network and devicesin the destination network can use the unchanged DSCP values toalso provide QoS service to the packet

[ 36 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Queuing OverviewQueuing configuration usually acts on outbound traffic Each interfacehas a hardware queue or transmit ring (TxQ) that holds traffic readyto be serialized onto the interface media This queue is always FirstInFirst Out (FIFO) When outbound traffic arrives at an interface theinterface scheduler sends it to the transmit ring to be placed on themedia If the transmit ring is full other traffic must wait in some buffermemory space assigned to that interface called a software queue Whentraffic must be placed into queues the interface is said to be congested

Causes of congestion include

n Speed mismatches mdashTypically LAN traffic needing to go across amuch slower WAN link (persistent congestion) It can also beGigEthernet traffic bound out a FastEthernet interface (transientcongestion)

n Link aggregationmdashFor WAN links this occurs when multipleremote sites access a hub site across an oversubscribed link ForLAN links this typically occurs on a distribution switch withmultiple access switches feeding in to it on the uplink port(s) tothe core switch

Hardware QueueLogical interfaces such as subinterfaces and tunnel interfaces use thehardware queue of the physical interface they do not have their owntransmit queues

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 37: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

The number of packets a TxQ can hold depends on the speed of theinterface It is automatically determined and that length is typicallyfine but can be tuned if desired Most devices use the tx ring-limitcommand for tuning TxQ size

Lowering the Tx ring size lessens the length of time a packet waits inthe FIFO queue and it increases the chance of a packet hitting the soft-ware queue However too short of a TxQ results in router resource useas the CPU must be interrupted each time the Tx ring requests a packetfrom a software queue A decrease in ring size means an increase ininterrupts

Increasing the TxQ size is usually not recommended when using QoSbecause it decreases the use of the software queue

Use the show controllers interface command to find information aboutthe transmit ring size

Software QueueThe software queuing strategy is configurable and the next sectionsdeal with various techniques to do this This is where you can influencethe order in which packets are scheduled into the TxQ and the numberof packets sent When using queuing mechanisms several differentlogical queues are created and traffic is placed into the appropriatesoftware queue when it arrives at the interface Each software queuehas size limits and packets above that limit are dropped

[ 37 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Remember that fast-switched or CEF-switched traffic enters the soft-ware queue only if the hardware queue is congested Process-switchedtraffic always goes into the software queue

Legacy Queuing TechniquesQueuing mechanisms allow you to control the way congested traffic isbuffered and send out the interface by placing each type of traffic in itsown queue The router or switch then services each queue schedulingtransmittal of its traffic according to a configured policy

FIFO QueuingBy default most interfaces use FIFO queuingmdashthere is just one soft-ware queue and traffic is buffered and then scheduled onto the inter-face in the order it is received

NoteSerial interfaces of E1 speed and below use weighted fair queuing by defaultrather than FIFO queuing

Priority QueuingWith Priority queuing queues are assigned different priority values andplaced in one of four queues The high-priority queue is a strict priority

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 38: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

queue which means that it gets serviced before anything else until it isempty After that each queue is serviced in turn as long as the priorityqueue remains empty The lower-priority queues may never be servicedif there is sufficient traffic in higher-priority queues (a condition calledldquostarvationrdquo)

Round Robin QueuingRound Robin queuing takes one packet from each queue and then startsover Each queue is serviced none starve but there is no way to priori-tize any of the traffic or apply any sort of differential treatment to it

During times of interface congestion Weighted Round Robin (WRR)queuing weights queues and more packets are sent from higherweighted queues thus giving them more bandwidth However thebandwidth allocations are done in a way that might lead to more bytesbeing sent from some queues than desired which causes other packetsto be delayed

Weighted Fair QueuingWeighted Fair Queuing (WFQ) attempts to address some of the failingof FIFO and Priority queuing by allowing all traffic some access to theinterface Some characteristics of WFQ include

n Queues traffic by flow or conversation

n Flows are identified by header information such as source anddestination IP address protocol source and destination ports and

[ 38 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

type of service field value These are used by a hash algorithm tocreate a queue index number

n Each interface has a limited number of WFQ queues Default formost interfaces is 256 it can be configured from 16ndash4096

n If the number of flows exceeds the number of queues multipleflows are placed in the same queue resulting in less bandwidthper flow

n Provides queues for system traffic and RSVP traffic separate fromthe WFQ queues

n Traffic is weighted by flow based on IP precedence

n WFQ schedules small interactive flows before high-bandwidthflows

n Allows lower-weighted flows relatively more bandwidth thanhigher-weighted conversations

n Drops packets from high-volume flows more aggressively thanthose of low-volume flows

n The hold-queue limit determines how many packets can be held inthe WFQ system before all new packets are dropped (tail drop)The default is 1000

n The congestive discard threshold (CDT) determines how manypackets can be held by the WFQ before it begins dropping packetsfrom high-volume flows Packets are dropped from the queueswith the most packets first Packets are not dropped from low-volume conversations The default CDT is 64

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 39: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Advantages of WFQ include simplicity of configuration support onmost platforms and IOS versions allowing some bandwidth to alltraffic and dropping more packets from higher-bandwidth flows

Disadvantages of WFQ include lack of support for tunneling or encryp-tion lack of manual control over traffic classification lack of minimumor fixed bandwidth guarantees and chance of multiple flows placed inthe same queue

Configuring WFQWFQ is enabled by default on physical interfaces with a bandwidth lessthan 2048 Mbps If it has been disabled or to enable it on anotherinterface use the interface command fair-queue [congestive-discard-threshold [dynamic-queues [reservable-queues]]] For example thefollowing commands enable WFQ on the serial interface set a CDT of100 increase the number of flow queues to 512 and reserve 10 queuesfor RSVP to use

Router(config)int s1000

Router(config-if)fair-queue 100 512 10

To change the size of the hold queue use the hold-queue number in |out interface command as shown

Router(config-if)hold-queue 2000 out

To monitor the interface queues use either show interface interface orshow queue interface

[ 39 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Routershow interface s1000[output omitted]

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 020001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

[output omitted]

Routershow queue s1000

Input queue 07500 (sizemaxdropsflushes) Total outputdrops 0

Queueing strategy weighted fair

Output queue 010001000 (sizemax totalthresholddrops)

Conversations 00512 (activemax activemax total)

Reserved Conversations 00 (allocatedmax allocated)

Available Bandwidth 2250 kilobitssec

CBWFQ and LLQ

CBWFQClass-Based Weighted Fair Queuing (CBWFQ) addresses some of theproblems with WFQ It allows manual configuration of traffic classifi-cation and minimum bandwidth guarantees It uses the MQC to config-ure classes and allocate bandwidth Therefore you can group traffic

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 40: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

into classes based on any of the criteria available through the MQCEach class becomes its own FIFO queue at the interface This is stillconsidered Weighted Fair Queuing because each queue is assigned aweight based on the class bandwidth guarantee and the scheduler takespackets from each queue based on those weights

There are three ways to designate bandwidth within an MQC policymap All the CBWFQ classes within a single policy map must use thesame method

n The bandwidth bandwidth-in-kbps command

n The bandwidth percent command

n The bandwidth remaining percent command

Each of these methods designates a minimum bandwidth to allocate tothe class Traffic is allowed to burst above that amount if extra band-width is available You can allocate up to 75 percent of the interfacebandwidth by default the rest is reserved for system traffic such asrouting updates This can be changed using the max-reserved-band-width interface command

You can optionally specify the maximum number of packets allowed ineach class queue with the policy map command queue-limit number-of-packets The default is 64

Each policy map has a default class that is created automatically Alltraffic not identified by one of the other classes is placed in this queueYou can allocate bandwidth to this class or enable WFQ for its traffic

[ 40 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

but not both To enable WFQ use the fair-queue command If WFQ isenabled you can also configure the number of dynamic queues withthe fair-queue number-of-queues command

Benefits of CBWFQ include

n Control over traffic classification

n Minimum bandwidth guarantees

n Granular control and scalability

Drawbacks of CBWFQ include

n Voice traffic can be delayed

This example shows CBWFQ configured in a policy map along with LLQ

LLQLLQ addresses the needs of real-time traffic for low delay and guaranteedbandwidth It creates one priority queue (in addition to the CBWFQs)with bandwidth that is both guaranteed and policed This is a strict priorityqueuemdashtraffic is sent from it before any other queues However whenthe interface is congested the priority queue is not allowed to exceedits configured bandwidth to avoid starving the other queues Voice trafficis typically enqueued into the LLQ You can place more than one classof traffic in the LLQ If so the router still creates just one priority queuebut allocates bandwidth to each class and meters the traffic so that itdoes not exceed the bandwidth assigned to that class

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 41: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Configure LLQ under the class statement in the policy map

(config-pmap-c)priority bandwidth [burst] | percent percentage[burst]

Bandwidth is configured in kilobits per second and burst is configuredin bytes These bandwidth amounts include the layer 2 headers

Example 4-2 shows RTP voice traffic put into an LLQ then guaranteedand policed to 256K of bandwidth Traffic bound to URLs that includethe string ldquoccnprdquo are placed in another queue guaranteed 128K ofbandwidth and congestion avoidance is applied via WRED Trafficbound for eDonkey applications is dropped All other traffic falls intothe default class is placed in its own queue and WRED is applied Thepolicy is applied outbound on the serial interface

This example is based on an earlier classification and marking exampleTo refer back to it click here Classify

EXAMPLE 4-2 Configuring LLQ and CBQFQ

Router(config)class-map VOIP-Out

Router(config-cmap)match ip dscp ef

Router(config-cmap)

Router(config-cmap)class-map Exams-Out

Router(config-cmap)match ip dscp 31

Router(config-cmap)

Router(config-cmap)class-map eDonkey-Out

Router(config-cmap)match ip dscp 13

Router(config-cmap)

Router(config-cmap)policy-map QOS

Router(config-pmap)class VOIP-Out

Router(config-pmap-c)priority 256

[ 41 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Router(config-pmap-c)class ExamsRouter(config-pmap-c)bandwidth 128Router(config-pmap-c)random-detect dscp-basedRouter(config-pmap-c)class eDonkeyRouter(config-pmap-c)dropRouter(config-pmap-c)class class-defaultRouter(config-pmap-c)fair-queueRouter(config-pmap-c)random-detect dscp-basedRouter(config)int s1001Router(config-if)service-policy output QOS

Use the show policy-map interface interface command to see theservice policy configuration and also the effect it has had as shown inExample 4-3

EXAMPLE 4-3 Verifying a Policy Map

Routershow policy-map output interface s1000

Serial1000

Service-policy output TestPolicy

Class-map VoIP (match-all)0 packets 0 bytes5 minute offered rate 0 bps drop rate 0 bpsMatch access-group 100Weighted Fair QueueingStrict PriorityOutput Queue Conversation 264Bandwidth 128 (kbps) Burst 3200 (Bytes)(pkts matchedbytes matched) 00(total dropsbytes drops) 00

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 42: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Class-map class-default (match-any)

19 packets 1990 bytes

30 seconds offered rate 0 bps drop rate 0 bps

Match any

Congestion AvoidanceWRED solves two major problems with TCP and tail drop

n TCP Synchronization occurs when all TCP packets exiting aninterface are repeatedly dropped At each tail drop each sessiongoes into slow start and then ramps up its sending rate When theinterface queue fills all packets are dropped again and all sessionsreduce their sending again Eventually this results in waves ofincreased and decreased transmission causing underutilization of the interface

n TCP Starvation results when large flows with increased windowsizes fill the interface queue Packets from smaller or less aggres-sive flows are then dropped This can cause jitter for those smallerflows due to a lack of a differentiated dropping strategy

Random Early Detection (RED) attempts to avoid tail drops by prevent-ing the interface from becoming totally congested Once the queue fillsabove a threshold level it drops random packets from the interfacequeue dropping a higher percentage of packets as the queue fills TCPsessions experience a packet loss at different times and so they go intoslow start at different times thus preventing TCP synchronization

[ 42 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

You need to understand three RED concepts

n Minimum thresholdmdashThe queue depth at which RED beginsdropping packets

n Maximum thresholdmdashThe queue depth at which the maximumnumber of packets are being dropped

n Mark probability denominatormdashControls how many packets aredropped when the maximum threshold is reached The probabilityof a packet being dropped equals 1max-prob-denom

RED has three packet-dropping modes

n No dropmdashWhen the queue depth is between zero and theminimum threshold

n Random dropmdashWhen the queue depth is between the minimumand the maximum thresholds

n Tail dropmdashWhen the queue depth is above the maximum thresh-old

Basic RED does not distinguish between flows or types of trafficWeighted RED on the other hand drops traffic differently dependingon its IP precedence or DSCP value WRED is combined with CBWFQto implement DiffServrsquos Assured Forwarding PHB Each PHB has aunique WRED profile identifying a minimum threshold maximumthreshold and mark probability denominator for that profile There aredefault profiles for each PHB but they can also be manually configured

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 43: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Configure WRED under a physical interface a VC or a class within apolicy map with the command random-detect [dscp-based] Packetdrop decisions are based on IP precedence value unless the dscp-basedoption is configured To change the default profile for a specific DSCPvalue use the random-detect dscp dscp-value min-threshold max-threshold mark-probability-denominator command

Traffic Policing and ShapingTraffic policing and traffic shaping are both ways to control the amountof traffic through an interface Policing drops traffic whereas shapingbuffers it for sending later Policing can be used inbound or outboundbut shaping is used only on outbound traffic

Both mechanisms use a token bucket concept to measure the amount ofbandwidth allowed Enough tokens enter the bucket at regular intervalsto allow the interface to send the number of bytes configured for thatinterval If a packet enqueued has fewer bytes than are represented bytokens in the bucket it considered a conforming packet The packet issent and an equivalent number of tokens are subtracted from the bucketIf it has more bytes than there are tokens to send it is considered anexceeding packet The router then takes action based on whether policingor shaping is configured Some implementations use two token bucketsIf a packet exceeds the first bucket it is checked against the secondone If there are not enough tokens in the second bucket to send thepacket it is considered a violation

If all the tokens are not used within the interval they can accrue andremain available to future packets if bursting is enabled

[ 43 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Traffic PolicingBy using the QoS policing function bandwidth use can be controlledon physical interfaces Policing specifies an amount of bandwidthallowed for a particular type of traffic and generally drops traffic overthat amount It can also be configured to allow the excess traffic but itmarks it with a different (usually lower) DSCP value

Some uses for policing include

n Limiting the bandwidth of a high-speed interface to a lower rate

n Limiting the rate of an application or a traffic class

n Remarking the DSCP of traffic exceeding a specified rate

Class-based policing is configured in a policy map Its possible condi-tions are Conform Exceed and Violate Its possible actions are DropSet (DSCP for example) and Transmit

Traffic ShapingTraffic shaping also controls the amount of traffic sent out an interfacebut shaping buffers excess traffic instead of dropping it Because data isusually bursty the buffered traffic can be sent out between bursts Thusshaping smoothes out the flow of traffic This also results in fewerpacket drops and thus fewer TCP retransmits It does however intro-duce some delay for traffic that must be buffered It does not supportremarking traffic

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 44: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Some uses for shaping include

n Making the outgoing traffic rate match the contracted committedinformation rate (CIR)

n To avoid overrunning remote links in networks such as ATMFrame Relay and Metro Ethernet that might have different band-widths on hub and spoke devices

n Interacting with Frame Relay congestion notifications causing therouter to throttle-back its sending rate

Class-based traffic shaping is configured under the policy map Itworks with any type of interface not just Frame Relay interfaces

Link Efficiency MechanismsAlthough QoS mechanisms cannot actually create bandwidth they canhelp your network use the available bandwidth more efficiently Twoways of doing this are compression and fragmentation These mecha-nisms are typically applied at the WAN edge where links are slowerthan within the LAN

CompressionCompressing the traffic on a line creates more useable bandwidthbecause each frame is smaller there are fewer bits to transmit Thusthe serialization delay is reduced and more frames can be sent CiscoIOS supports two types of compression payload and header

[ 44 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Payload compression can be done at either Layer 2 or Layer 3

n Layer 2 Payload CompressionmdashThe Layer 2 payload compressioncompresses the Layer 3 and 4 headers and the packet data Layer 2payload compression is typically a hop-by-hop mechanismbecause the Layer 2 header is removed at each hop Layer 2compression done in software is CPU-intensive and might actuallyadd extra delay to the traffic flow Hardware compressionhowever adds little delay Cisco supports three Layer 2 payloadcompression algorithms

mdash Stacker

mdash Predictor

mdash Microsoft Point-to-Point Compression (MPPC)

n Layer 3 Payload CompressionmdashLayer 3 payload compressioncompresses the Layer 4 header and the packet data It is generallydone session-by-session

Header compression leaves the payload intact but compresses theheaders TCP header compression compresses the IP and TCP headersRTP header compression compresses the IP UDP and RTP headers Itis most effective when the headers are much larger than the payloadsuch as with Telnet or VoIP Headers do not change much over the lifeof a flow and contain many redundant fields (such as source and desti-nation IP address protocol and port) Compression removes the redun-dant information and sends only the new information and an indexpointing to the unchanged information

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 45: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Compression configured on a physical interface applies to all flowsFor more granular control over which traffic is compressed configure itin the MQC policy map under the desired classes Header compressionuses fairly few CPU resources

Link Fragmentation and Interleave (LFI)A typical network has a range of packet sizes Small packets can bedelayed waiting for a large packet to be sent out the interface This canhappen even if LLQ is configuredmdasha small voice packet might be sentimmediately to the hardware queue However the hardware queue isFIFO If a large packet arrived there just before the voice packet it isserialized out the interface first The voice packet has to wait Thiscauses delay and jitter

LFI breaks large packets into smaller segments and intersperses thesmaller packets between the pieces of the big ones Thus delay andjitter are reduced for the small packets

The target serialization delay for voice is 10ndash15 ms At 2 Mbps linkspeed a 1500 byte packet can be serialized in 10 ms Thus there istypically no need for LFI on links over E1 speed

QoS with VPNsA Virtual Private Network (VPN) is a way of creating a virtual point-to-point link over a shared network (often over the Internet) It can beused either for user remote access or for intrasite links Two types ofremote access VPNs are

[ 45 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Client-initiatedmdashThe user has a VPN client application such asCiscorsquos VPN Client on their computer After they are connected tothe Internet they use the application to connect them to theirnetwork

n Network Access Server (NAS) initiatedmdashUsers connect into anaccess server at their ISP The NAS then sets up a VPN to theprivate network

Two types of intrasite VPNs are

n Intranet VPNmdashLinks sites within the same company to each other

n Extranet VPNmdashLinks an external group (such as a customer orsupplier) to the companyrsquos private network

VPNs have several advantages including

n The ability to encrypt traffic across the public network and keep itconfidential

n The ability to verify that the data was not changed between thesource and destination

n The ability to authenticate the packet sender

Router-to-router VPN tunnels use a logical tunnel interface that is createdon the router This interface is where you put configuration pertaining tothe tunnel itself Tunnel traffic uses one of the routerrsquos physical interfacesdetermined by the routing table Configuration on this interface appliesto all traffic even if several tunnels use that interface

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 46: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

VPNs create an extra challenge for QoS A VPN tunnels traffic from onedevice to another by adding an IP header on top of the original one Thusthe original header with its QoS markings is hidden from routers in thepacketrsquos path If the packet needs any special QoS treatment the markingsmust be copied from the original IP header into the tunnel IP header

GRE TunnelsGeneric Routing Encapsulation (GRE) tunnels add a GRE header and atunnel IP header to the packet By default TOS markings on the origi-nal packet are copied into the tunnel IP header When the packet arrivesat the physical interface classification and queuing are based on themarkings in the tunnel IP header

IPSec TunnelsIP Security (IPSec) can operate in either tunnel mode or transportmode In tunnel mode it creates a tunnel through the underlyingnetwork In transport mode it provides security over normal physicallinks or over a tunnel created with a different protocol IPSec can alsoprovide either authentication alone using Authentication Headers (AH)or encryption and authentication using Encapsulation Security Protocol(ESP) Table 4-4 describes the differences between AH and ESP

[ 46 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

TABLE 4-4 IPSec AH and ESP

AH ESP

Protocol 51 50

Fields Added Authentication ESP Header ESP Header Trailer ESP

AuthenticationTrailer

IP Headermdash Creates new tunnel Creates new tunnel Tunnel Mode IP header IP header

IP Headermdash Uses original Uses original Transport Mode IP header IP header

TOS Bytemdash Copies original TOS Copies original TOS Transport Mode markings to new markings to new

IP header IP header

TOS Bytemdash Original TOS byte Original TOS byte Transport Mode is available is available

Payload Change None Encrypts payload

Authentication MD5 SHA MD5 SHAProtocols Supported

Encryption None DES 3DES AESProtocols Supported

MD5 = Message Digest 5

SHA = Secure Hash Algorithm

DES = Data Encryption Standard

AES = Advanced Encryption Standard

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 47: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Although both GRE and IPSec allow traffic to be classified based on itsoriginal TOS markings there are times when you might want to clas-sify based on other fields such as port number or original IP addressIn that case packets must be classified before the original IP header ishidden or encrypted To do this use the qos pre-classify commandThis command causes the router to make a copy of the original IPheader and classify the packet based on that information

Qos pre-classify can be given on a tunnel interface in a crypto map oron a virtual template interface and it works only on IP packets Use iton the tunnel interface for a GRE tunnel on the virtual interface for aL2TP tunnel and under both the crypto map and the tunnel interfacefor an IPSec tunnelmdashIF classification must be done on non-TOS fields

Enterprise-Wide QoSDeployment

SLAA company might use a Service Level Agreement (SLA) to contractwith their ISP for certain levels of service This typically provideslevels of throughput delay jitter packet loss and link availabilityalong with penalties for missing the SLA With Layer 2 links (such asframe relay) the service provider is not involved in providing QoSthrough its network With Layer 3 links (such as MPLS) the serviceprovider can contract for QoS SLAs through its network

[ 47 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Service providers use a set number of classes and your marking mustconform to their guidelines to use QoS SLAs When calculating theamount of delay (or latency) jitter and packet loss for your SLAremember to take into account your internal network performance Forexample voice is best with an end-to-end delay of 150 ms or less Ifthe latency in the LAN at each site is 25 ms then your latency SLAwith the ISP should be no more than 100 ms

Enterprise QoSEach block within an enterprise network has its own QoS needs andconsiderations In general you should

n Classify and mark traffic as close to the access edge as possibleSwitches that can accomplish this in hardware are more efficientthan routers that must do it in software

n Establish the correct trust boundaries

n Prioritize real-time traffic (such as voice and video)

n Configure the appropriate queues on outbound interfaces

At the Access switch level

n Set the trust boundary appropriately

n Classify and mark non-VoIP traffic

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 48: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

At the Distribution switch level

n Set the trust boundary appropriately

n Place VoIP traffic in interface priority queue

n Set speed and duplex

n Can use multiple queues especially on uplink ports

n Might use Layer 3 policing and marking

n Use WRED in data queues

At the WAN edge

n Determine SLA

n Might need to reclassify and remark traffic

n Use LLQ for real-time traffic

n Use WRED in data queues

n Might need to use shaping compression or LFI

Within the Service Providersrsquos network

n Have a DiffServ-compliant backbone

n Use LLQ or modified deficit round robin (MDRR)

n Plan for adequate capacity

n Use WRED in data queues

[ 48 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

The actual configuration done on WAN edge routers depends onwhether or not the router is managed by the provider If it is managedthen the provider configures output policies on the customer router anddoes not need any input policies on the provider edge router For trafficbound from the provider network to the customer network the provideredge router has the configuration to enforce SLAs

If the customer edge router is not managed then customers mustconfigure their own QoS policies The service provider likely alsoconfigures their edge router to enforce contracted SLAs on traffic fromthe customer For traffic bound from the provider network to thecustomer network the provider edge router has the configuration toenforce SLAs The customer might have other types of configurationsuch as reclassifying and remarking to fit their internal QoS policies

CoPPControl Plane Policing (CoPP) allows QoS to be applied to the routerrsquoscontrol plane to avoid overrunning the routerrsquos CPU The control planeconsists of high-level processes that run on the route processor andhandles management tasks such as traffic bound to or from the routeror switch itself

CoPP uses the MQC to control the traffic bound to and from the routeror switchrsquos control plane Two policy options are availablemdashpolice ordrop To configure CoPP take the following steps

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 49: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 4

QOS DETAILS

Step 1 Configure a class map that identifies traffic to be policed

Step 2 Configure a policy map that either polices the trafficpermitted by the class map or drops it

Step 3 Enter control plane configuration mode using the globalcontrol-plane command

Step 4 Apply the service policy to the control plane

During a DOS attack or times of heavy processor use CoPP canensure that the network device remains available and critical networktraffic can be processed

[ 49 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 50: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 5

AutoQoSChapter 3 contained an introduction to AutoQoS This chapter expandson that and offers some restrictions caveats and ways to tune it

Some benefits of AutoQoS include

n Classification of applications

n Automatic policy generation

n QoS configuration

n Monitoring and recording via SNMP and Cisco QPM

n Consistent QoS policies

AutoQoS originally supported only VoIP applications AutoQoS forVoIP is available on all Cisco routers and switches Implementing it isbasically a one-step process as shown in the example in Chapter 3(click here to review that example for router configuration)

AutoQoS for SwitchesTo configure AutoQoS on a switch use the interface command autoqos voip cisco-phone | cisco-softphone | trust Use the cisco-phonekeyword when the interface connects to a phone QoS markings aretrusted when a Cisco IP phone is detected Use the cisco-softphonekeyword when the interface connects to a computer using the CiscorsquoSoftPhone Use the trust keyword when the interface links to a trustedswitch or a router Giving this command automatically enables globalQoS support (mls qos) Use show auto qos or show mls qos interfaceinterface-id to view the AutoQoS configuration and the QoS actions

[ 50 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

AutoQos for RoutersRouters can also use AutoQoS recent IOS versions support AutoQosfor Enterprise applications AutoQoS for Enterprise is currentlysupported only on routers and is a two-step process The configurationcan be manually tuned after it is automatically generated

Step 1 Application discovery and policy generationmdashThe firststep is to enable application discovery on interfaces whereQoS is configured NBAR is typically used for this Therouter then collects application data for the desired numberof days analyzes the data and creates QoS templates Youcan review these configurations before applying them tothe interface

Use the interface command auto discovery qos [trust] toenable application discovery Without the optional trustkeyword the router uses NBAR With it the router classifiestraffic by DSCP markings Use show auto discovery qosto view the traffic discovered and the configuration that isimplemented

Step 2 Implement the AutoQoS policiesmdashApply the policiesgenerated by AutoQoS to the interface(s) Use the interfacecommand auto qos [voip [trust] fr-atm] The optional voipkeywork enables only AutoQoS for VoIP If you use thisyou can then optionally choose to trust the existing DSCPmarkings with the keyword trust or enable AutoQoS forframe-relay to ATM with the optional keyword fr-atm Useshow auto qos to view the AutoQoS configuration

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 51: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 5

AUTOQOS

AutoQoS Restrictions andCaveatsCEF must be enabled for AutoQoS to work The interface must not havean existing QoS policy configured Bandwidth should be configured oneach interface If you change the bandwidth after enabling AutoQoS therouter does not change its QoS policies to reflect the new bandwidth Itclassifies links as slow or fast with slow being 768 kbps or less An IPaddress must be configured on slow speed links prior to enabling AutoQoSbecause the router uses Multilink PPP and transfers the IP address to themultilink interface by default On access switches CDP must be enabledfor the switch to detect a Cisco IP phone

SNMP support and an SNMP server address must be configured on therouter for SNMP traps to work The SNMP string ldquoAutoQoSrdquo needs tohave write permissions

AutoQoS supports the following WAN interfaces

n Frame-relay point-to-point subinterfaces The PVC must not havea map class or virtual template already assigned to it If LFI isneeded AutoQoS configures it for G729 codec use Manualtuning is needed for G711 use

n ATM point-to-point PVCs The PVC must not have a virtualtemplate already assigned to it Configure it as VBR-NRT

n Serial interfaces using PPP or HDLC AutoQoS must be configuredon both sides of the link and both sides must use the same bandwidth

[ 51 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Tuning AutoQoSAutoQoS might need tuning for three common reasons First it canconfigure too many classes for your network needs Second it does notadapt to changing network conditions Third it just might not includethe types of policies you want

Some questions to ask as you evaluate the policies generated byAutoQoS include

n How many classes were created using class maps

n What classification criterion was used to place traffic into eachclass

n What DSCP and COS markings were configured for each trafficclass

n What types of queuing or other QoS mechanisms were imple-mented

n Was the policy applied to the interface PVC or subinterface

AutoQoS ClassesAutoQoS uses up to ten different traffic classes as shown in Table 5-1The table also shows the type of traffic included in each class alongwith its DSCP and COS markings

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 52: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 5

AUTOQOS

TABLE 5-1 AutoQoS Traffic Classes

Traffic Class Traffic Type DSCP COS

IP Routing Network control traffic CS6 6(for example routing protocols)

Interactive Voice Voice bearer traffic EF 5

Interactive Video Interactive video data AF41 4traffic (for examplevideo conferencing)

Streaming Video Streaming media traffic CS4 4

Telephony Voice signaling and CS3 3Signaling control traffic

Transactional amp Transactional database AF21 2Interactive Data applications such as SQL

Network Network management CS2 2Management traffic such as telnet

Bulk Data Email traffic general AF11 1data traffic bulk data transfers

Scavenger Traffic needing CS1 1less-than-best-effort treatment

Best Effort Default class 0 0includes all other traffic

[ 52 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Too many classes might be generated for your needs Most companiesuse between three and six classes You might want to manually consoli-date some classes with similar QoS needs after AutoQoS has finishedits configuration

AutoQoS and Changing Network ConditionsAutoQoS creates its configuration based on the traffic it discoveredduring the initial discovery phase with NBAR If conditions changeyou might need to disable it run autodiscovery again and then re-enable AutoQos

Manually Tuning AutoQoS ConfigurationsThe show auto qos command shows the class maps that AutoQoScreated along with their match criteria and any access lists it created Itshows the policy maps and the policy configured for each class Itshows where the policy was applied and any monitoring that wasimplemented This can help you determine what changes are needed tothe configuration

You can modify AutoQoS configuration in two ways

n Using Cisco QPM

n Manually with the MQC

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 53: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 5

AUTOQOS

To modify using the MQC allow the routerswitch to apply itsAutoQoS configuration Copy the relevant portions to a text editor andmake the desired changes This might include changing the classifica-tion criteria combining classes or altering the policy for a particularclass for instance Then replace the old configuration with the newone

[ 53 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 54: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 6

Wireless ScalabilityWireless LANs (WLAN) are an extension to wired networks usingwireless standards such as 80211ABG The 80211 standards takethe place of the Ethernet standard but both data-links support the sametypes of services The benefit of WLANs is that it allows users to relo-cate within the workspace closer to machinery or conference roomsfor instance

WLAN QoS80211 wireless uses carrier sense multiple accesscollision avoidance(CSMACA) meaning transmissions are pre-announced becausesystems may not be able to hear each other or recognize collisions laterCA uses a Distributed Coordination Function (DCF) to implementtimers and delays to ensure cooperation

Unfortunately DCF timers interfere with low-latency applications suchas voice and video Wi-Fi Multimedia (WMM or 80211e) is an attemptto shorten timersmdashproportional to Differentiated Services Code Point(DSCP) prioritymdashand prioritize important traffic WMM replaces DCFwith enhanced DCF (EDCF) that creates four categories (platinumgold silver and bronze) and forces longer interframe waits on lower-priority traffic

[ 54 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

LWAPCisco introduced Lightweight Access Points (LWAP) that use the conceptof ldquosplit MACrdquo which separates the real-time communication andmanagement functions An LWAP controls beaconing buffering andencryption and uses a controller for 8021x Extensible AuthenticationProtocol (EAP) key management and bridging functions

In the LWAP scenario QoS is handled at the controller QoS is markedat Layer 2 using 80211e 80211e like 8021p will not pass through arouter so it has to be converted to DSCP if used end-to-end in a largenetwork Similarly 1p and DSCP fields must be mapped back toWMM when traffic goes to the client

Controllers host profiles that describe traffic handling At the controlleran administrator can specify

n Average and burst ldquobest effortrdquo data rate

n Average and burst ldquoreal-timerdquo data rate

n Maximum RF usage (set to 100)

n Queue depth which is the number of packets that will be in thequeu if the line is busy

n WMM-to-8021p mapping

Furthermore the controller may be set up to ignore allow or require80211e

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 55: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 6

WIRELESS SCALABILITY

8021x and WLAN SecurityWLAN security is important because wireless systems are designed toallow easy access and may extend beyond the physical perimeter ofyour building Many WLAN implementations do not have encryptionor authentication Small wonder then that ldquowar drivingrdquo or the act ofrandomly wondering in search of an open AP is so easy to perform

The number-one problem is that most APs are insecure by default andfew have any security added to them When present security forWLANs is accomplished through authenticating users and encryptingtraffic Old forms of authentication and encryption have been foundvulnerable so APs must be kept current Types of wireless securityinclude

n Service Set Identifier (SSID)

n Authentication by MAC

n Static Wired Equivalent Privacy (WEP) keys

n One-way authentication

Network administrators must not only ensure their APs are secure theymust always look for rogue APs (access points put up by users toaccomplish a narrow goal without regard to corporate security)

NoteLWAPs and their controllers help with AP security and rogue AP detectionLWAPs because they are controlled from a central point are more scalablebecause administration is much easier Cisco LWAPController model also hasrogue detection baked in

[ 55 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Figure 6-1 shows a timeline of WLAN security

FIGURE 6-1 WLAN Security over Time

WLAN Security Development

WEPWeak authenticationStatic keysWeak broken encryption

WPAMutual authenticationDynamic keysBetter encryption

WPA2Mutual authenticationDynamic keysGood encryption (AES)Includes intrusion detection

80211 WEP supports open and shared key authentication Openauthentication means that no authentication is used and any user isallowed to associate with an AP Shared key authentication expects acryptographic key to be known before accessing the AP this key issubsequently used to encrypt the payload To authenticate using a sharedkey an AP sends a plain-text challenge which the PC encrypts and sendsback If it is encrypted correctly the PC is authenticated More detail isprovided in Figure 6-2 which shows the entire authentication process

Double-click to view image at full size in an external viewer

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 56: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

PCs produce probe messages to discover APs

APs respond and client selects AP

PCs requests authentication

AP confirms authentication

PC associates with AP

AP confirms association

CHAPTER 6

WIRELESS SCALABILITY

FIGURE 6-2 WLAN Authentication

[ 56 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

Key improvements in WPAWPA2 include the following

n Per-session keys allow users a different key each timethe user accesses the AP

n TKIP changes the way the key is applied to consecu-tive packets

n Encryption uses a starting number called anInitialization Vector (IV) WPA uses an IV that isharder to guess

n The cryptographic function is changed to 128-bitAES AES is a standard that is common in securityfunctions such as virtual private networks (VPN)

n 8021x for encrypted RADIUS authenticationRADIUS can be linked back to Active Directory sousers sign in with familiar usernames and passwords

8021x requires that the client and AP support EAP andthat a RADIUS server is present There are severalmethods based on EAP to accomplish authentication

n Lightweight EAP (LEAP)

n EAP Flexible Authentication via Secure Tunnel (EAP-FAST)

n EAP-Transport Layer Security (EAP-TLS)

n Protected EAP (PEAP)

Enhanced WEP was a Cisco proprietary fix to WEP that added two improvements

n 8021x for authentication

n Cisco Key Integrity Protocol (CKIP) to protect the key

WPA (Wi-Fi Protected Access) the pre-standard version of 80211i mirrored theCisco Enhanced WEP by enhancing encryption and authentication in much the sameway Encryption is improved by incorporating Temporal Key Integrity Protocol (TKIP)WPA2 (standard 80211i) added Advanced Encryption Standard (AES) encryptionAuthentication was improved to support 8021x and the Extensible AuthenticationProtocol (EAP)

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 57: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CHAPTER 6

WIRELESS SCALABILITY

Configuring WLAN Security onControllerOpen (no authentication) is typically set up on public APs On a CiscoWLAN controller go to WLANsgtEdit and then set Layer 2 Securityto None

Setting Layer 2 Security to Static WEP WPA or WPA2 allows controlof parameters for a static key If no WPA static key is entered then thecontroller will use EAP 8021x to RADIUS

Setting Layer 2 Security to 8021X supports dynamic WEP keys Keysize may be selected but remember that Windows XP supports only40-bit and 104-bit keys

If Layer 3 Security is selected then users will enter credentials on acustomizable web page which then checks an internal database or aremote RADIUS server

WLAN ManagementCisco supports two WLAN models

n Autonomous APs

mdash Users connect to APs

mdash APs are aggregated by Wireless Domain Services (WDS)

mdash WDS is controlled by a Wireless Solution Engine (WLSE)which centralizes control similar to an LW Controller

[ 57 ]

copy 2007 Cisco Systems Inc All rights reserved This publication is protected by copyright Please see page 58 for more details

CCNP ONT Quick Reference Sheets

n Lightweight APs connected to a controller

mdash Users attach to LWAPs

mdash LWAPs are controlled by controllers

mdash Controllers are managed by Wireless Control System (WCS)

The benefit of LWAPs is centralized control The problem is that lossof the controller brings the whole campus down so redundancy isrecommended The lightweight model provides displays of RF cover-age dynamic management of the radio environment detection of rogueAPs and easier roaming

WLSE brings many of the benefits of a controller to an existingautonomous deployment WLSE is offered in two versions both ofwhich also handle AAA

n Ciscoworks WLSE for large deployments

n Ciscoworks WLSE Express for less than 100 APs

WCS allows management of the entire network as a unit It runs as aservice on Linux or Windows Three feature sets are supported

n Base which detects rogue APs and tracks a device to the closest AP

n WCS with Location which adds support for RF fingerprinting andtracks a device to within 10 meters

n WCS with Location+ which adds the ability to track 1500 clientsat the same time and collects historical information

Location is important to support VoIP calls to 911

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom

Page 58: Cisco VoIP QoS Overview QoS Details AutoQoS CCNP ONT Quick Reference Sheetscfs3.tistory.com/upload_control/download.blog?fhandle... · 2015-01-22 · CCNP ONT Quick Reference Sheets

CCNP ONT Quick Reference Sheets

Brent StewartDenise DonohueCopyrightcopy 2007 Cisco Systems Inc

Published by Cisco Press

800 East 96th Street

Indianapolis IN 46240 USA

All rights reserved No part of this digital short cut may be reproduced or transmitted in any form or by anymeans electronic or mechanical including photocopying recording or by any information storage andretrieval system without written permission from the publisher except for the inclusion of brief quotationsin a review

Printed in the United States of America 1 2 3 4 5 6 7 8 9 0

First Printing October 2006

ISBN 1-58705-315-2

Warning and DisclaimerThis digital short cut is designed to provide information about networking Every effort has been made tomake this digital short cut as complete and as accurate as possible but no warranty or fitness is implied

The information is provided on an ldquoas isrdquo basis The authors Cisco Press and Cisco Systems Inc shallhave neither liability nor responsibility to any person or entity with respect to any loss or damages arisingfrom the information contained in this book or from the use of the discs or programs that may accompany it

The opinions expressed in this book belong to the authors and are not necessarily those of Cisco SystemsInc

Trademark AcknowledgmentsAll terms mentioned in this digital short cut that are known to be trademarks or service marks have beenappropriately capitalized Cisco Press or Cisco Systems Inc cannot attest to the accuracy of this informa-tion Use of a term in this digital short cut should not be regarded as affecting the validity of any trademarkor service mark

Feedback InformationAt Cisco Press our goal is to create in-depth technical books of the highest quality and value Each book iscrafted with care and precision undergoing rigorous development that involves the unique expertise ofmembers from the professional technical community

Readersrsquo feedback is a natural continuation of this process If you have any comments regarding how wecould improve the quality of this digital short cut or otherwise alter it to better suit your needs you cancontact us through e-mail at feedbackciscopresscom Please make sure to include the digital shortcut title and ISBN in your message

We greatly appreciate your assistance

Corporate and Government SalesCisco Press offers excellent discounts on this digital shortcut when ordered in quantity for bulk purchases or special sales For more information please contact US Corporate and Government Sales 1-800-382-3419 corpsalespearsontechgroupcom

For sales outside the US please contact International Sales internationalpearsonedcom