topic Re: QoS!!! in Network Security

QoS!!!

riju — Fri, 21 Feb 2020 08:00:05 GMT

Hi All

I have configured QoS for particular ports 1494 and 1604, but not sure whether the QoS is working correctly or not.

Below are the setting details.

Does the class-map match-all default override my class-map match-all metaframe?

I was confused because, in my log server, I see lot of traffic for port 1494, but the counters for access-list 111 is not showing that much.

Can some body please tell, what can be the problem?

class-map match-all metaframe

description Mataframe applications are marked

match access-group 111

class-map match-all default

description Marking all the traffic

match any

policy-map metaframe-map

class metaframe

shape peak 384000

bandwidth 384

interface Serial0/0

service-policy output metaframe-map

access-list 111 permit tcp any any eq 1494

access-list 111 permit udp any any eq 1604

test#show access-lists 111

Extended IP access list 111

permit tcp any any eq 1494 (5571 matches)

permit udp any any eq 1604 (2 matches)

test#

test#show policy-map interface serial 0/0

Serial0/0

Service-policy output: metaframe-map

Class-map: metaframe (match-all)

5312 packets, 253681 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 111

Traffic Shaping

Target Byte Sustain Excess Interval Increment Adapt

Rate Limit bits/int bits/int (ms) (bytes) Active

768000 2400 9600 9600 25 2400 -

Queue Packets Bytes Packets Bytes Shaping

Depth Delayed Delayed Active

0 5310 253585 0 0 no

Weighted Fair Queueing

Output Queue: Conversation 266

Bandwidth 384 (kbps) Max Threshold 64 (packets)

(pkts matched/bytes matched) 5312/253681

(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)

1202077 packets, 57081765 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

test#

test#show policy-map metaframe-map

Policy Map metaframe-map

Class metaframe

Traffic Shaping

Peak Rate Traffic Shaping

CIR 384000 (bps) Max. Buffers Limit 1000 (Packets)

Weighted Fair Queueing

Bandwidth 384 (kbps) Max Threshold 64 (packets)

test#

test#show class-map

Class Map match-any class-default (id 0)

Match any

Class Map match-all metaframe (id 2)

Description: Mataframe applications are marked

Match access-group 111

Class Map match-all default (id 3)

Description: Marking all the traffic

Match any

test#

-Rcp

Re: QoS!!!

mariowa — Wed, 09 Mar 2005 10:26:41 GMT

the command match all is to match both arguments in the access list. however if you use match any, the match argument matches each one.

also you can use NBAR to recognise ICA auto depending on router and IOS.

it should look like this

class-map match-any metaframe

match protocol citrix

policy-map metaframe-map

class metaframe

shape peak 384000

bandwidth 384

good luck

Re: QoS!!!

riju — Wed, 09 Mar 2005 10:53:44 GMT

Thakyou very much.

My IOS version is not supporting the protocol citirix. So I used the access-list.

Do I need to use the below command apart from my metaframe:

class-map match-all default

description Marking all the traffic

match any

-Rcp

Re: QoS!!!

mariowa — Wed, 09 Mar 2005 11:16:25 GMT

Hi,

No, all other traffic will fall into default

Mario

Re: QoS!!!

riju — Wed, 09 Mar 2005 11:28:07 GMT

Hi,

Thankyou verymuch.

Is it possible to use the priority-list with class-map/policy-map like:

priority-list 1 protocol ip high list 111

priority-list 2 default medium

-Rcp

Re: QoS!!!

mariowa — Wed, 09 Mar 2005 11:34:59 GMT

Hi,

It is beter to use CBWFQ insted of PQ - you can use PQ but you can not monitor it by SNMP

regards

Mario

Re: QoS!!!

riju — Thu, 10 Mar 2005 01:51:21 GMT

Thank you very much.

After changing the config, I monitored the citirix packets in log server and in my router access-list count. It seems that the count of packets are not matching.

Whether the access-list count shows only first packet count from an IP address which got matched with access-list and rest all the packets with same IP address and with match with access-list will not be shown in the counter?

version 12.2

class-map match-any metaframe

description Mataframe applications are marked

match access-group 111

policy-map metaframe-map

class metaframe

shape peak 384000

bandwidth 384

interface Serial0/0

service-policy output metaframe-map

test#show policy-map

Policy Map metaframe-map

Class metaframe

Traffic Shaping

Peak Rate Traffic Shaping

CIR 384000 (bps) Max. Buffers Limit 1000 (Packets)

Weighted Fair Queueing

Bandwidth 384 (kbps) Max Threshold 64 (packets)

test#

test#show class-map

Class Map match-any class-default (id 0)

Match any

Class Map match-any metaframe (id 2)

Description: Mataframe applications are marked

Match access-group 111

test#

test#show access-list 111

Extended IP access list 111

permit tcp any any eq 1494 (30 matches)

permit udp any any eq 1604

test#

test#show policy-map interface serial 0/0

Serial0/0

Service-policy output: metaframe-map

Class-map: metaframe (match-any)

5387 packets, 257287 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 111

30 packets, 1430 bytes

5 minute rate 0 bps

Traffic Shaping

Target Byte Sustain Excess Interval Increment Adapt

Rate Limit bits/int bits/int (ms) (bytes) Active

768000 2400 9600 9600 25 2400 -

Queue Packets Bytes Packets Bytes Shaping

Depth Delayed Delayed Active

0 5385 257191 0 0 no

Weighted Fair Queueing

Output Queue: Conversation 266

Bandwidth 384 (kbps) Max Threshold 64 (packets)

(pkts matched/bytes matched) 5387/257287

(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)

1215401 packets, 58022614 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

test#

-Rcp

Re: QoS!!!

lnguye — Tue, 15 Mar 2005 14:00:10 GMT

Let me guess, your router is a Cat6500 (perhaps running hybrid mode, not native mode). With Cat6500, the first packet is processed by the MSFC and the ACL counter is incremented. Subsequence packets of the flow is processed by the PFC and ACL counter will not be incremented. The counters of policy-map is corrected because the CBWFQ is processed by the MSFC, not PFC.

Re: QoS!!!

riju — Wed, 16 Mar 2005 07:24:12 GMT

Hi,

Thankyou very much for replying.

My router is cisco 1751 with IOS version 12.2(4)T3.

How can I know, whether the QoS is taking place or not?

Some more information:

test#show queueing

Current fair queue configuration:

Interface Discard Dynamic Reserved Link Priority

threshold queues queues queues queues

Serial0/0 64 256 64 8 1

Current DLCI priority queue configuration:

Current priority queue configuration:

Current custom queue configuration:

Current random-detect configuration:

Current per-SID queue configuration:

test#

test#show queueing interface serial 0/0

Interface Serial0/0 queueing strategy: fair

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 8601

Queueing strategy: weighted fair

Output queue: 0/1000/64/8601 (size/max total/threshold/drops)

Conversations 0/33/256 (active/max active/max total)

Reserved Conversations 1/2 (allocated/max allocated)

Available Bandwidth 774 kilobits/sec

test#

test#show queue serial 0/0

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 8601

Queueing strategy: weighted fair

Output queue: 0/1000/64/8601 (size/max total/threshold/drops)

Conversations 0/33/256 (active/max active/max total)

Reserved Conversations 1/2 (allocated/max allocated)

Available Bandwidth 774 kilobits/sec

test#

Re: QoS!!!

lnguye — Wed, 16 Mar 2005 13:35:00 GMT

When you see the counters from 'sh policy' increasing, the QoS is working. Keep in mind, your configuration reserves the bandwidth for the application but does not tell it to put this apps in front of other traffics. To get priority treatment for this apps, replace the word "bandwidth" with "priority". That means the meta packets will always be processed first. However, under congestion, this app cannot used more than its share of bandwidth. When not congested, this app can use more bandwidth. I see you have traffic shaping, if you have frame relay connection, the FR cloud can delay your packet based on the cloud's condition at the moment.

As for the counter of ACL not incrementing correctly, I would assume it is the "feature of the day" that you ran into, the fix is usually "upgrade the IOS to higher version".

Re: QoS!!!

riju — Thu, 17 Mar 2005 08:18:47 GMT

My IOS priority feature is below:

test(config-pmap-c)#?

QoS policy-map class configuration commands:

bandwidth Bandwidth

exit Exit from QoS class action configuration mode

no Negate or set default values of a command

priority Strict Scheduling Priority for this Class

queue-limit Queue Max Threshold for Tail Drop

random-detect Enable Random Early Detection as drop policy

service-policy Configure QoS Service Policy

shape Traffic Shaping

yem(config-pmap-c)#priority ?

<8-2000000> Kilo Bits per second

percent % of total bandwidth

test(config-pmap-c)#priority

This dosent allow to set the priority as high for meta application.

My network is FR. We have not configured traffic shaping in FR interface(serial).

Shape peak of 384000 is for metaframe class.

Is it possible to configure both priority and bandwidth for perticular class?

Re: QoS!!!

lnguye — Thu, 17 Mar 2005 13:14:31 GMT

You can configure priority only for 1 class, and upto 63 bandwidth reservation for other classes. You cannot both config both priority and bw for the same class but setting priority has the same characteristic effect. For sample config, search for MQC on CCO.

Re: QoS!!!

barisal — Tue, 29 Mar 2005 13:08:55 GMT

Hi!

Priority is not recommended to be used rather than RTP packets, so keep it in your mind. RTP uses UDP between 16383-32767 and some TCP ports. So, in your application it is not something that is acceptable. To prioritise your preferred traffic, CBWFQ as you configure is to be, should be enough...

Baris.

Re: QoS!!!

lnguye — Tue, 29 Mar 2005 13:56:38 GMT

LLQ is different than RTP priority. RTP priority is only for UDP traffic in the specified port range. LLQ can be used for any traffic type you want. CBWFQ (same as LLQ but lacks one priority class) does not actually give prioritization. It reserves the bandwidth for each different traffic classes. The implementation depends on what you want.

Re: QoS!!!

barisal — Tue, 29 Mar 2005 14:44:15 GMT

I agree with you, RTP priority priotises only the traffic between 16383-32767 UDP ports, let me better classify only the even numbered ports. As you have said that LLQ actually understands every port, it can be used for any type of traffic. As i have wanted to point out that LLQ's prioritisation is not RECOMMENDED to be used for other traffic rather than voice, video such real-time applications that do not bear with any delay on the link. The implementation depends on how you want to manage the traffic flowing through the link.

Regards,

Re: QoS!!!

lnguye — Tue, 29 Mar 2005 16:02:13 GMT

Now, I understand your point. Very true. I have been under the assumption that Riju's network is not using voice/video on IP. That's why I gave the option of prioritizing the metaframe packets. There is only 1 priority class in the network. If there are V/VoIP, noone should mix data traffic with voice in the priority queue.