Qos on GRE Tunnel interfaces

[ayokunles]

I have a challenge. i want to implement QoS on our Core router but the core router makes use of GRE Tunnels to remote branch locations.

so far all QoS techniques i want to use cannot be implemented using tunnel interfaces.

the core router is a cisco 7604 router with IOS version 12.2 (33)SRE while the remote locations have ISRs (2821).

i would need help in deciding which QoS technique to use with respect to GRE Tunnels as there are times of congestion due to heavy network traffic to those remote locations.

thanks guys.

[lgijssel]

What you want to achieve is possible.

When packets are encapsulated by tunnel or encryption headers, QoS features are unable to examine the original packet headers and correctly classify the packets. Packets traveling across the same tunnel have the same tunnel headers, so the packets are treated identically if the physical interface is congested. With the introduction of the Quality of Service for Virtual Private Networks (VPNs) feature, packets can now be classified before tunneling and encryption occur.

The qos pre-classify command is used for enabling this.

http://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a008017405e.shtml#topic1

regards,

Leo

[ayokunles]

Hii Leo,

thanks, but the other question is would it work on a cisco 7604 router with the IOS mentioned in the first post?

[Amit Aneja]

It should work on the IOS that you have mentioned.

[ayokunles]

Hello Amit,

thanks but the command is not supported on my IOS.  i mean the qos pre-classify command.

any other ideas? i am really stuck.

[Amit Aneja]

Could you paste the complete IOS image name here?

What is the interface you are trying to enable "qos pre-classify"?

[Amit Aneja]

hey, I apologize, I just checked that it is not supported on 6k. It is hard to believe, but, it isn't.

Let me check if this is on the roadmap in upcoming releases.

[Amit Aneja]

qos pre-classify relies on keeping a copy of the original packet in some shared memory. 6500 is a

distributed architecture, there is not really shared memory at all, so this is something which is a hardware limitation.

The feature is *not* on the roadmap as well.

Regards,

Amit

[ayokunles]

so am stuck then...

what if i try to use hierachical policy maps

would it work.

[Joseph W. Doherty]

Disclaimer

The  Author of this posting offers the information  contained within this  posting without consideration and with the  reader's understanding that  there's no implied or expressed suitability  or fitness for any purpose.  Information provided is for informational  purposes only and should not  be construed as rendering professional  advice of any kind. Usage of  this posting's information is solely at  reader's own risk.

Liability Disclaimer

In   no event shall Author be liable for any damages whatsoever (including,   without limitation, damages for loss of use, data or profit) arising  out  of the use or inability to use the posting's information even if  Author  has been advised of the possibility of such damage.

Posting

Assuming it's impossible to configure QoS on a "normal" 7600 GRE tunnel, it might be possible if you use a "WAN" type line card (assuming you're not now).  Another option would be to "front" the core 7604 with "regular" (e.g. 3900, 7200) WAN router that can deal with the bandwidth you're using.

[ayokunles]

Hi Joseph,

I am not sure i understand the word "front".  All Service provider backhauls terminate on this core router.

Would "fronting" mean that i have to transfer all the connections to the the "new front" and reconfigure all the GRE tunnels.

I am also not sure if i am using a WAN type line card.

[Joseph W. Doherty]

Disclaimer

The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.

Liability Disclaimer

In  no event shall Author be liable for any damages whatsoever (including,  without limitation, damages for loss of use, data or profit) arising out  of the use or inability to use the posting's information even if Author  has been advised of the possibility of such damage.

Posting

"Front" as having another software router "in front" of the core device, i.e. it would terminate the WAN connections and yes it would then have the GRE tunnels.  (In other words, a WAN edge.)

WAN type cards are those line cards with enhanced QoS features useful on WANs, for example FlexWAN or SIP-200 and SIP-400.  Some of the "ES" cards might too, but not sure about those.

Amit might also have a worthwhile suggestion about the VSPA.

[ayokunles]

Hi Joseph,

please find attached a section of the sh version on the router.  I believe the SIP card is present.

besides the 7604 serves as the WAN edge already.

[Joseph W. Doherty]

Disclaimer

The   Author of this posting offers the information contained within this   posting without consideration and with the reader's understanding that   there's no implied or expressed suitability or fitness for any purpose.   Information provided is for informational purposes only and should not   be construed as rendering professional advice of any kind. Usage of  this  posting's information is solely at reader's own risk.

Liability Disclaimer

In   no event shall Author be liable for any damages whatsoever (including,   without limitation, damages for loss of use, data or profit) arising  out  of the use or inability to use the posting's information even if  Author  has been advised of the possibility of such damage.

Posting

Does the WAN interface use a SPA interface on the SIP-400 for the GRE tunnel source?  (Looks like it's hosting a single 10 gig.  What's the SPA interface?)

(NB: I know the FlexWAN offers additional QoS features.  I believe the SIP-200 is similar.  I also thought the SIP-400 does too, but not as sure about it.  Such features are limited to interfaces on that card.)

Understood that the 7604 serves as your WAN edge, but if it doesn't offer the features you need for your WAN, then the only alternative to obtain those features is to use a platform that does support your needs.

[ayokunles]

Joseph,

there are two 5 port modules and each port is Gigabit SPA. 

yes all service providers are terminated on SPA interfaces.

what i'm not sure of is whether i have a VPN SPA module or would the SSC 400 serve as a VPN SPA module.

I'm not quite sure, really.

thanks