QoS Configuration. Overview. Introduction to QoS. QoS Policy. Class. Traffic behavior

Transcription

1 Table of Contents QoS Configuration 1 Overview 1 Introduction to QoS 1 QoS Policy 1 Traffic Policing 2 Congestion Management 3 Line Rate 9 Configuring a QoS Policy 9 Configuration Task List 9 Configuring a Class 11 Configuring a Traffic Behavior 14 Configuring a Policy 18 Applying the Policy to an Interface 20 QoS Configuration Examples 21 CAR Configuration Example 21 Priority Marking Configuration Example 27 CBQ Configuration Example 34 Packet Filtering Configuration Example 41 Configuration Guidelines 46 i

2 QoS Configuration Overview Introduction to QoS In data communications, Quality of Service (QoS) is the ability of a network to provide differentiated service guarantees for diversified traffic regarding bandwidth, delay, jitter, and drop rate. The network resources are always scarce. Wherever there is contention for resources, there is the demand for QoS to prioritize important traffic flows over trivial traffic flows. When making a QoS scheme, a network administrator must plan network resources carefully considering the characteristics of various applications to balance the interests of diversified users and fully utilize network resources. The following part introduces the QoS service models, and some mature QoS techniques in wide use. Appropriately using these techniques in specific environments, you can improve QoS effectively. QoS Policy Class Traffic behavior In the web interface, you can implement QoS by applying QoS policies to interfaces. With QoS policies, you can configure QoS flexibly. Before configuring a QoS policy, be familiar with these concepts: class, traffic behavior, and policy. Classes are used to classify traffic. A class is identified by a class name and contains match criteria for traffic identification. The relationship between the criteria is AND or OR. AND: A packet is considered belonging to a class only when the packet matches all the criteria in the class. OR: A packet is considered belonging to a class if it matches any of the criteria in the class. A match criterion in a class can be any of the following: Access control list (ACL) Protocol group Source MAC address Destination MAC address Customer network 802.1p priority A traffic behavior defines a set of QoS actions to take on packets. You can configure the following actions in a traffic behavior: Traffic policing: Regulates the specifications of matched traffic. For more information, see Traffic Policing. 1

3 Policy Priority marking: Modifies the priority parameters (including IP precedence, DSCP, local precedence, and 802.1p priority) of the matched traffic. Queuing (for congestion management): Schedules the matched traffic in order to avoid congestion. For more information, see Congestion Management. Packet filtering: Filters matched traffic. For example, you can configure a packet filter to permit or deny traffic from a suspicious source IP address. A policy associates a class with a traffic behavior to define what actions to take on which class of traffic. You can configure multiple class-behavior associations in a policy. Traffic Policing Without limits on user traffic, a network can be overwhelmed very easily. To help assign network resources such as bandwidth efficiently to improve network performance and hence user satisfaction, network traffic must be controlled. Traffic policing is a traffic control policy that limits the traffic rate and resource usage according to traffic specifications. Traffic evaluation and token buckets Traffic policing To perform traffic policing, a device must evaluate traffic to determine whether it has exceeded the specifications. This is typically done with token buckets. A token bucket is analogous to a container holding a certain number of tokens. The system puts tokens into the bucket at a set rate. When the token bucket is full, the extra tokens overflows. The evaluation of traffic specifications is based on whether the number of tokens in the bucket can meet the need of packet forwarding. Generally, one token is associated with a 1-bit forwarding authority. If the number of tokens in the bucket is enough for forwarding the packets, the traffic conforms to the specification and is called conforming traffic; otherwise, the traffic does not conform to the specification and is called excess traffic. A token bucket has the following configurable parameters: Mean rate at which tokens are put into the bucket, namely, the permitted average rate of traffic. It is usually set to the committed information rate (CIR). Burst size or the capacity of the token bucket. It is the maximum traffic size that is permitted in each burst. It is usually set to the committed burst size (CBS). The set burst size must be greater than the maximum packet size. Evaluation is performed for each arriving packet. In each evaluation, if the number of tokens in the bucket is enough, the traffic conforms to the specification and the tokens for forwarding the packet are taken away; if the number of tokens in the bucket is not enough, the traffic is excessive. Traffic policing regulates particular flows entering or leaving a device according to configured specifications. When a flow exceeds the specification, some restriction or punishment measures can be taken to prevent overconsumption of network resources and protect the network resources. For example, you can limit the bandwidth for HTTP packets to less than 50% of the total and drop the HTTP packets exceeding the threshold. 2

4 NOTE: Traffic policing supports policing traffic in both inbound and outbound directions. Thereafter, the outbound direction is taken for example. Figure 1 Schematic diagram for traffic policing Packets to be sent through this interface Tokens are put into the bucket at the set rate Packets sent Packet classification Token bucket Queue Packets dropped Traffic policing is widely used in policing traffic entering the networks of internet service providers (ISPs). It can classify the policed traffic and perform pre-defined policing actions specific to evaluation results. These actions include: Forwarding the packets if the evaluation result is conforming. Dropping the packets if the evaluation result is excess. NOTE: Traffic policing can be configured in the policy-based approach or CAR list-based approach. This chapter introduces only how to configure traffic policing in the policy-based approach. For how to configure traffic policing in the CAR list-based approach, see Traffic Policing Configuration. Congestion Management Causes, impacts, and countermeasures of congestion Congestion occurs on a link or node when traffic size is so large that the processing capability of the link or node is exceeded. It is typical of a statistical multiplexing network and can be caused by link failure, insufficient resources, and various other causes. The following figure shows two common congestion scenarios: 3

5 Figure 2 Typical traffic congestion scenarios 100M 100M 10M 10M 100M 100M>10M 50M (100M+10M+50M)>100M (1) (2) Congestion may bring these negative results: Increased delay and jitter during packet transmission Decreased network throughput and resource use efficiency Network resource (memory in particular) exhaustion and even system breakdown Congestion is unavoidable in switched networks or multi-user application environments. To improve the service performance of your network, you must take measures to manage and control it. One major issue that congestion management deals with is how to define a resource dispatching policy to prioritize packets for forwarding when congestion occurs. Congestion management policies FIFO Queuing is a common technology used for congestion management. It classifies traffic into queues and picks out packets from each queue following a certain algorithm. There are various queuing algorithms, each addressing a particular network traffic problem. Your choice of algorithm affects bandwidth assignment, delay, and jitter significantly. Congestion management involves queue creating, traffic classification, packet enqueuing, and queue scheduling. Queue scheduling treats packets with different priorities differently to transmit high-priority packets preferentially. Several common queue-scheduling mechanisms are introduced here. Figure 3 FIFO queuing Packets to be sent through this interface Packets sent Queue Interface Sending queue As shown in Figure 3, First In First Out (FIFO) uses a single queue and thus does not classify traffic or schedule queues. FIFO delivers packets depending on their arrival order, with the one arriving earlier scheduled first. The only concern of FIFO is queue length, which affects delay and packet loss rate. On 4

6 a device, resources are assigned for packets depending on their arrival order and load status of the device. The best-effort service model uses FIFO queuing. FIFO does not address congestion problems. If there is only one FIFO output/input queue on a port, you can hardly ensure timely delivery of mission-critical or delay-sensitive traffic or smooth traffic jitter. The situation gets worsened if malicious traffic is present to occupy bandwidth aggressively. To control congestion and prioritize forwarding of critical traffic, you need to use other queue scheduling mechanisms, where multiple queues can be configured. Within each queue, however, FIFO is still used. By default, FIFO queuing is used on interfaces. Weighted fair queuing Figure 4 Weighted fair queuing (WFQ) Before WFQ is introduced, you need to understand fair queuing (FQ). FQ is designed for fairly allocating network resources to reduce delay and jitter of each traffic flow as possible. In an attempt to balance the interests of all parties, FQ follows these principles: Different queues have fair dispatching opportunities for delay balancing among streams. Short packets and long packets are fairly scheduled: if there are long packets and short packets in queues, statistically the short packets are scheduled preferentially to reduce the jitter between packets on the whole. Compared with FQ, WFQ takes weights into account when determining the queue scheduling order. Statistically, WFQ gives high priority traffic more scheduling opportunities than low priority traffic. WFQ can automatically classify traffic according to the session information of traffic (protocol type, TCP or UDP source/destination port numbers, source/destination IP addresses, IP precedence bits in the ToS field, and so on), and try to provide as many queues as possible so that each traffic flow can be put into these queues to balance the delay of every traffic flow on a whole. When dequeuing packets, WFQ assigns the outgoing interface bandwidth to each traffic flow by precedence. The higher precedence value a traffic flow has, the more bandwidth it gets. For example, assume that there are five flows in the current interface with precedence 0, 1, 2, 3, and 4 respectively. The total bandwidth quota is the sum of all the (precedence value + 1)s, that is, = 15. The bandwidth percentage assigned to each flow is (precedence value of the flow + 1)/total bandwidth quota. The bandwidth percentages for flows are 1/15, 2/15, 3/15, 4/15, and 5/15 respectively. 5

7 Because WFQ can balance the delay and jitter of each flow when congestion occurs, it is suitable for handling some special occasions. For example, WFQ is used in the assured forwarding (AF) services of the Resource Reservation Protocol (RSVP). In Generic Traffic Shaping (GTS), WFQ is used to schedule buffered packets. CBQ Class-based queuing (CBQ) extends WFQ by supporting user-defined classes. CBQ assigns an independent reserved FIFO queue for each user-defined class to buffer data of the class. When network congestion occurs, CBQ enqueues packets by user-defined traffic classification rules. Before that, congestion avoidance actions such as tail drop or weighted random early detection (WRED) and bandwidth restriction check are performed. When being dequeued, packets are scheduled by WFQ. CBQ provides an emergency queue to enqueue emergent packets. The emergency queue is a FIFO queue without bandwidth restriction. However, realtime packets (such as voice and video packets, which are delay-sensitive) may not be transmitted timely in CBQ since packets are fairly treated. To solve this issue, Low Latency Queuing (LLQ) was introduced to transmit realtime packets preferentially. When defining traffic classes for LLQ, you can configure a class of packets to be transmitted preferentially. Such a class is called a priority class. The packets of all priority classes are assigned to the same priority queue. Bandwidth restriction on each class of packets is checked before the packets are enqueued. During the dequeuing operation, packets in the priority queue are transmitted first. WFQ is used to dequeue packets in the other queues. In order to reduce the delay of the other queues except the priority queue, LLQ assigns the maximum available bandwidth for each priority class. The bandwidth value is used to police traffic during congestion. When no congestion is present, a priority class can use more than the bandwidth assigned to it. During congestion, the packets of each priority class exceeding the assigned bandwidth are discarded. LLQ can also specify burst-size. The system matches packets with classification rules in the following order: Match packets with priority classes and then the other classes. Match packets with priority classes in the configuration order. Match packets with other classes in the configuration order. Match packets with classification rules in a class in the configuration order. Congestion management technology comparison The following table compares these queuing technologies for efficient use. 6

8 Table 1 Congestion management technology comparison Type Number of queues Advantages Disadvantages FIFO 1 No need to configure, easy to use Easy to operate, low delay All packets are treated equally. The available bandwidth, delay and drop probability are determined by the arrival order of packets. No restriction on the incooperative data sources (that is, flows without any flow control mechanism, UDP for example), resulting in bandwidth loss of cooperative data sources such as TCP. No delay guarantee for time-sensitive real-time applications, such as VoIP 7

9 Type Number of queues Advantages Disadvantages Flexible traffic classification based on various rules and differentiated queue scheduling mechanisms for expedited forwarding (EF), assured forwarding (AF) and best-effort (BE) services. CBQ Configura ble (0 to 64) Highly precise bandwidth guarantee and queue scheduling on the basis of AF service weights for various AF services Absolutely preferential queue scheduling for the EF service to meet the delay requirement of real-time data; overcoming the disadvantage of PQ that some low-priority queues are not serviced by restricting the high-priority traffic. The system overheads are large. WFQ scheduling for best-effort traffic (the default class). 8

10 Line Rate Line rate also uses token buckets to evaluate traffic specifications for traffic control. The line rate of a physical interface specifies the maximum rate for forwarding packets (including critical packets). Compared with traffic policing, line rate can only limit traffic rate on a physical interface. To limit the rate of all the packets on an interface as a whole, using line rate is easier. NOTE: For more information about token buckets, see Traffic evaluation and token buckets. With line rate configured on an interface, all packets to be sent through the interface are firstly handled by the token bucket at line rate. If there are enough tokens in the token bucket, packets can be forwarded; otherwise, packets are put into QoS queues for congestion management. In this way, the traffic passing the physical interface is controlled. Figure 5 Line rate implementation In the token bucket approach to traffic control, bursty traffic can be transmitted so long as enough tokens are available in the token bucket; if tokens are inadequate, packets cannot be transmitted until the required number of tokens are generated in the token bucket. Thus, traffic rate is restricted to the rate for generating tokens, thus limiting traffic rate and allowing bursty traffic. Configuring a QoS Policy Configuration Task List Perform the tasks in Table 2 to configure a QoS policy: 9

11 Table 2 QoS policy configuration task list Task Remarks Configuring a Class Optional This task creates a class and configures classification rules for the class. The system-defined classes include default-class, ef, af1, af2, af3, af4, ip-prec0, ip-prec1, ip-prec2, ip-prec3, ip-prec4, ip-prec5, ip-prec6, ip-prec7, mpls-exp0, mpls-exp1, mpls-exp2, mpls-exp3, mpls-exp4, mpls-exp5, mpls-exp6, and mpls-exp7. A system-defined class cannot be modified or deleted. Configuring a Traffic Behavior Optional This task creates a traffic behavior and configures actions for the traffic behavior. By default, the system-defined traffic behaviors include ef, af, be, be-flow-based, and so on. A system-defined traffic behavior cannot be modified or deleted. Configuring a Policy Optional This task creates a QoS policy and configures class-behavior associations for the QoS policy. By default, the system-defined policy is policy default. The system-defined policy cannot be modified or deleted. IMPORTANT: A class can be associated with only one traffic behavior in a QoS policy. If a class is associated with multiple traffic behaviors, the last associated one takes effect. Applying the Policy to an Interface Required Apply the QoS policy to the specified interface. 10

12 Configuring a Class Creating a class To configure a class, create it first, and then configure classification rules for it. Select Firewall > QoS > Classifier from the navigation tree to enter the classifier displaying page, as shown in Figure 6. Then click Add to enter the page for creating a class, as shown in Figure 7. Figure 6 Classes Figure 7 Create a class Table 3 describes the configuration items of creating a class. 11

13 Table 3 Configuration items of creating a class Item Classifier Name Operation Type Description Specify a name for the classifier to be created. Ensure that the name is different from those of the system-defined classifiers, if any. Specify the logical relationship between rules in the classifier. Two options are available: And: Specifies the relationship between the rules in a class as logical AND. That is, the device considers a packet as belonging to a class only when the packet matches all the rules in the class. Or: Specifies the relationship between the rules in a class as logical OR. That is, the device considers a packet as belonging to a class as long as the packet matches one of the rules in the class. Configuring classification rules Click the icon in the Operation column for the class to be configured in the class list to enter the page as shown in Figure 8. On the upper part of the page, you can modify the basic information of the class; on the lower part of the page, information about all rules of the class is displayed. Click Create to enter the page for creating a classification rule for the class, as shown in Figure 9. Figure 8 Classification rule configuration page 12

14 Figure 9 Create a classification rule for a class Table 4 describes the configuration items of configuring a classification rule. Table 4 Configuration items of configuring a classification rule Item Classifier Name ACL Description Displays the name of the class you are configuring. Define an ACL-based match criterion, and specify the ACL by number. You can select or input an ACL number. The available ACLs are those configured in Firewall > ACL. For how to configure an ACL, see ACL Configuration. IMPORTANT: If the specified ACL does not exist, the match criterion can be configured successfully, but does not take effect. Protocol group Define a criterion to match a protocol group, and specify the protocol group ID. The available protocol groups are those configured in Identification > P2P Identify > Protocol Group. For how to configure a protocol group, see P2P Traffic Control Configuration. IMPORTANT: If the specified protocol group ID does not exist, the match criterion can be configured successfully, but does not take effect. Source MAC Address Define a criterion to match the specified source MAC address. IMPORTANT: A criterion to match a source MAC address is applicable only to Ethernet interfaces. 13

15 Item Destination MAC Address Customer 802.1p Description Define a criterion to match the specified destination MAC address. IMPORTANT: A criterion to match a destination MAC address is applicable only to Ethernet interfaces. Define a criterion to match the specified customer 802.1p priority value or values You can input up to eight 802.1p priority values, and the logical relationship between different 802.1p priority values is OR. Return to QoS policy configuration task list. Configuring a Traffic Behavior To configure a traffic behavior, create it first and then configure actions for it. Creating a traffic behavior Select Firewall > QoS > Behavior from the navigation tree to enter the behavior displaying page, as shown in Figure 10. Click Add to enter the page for creating a behavior, as shown in Figure

16 Figure 10 Behavior configuration page Figure 11 Create a behavior Table 5 describes the configuration items of creating a behavior. 15

17 Table 5 Configuration items of creating a behavior Item Behavior Name Description Specify a name for the behavior to be created. Ensure that the name is different from those of the system-defined traffic behaviors, if any. Configuring actions for the traffic behavior Click the icon in the Operation column for the traffic behavior in the traffic behavior list to enter the page for configuring actions for the traffic behavior, as shown in Figure 12. Figure 12 Configure actions for a traffic behavior Table 6 describes the configuration items of configuring actions for a traffic behavior. Table 6 Configuration items of configuring actions for a traffic behavior Item Behavior Name Description Name of the traffic behavior being configured 16

18 Item Description CAR Configure CAR for data packets Enable/Disable Enable or disable CAR. CAR CIR CBS Set the committed information rate (CIR), the average traffic rate. Set the committed burst size (CBS), number of bits that can be sent in each interval. IMPORTANT: For bursty traffic to be handled effectively, ensure that the ratio of CBS to CIR is at least 100:16. Discard Green Pass Pass (Remark DSCP) Set the action to perform for conforming packets (that is, green packets), which can be: Discard: Drops the packets. Pass: Permits the packets to pass through. Pass (Remark DSCP): Sets a specific DSCP value for the packets and permits the packets to pass through. With this option selected, you must select a DSCP value. By default, conforming packets are permitted to pass through. Remark Queue IP Precedence DSCP Local Precedence Dot1p Queue EF Max Bandwidth Set to mark matching packets with the selected IP precedence. Selecting Not Set disables the IP precedence marking action. Set to mark matching packets with the selected DSCP precedence. Selecting Not Set disables the DSCP marking action. Set to mark matching packets with the selected local precedence. Selecting Not Set disables local precedence marking. Set to mark matching packets with the selected 802.1p priority. Selecting Not Set disables 802.1p priority marking. Configure CBQ for packets If this option is not selected, FIFO is used to schedule packets by default. Configure expedited forwarding (EF). Configure the maximum bandwidth for EF. EF CBS Percent CBS-Ratio Configure the CBS for EF when the Max Bandwidth option is selected. Configure the percent of available bandwidth for EF. Configure the ratio of CBS to CIR for EF when the Percent option is selected. 17

19 Item Description AF WFQ AF Max Bandwidth Percent Configure assured forwarding (AF). Configure the minimum guaranteed bandwidth for AF. Configure the percent of available bandwidth for AF. Configure WFQ by inputting the total number of fair queues, which must equal two to the power of an integer. A traffic behavior configured with WFQ can only be associated a system-defined class. Filter Configure the packet filtering action for data packets, which can be: Permit: Forwards the packet. Deny: Drops the packet. Not Set: Cancels the packet filtering action. Return to QoS policy configuration task list. Configuring a Policy Creating a policy To configure a policy, create it first and then configure class-behavior associations for it. Select Firewall > QoS > Policy from the navigation tree to enter the policy displaying page, as shown in Figure 13. Click Add to enter the page for creating a policy, as shown in Figure 14. Figure 13 Policy configuration page 18

20 Figure 14 Create a QoS policy Table 7 describes the configuration items of creating a policy. Table 7 Configuration items of creating a policy Item Policy Name Description Specify a name for the policy to be created. Ensure that the name is different from those of the system-defined policies, if any. Associating the classifier and the behavior in the policy Select the policy to be configured, and click Add Relation to enter the page for associating a classifier with a traffic behavior you created in the policy, as shown in Figure 15. Figure 15 Associate a classifier with a behavior Table 8 describes the configuration items of configuring a classifier-behavior association in the policy. Table 8 Configuration items of configuring a classifier-behavior association in the policy Item Policy Name Classifier Name Behavior Name Description Name of the policy being configured Associate an existing class with an existing behavior Return to QoS policy configuration task list. 19

21 Applying the Policy to an Interface Select Firewall > QoS > Apply from the navigation tree to enter the page for displaying policies applied to interfaces, as shown in Figure 16. Click Apply Policy to enter the page for applying a QoS policy to an interface, as shown in Figure 17. Figure 16 QoS policies applied to interfaces Figure 17 Apply a QoS policy to an interface Table 9 describes the configuration items of applying a policy to an interface. Table 9 Configuration items of applying a policy to an interface Item Interface Name Policy Name Direction Description Specify the interface to which the policy is to be applied. Select the QoS policy to be applied. Specify the direction in which the policy is to be applied. Inbound: Applies the policy to the incoming packets on the specified interface. Outbound: Applies the policy to the outgoing packets on the specified interface. Return to QoS policy configuration task list. 20

22 QoS Configuration Examples CAR Configuration Example Network requirements As shown in Figure 18, Server and Host can access the Internet through Device. Perform traffic control on GigabitEthernet 1/0/1 of Device for traffic received from Server and Host respectively, as follows: Limit the rate of traffic from Server to 54 kbps to transmit the conforming traffic but drop the exceeding traffic. Limit the rate of traffic from Host to 8 kbps to transmit the conforming traffic but dropping the exceeding traffic. Figure 18 Network diagram for CAR configuration Configuration procedure Step1 Configure ACLs # Configure ACL 2000 to match traffic from Server. Select Firewall > ACL from the navigation tree, and click Add. Perform configuration on the page shown in Figure 19. Figure 19 Create ACL 2000 Type 2000 as the ACL number. Click the icon corresponding to ACL 2000 on the ACL list, and click Add. Perform configuration on the page shown in Figure

23 Figure 20 Configure rules for ACL 2000 Select Permit from the Operation drop-down list. Select the Source IP Address option, type as the source IP address, and as the source wildcard. # Configure ACL 2001 to match traffic from Host. Select Firewall > ACL from the navigation tree, and click Add. Perform configuration on the page shown in Figure 19. Type 2001 as the ACL number. Click the icon corresponding to ACL 2001 on the ACL list, and click Add. Perform configuration on the page shown in Figure 20. Select Permit from the Operation drop-down list. Select the Source IP Address option, type as the source IP address, and as the source wildcard. Step2 Configure classes # Create a class named classifier_server, and reference ACL 2000 in the class. Select Firewall > QoS > Classifier from the navigation tree, and click Add. Perform configuration on the page shown in Figure 21. Figure 21 Create a class named classifier_server Type classifier_server as the classfier name. 22

24 Click the icon corresponding to classifier_server on the classifier list, and click Add. Perform configuration on the page shown in Figure 22. Figure 22 Configure rules for class classifier_server Select the ACL option, and then select 2000 from the drop-down list. # Create a class named classifier_host, and reference ACL 2001 in the class. Select Firewall > QoS > Classifier from the navigation tree, and click Add. Perform configuration on the page shown in Figure 21. Type classifier_host as the classfier name. Click the icon corresponding to classifier_host on the classifier list, and click Add. Perform configuration on the page shown in Figure 22. Select the ACL option, and then select 2001 from the drop-down list. Step3 Configure traffic behaviors # Create a behavior named behavior_server, and configure CAR for the behavior. Select Firewall > QoS > Behavior from the navigation tree, and click Add. Perform configuration on the page shown in Figure 23. Figure 23 Create a traffic behavior named behavior_server Type behavior_server as the behavior name. 23

25 Click the icon corresponding to behavior_server on the behavior list, and perform configuration on the page shown in Figure 24. Figure 24 Configure actions for behavior behavior_server Select the CAR option. Type 50 in the CIR input box. Select the CBS option, and then type The configuration progress dialog box as shown in Figure 25 appears. 24

26 Figure 25 Configuration progress dialog box When OK appears, click Close. # Create a behavior named behavior_host, and configure CAR for the behavior. On the page displaying behaviors, click Add. Perform configuration on the page shown in Figure 23. Type behavior_host as the behavior name. Click the icon corresponding to behavior_host on the behavior list, and perform configuration on the page shown in Figure 24. Select the CAR option. Type 8 in the CIR input box. Select the CBS option, and then type The configuration progress dialog box as shown in Figure 25 appears. After OK appears, click Close. Step4 Configure a QoS policy # Create a policy named policy, and configure class-behavior associations in the policy. Select Firewall > QoS > Policy from the navigation tree, and click Add. Perform configuration on the page shown in Figure 26. Figure 26 Create a policy named policy Type policy as the policy name. 25

27 Select policy from the Policy Name drop-down list and then click Add Relation. Perform configuration on the page shown in Figure 27. Figure 27 Configure class-behavior associations for the policy named policy Select classifier_server from the Classifier Name drop-down list. Select behavior_server from the Behavior Name drop-down list. Select policy from the Policy Name drop-down list and then click Add Relation. Perform configuration on the page shown in Figure 27. Select classifier_host from the Classifier Name drop-down list. Select behavior_host from the Behavior Name drop-down list. Step5 Apply the policy to an interface # Apply the policy named policy to the incoming packets of GigabitEthernet 0/1. Select Firewall > Traffic Policing > Apply from the navigation tree, and click Apply Policy. Perform configuration on the page shown in Figure 28. Figure 28 Apply the policy named policy to the incoming packets of GigabitEthernet 0/1 Select GigabitEthernet 0/1 from the Interface Name drop-down list. Select policy from the Policy Name drop-down list. Select Inbound from the Direction drop-down list. 26

28 Priority Marking Configuration Example Network requirements As shown in Figure 29, the enterprise network of a company interconnects hosts with servers through Device. The network is described as follows: Host A and Host B are connected to GigabitEthernet 0/1 of Device. The data server, mail server, and file server are connected to GigabitEthernet 0/2 of Device. Configure a priority marking QoS policy on Device to satisfy the following requirements: Traffic source Destination Processing priority Host A, B Data server High Host A, B Mail server Medium Host A, B File server Low Figure 29 Network diagram for priority marking configuration Configuration procedure Step1 Configure ACLs # Configure ACL 3000 to match packets with destination address Select Firewall > ACL from the navigation tree and then click Add. Perform configuration on the page as shown in Figure 30. Figure 30 Create ACL

29 Type the ACL number Click the icon corresponding to ACL 3000 in the ACL list and click Add. Perform configuration on the page as shown in Figure 31. Figure 31 Configure rules for ACL 3000 Select Permit in the Operation drop-down list. Select the Destination IP Address option, and type IP address and destination wildcard # Configure ACL 3001 to match packets with destination address Select Firewall > ACL from the navigation tree and then click Add. Perform configuration on the page shown in Figure 30. Type the ACL number Click the icon corresponding to ACL 3001 in the ACL list and click Add. Perform configuration on the page shown in Figure 31. Select Permit in the Operation drop-down list. Select the Destination IP Address check box, and type IP address and destination wildcard # Configure ACL 3002 to match packets with destination address

30 Select Firewall > ACL from the navigation tree and then click Add. Perform configuration on the page shown in Figure 30. Type the ACL number Click the icon corresponding to ACL 3002 in the ACL list and click Add. Perform configuration on the page shown in Figure 31. Select Permit in the Operation drop-down list. Select the Destination IP Address check box, and type IP address and destination wildcard Step2 Configure classes # Configure class classifier_dbserver to match packets based on ACL Select Firewall > QoS > Classifier from the navigation tree and then click Add. Perform configuration on the page as shown in Figure 32. Figure 32 Create class classifier_dbserver Type the class name classifier_dbserver. Select classifier_dbserver in the classifier list and click its icon. Click Create, and perform configuration on the page on the page shown in Figure 33. Figure 33 Configure rules for class classifier_dbserver Select the ACL option and select ACL

31 # Configure class classifier_mserver to match packets based on ACL Select Firewall > QoS > Classifier from the navigation tree and then click Add. Perform configuration on the page shown in Figure 32. Type the class name classifier_mserver. Select classifier_mserver in the classifier list and click its icon. Click Create, and perform configuration on the page shown in Figure 33. Select the ACL option and select ACL # Configure class classifier_fserver to match packets based on ACL Select Firewall > QoS > Classifier from the navigation tree and then click Add. Perform configuration on the page shown in Figure 32. Type the class name classifier_fserver. Select classifier_fserver in the classifier list and click its icon. Click Create, and perform configuration on the page shown in Figure 33. Select the ACL option and select ACL Step3 Configure traffic behaviors # Configure traffic behavior behavior_dbserver to mark packets with local precedence 4. Select Firewall > QoS > Behavior from the navigation tree and then click Add. Perform configuration on the page shown in Figure 34. Figure 34 Create traffic behavior behavior_dbserver Type the behavior name behavior_dbserver. Click the icon corresponding to behavior_dbserver in the traffic behavior list, and perform configuration on the page shown in Figure

32 Figure 35 Configure actions for traffic behavior behavior_dbserver Select the Dot1p option, and then select 4 in its drop-down list. The configuration progress dialog box as shown in Figure 36 appears. Figure 36 Configuration progress dialog box 31

33 After OK appears, click Close. # Configure traffic behavior behavior_mserver to mark packets with local precedence 3. Select Firewall > QoS > Behavior from the navigation tree and then click Add. Perform configuration on the page shown in Figure 34. Type the behavior name behavior_mserver. Click the icon corresponding to behavior_mserver in the traffic behavior list, and perform configuration on the page shown in Figure 35. Select the Dot1p option, and then select 3 in its drop-down list. The configuration progress dialog box as shown in Figure 36 appears. After OK appears, click Close. # Configure traffic behavior behavior_fserver to mark packets with local precedence value 2. Select Firewall > QoS > Behavior from the navigation tree and then click Add. Perform configuration on the page shown in Figure 34. Type the behavior name behavior_fserver. Click the icon corresponding to behavior_fserver in the traffic behavior list, and perform configuration as shown in Figure 35. Select the Dot1p option, and then select 2 in its drop-down list. The configuration progress dialog box as shown in Figure 36 appears. After OK appears, click Close. Step4 Configure a policy # Create QoS policy policy_server, and configure class-behavior associations for the policy. Select Firewall > QoS > Policy from the navigation tree and then click Add. Perform configuration on the page on the page shown in Figure 37. Figure 37 Create policy policy_server Type the policy name policy_server. Select policy_server from the Policy Name drop-down list above the policy list and then click Add Relation. Perform configuration on the page shown in Figure

34 Figure 38 Configure class-behavior associations for policy policy_server Select class_dbserver in the Classifier Name drop-down list. Select behavior_dbserver in the Behavior Name drop-down list. Select policy_server from the Policy Name drop-down list above the policy list and then click Add Relation. Perform configuration on the page shown in Figure 38. Select class_mserver in the Classifier Name drop-down list. Select behavior_mserver in the Behavior Name drop-down list. Select policy_server from the Policy Name drop-down list above the policy list and then click Add Relation. Perform configuration on the page shown in Figure 38. Select class_fserver in the Classifier Name drop-down list. Select behavior_fserver in the Behavior Name drop-down list. Step5 Apply the policy to an interface # Apply policy policy_server to the outgoing packets of GigabitEthernet 0/2. Select Firewall > QoS > Apply from the navigation tree and then click Apply Policy. Perform configuration on the page shown in Figure 39. Figure 39 Apply policy policy_server to the outgoing packets of GigabitEthernet 0/2 Select interface GigabitEthernet 0/2 in the Interface Name drop-down list. Select policy_server in the Policy Name drop-down list. Select Outbound in the Direction drop-down list. 33

35 CBQ Configuration Example Network requirements As shown in Figure 40, traffic travels from Router C to Router D through Device A and Device D. Traffic from Router C is classified into three classes based on DSCP. Configure a QoS policy to: Perform AF for traffic with the DSCP value being AF11 or AF21 and set a minimum guaranteed bandwidth percentage of 5% for the traffic. Perform EF for traffic with the DSCP value being EF and set the maximum bandwidth percentage for the traffic to 30%. Before performing configuration, make sure that: Router C and Router D are reachable to each other across Device A and Device B. The DSCP fields have been set for the traffic before the traffic enters Router A. Figure 40 Network diagram for CBQ configuration Configuration procedure Configure as follows on Device A: Step1 Configure ACLs # Create ACL 3000, and configure a rule to match packets with the DSCP value AF11. Select Firewall > ACL from the navigation tree, and click Add. Perform configuration on the page shown in Figure 41. Figure 41 Create ACL 3000 Type 3000 as the ACL number. 34

36 Click the icon corresponding to ACL 3000 on the ACL list, and click Add. Perform configuration on the page shown in Figure 42. Figure 42 Configure rules for ACL 3000 Select Permit from the Operation drop-down list. Select 10 af11: S pec if y AF11 DSCP (001010) from the DSCP drop-down list. # Create ACL 3001, and configure a rule to match packets with the DSCP value AF21. Select Firewall > ACL from the navigation tree, and click Add. Perform configuration on the page shown in Figure 41. Type 3001 as the ACL number. Click the icon corresponding to ACL 3001 on the ACL list, and click Add. Perform configuration on the page shown in Figure 42. Select Permit from the Operation drop-down list. Select 18 af21: Specify AF21 DSCP (010010) from the DSCP drop-down list. # Create ACL 3002, and configure a rule to match packets with the DSCP value EF. Select Firewall > ACL from the navigation tree, and click Add. Perform configuration on the page shown in Figure 41. Type 3002 as the ACL number. 35

37 Click the icon corresponding to ACL 3002 on the ACL list, and click Add. Perform configuration on the page shown in Figure 42. Select Permit from the Operation drop-down list. Select 46 ef: Specify EF DSCP (101110) from the DSCP drop-down list. Step2 Configure classes # Create a class named af11_class, and reference ACL 3000 in the class. Select Firewall > QoS > Classifier from the navigation tree, and click Add. Perform configuration on the page shown in Figure 43. Figure 43 Create a class named af11_class Type af11_class as the classfier name. Click the icon corresponding to af11_class on the classifier list, and click Add. Perform configuration on the page shown in Figure 44. Figure 44 Configure rules for class af11_class Select the ACL option, and then select 3000 from the drop-down list. # Create a class named af21_class, and reference ACL 3001 in the class. Select Firewall > QoS > Classifier from the navigation tree, and click Add. Perform configuration on the page shown in Figure 43. Type af21_class as the classfier name. 36

38 Click the icon corresponding to af21_class on the classifier list, and click Add. Perform configuration on the page shown in Figure 44. Select the ACL option, and then select 3001 from the drop-down list. # Create a class named ef_class, and reference ACL 3002 in the class. Select Firewall > QoS > Classifier from the navigation tree, and click Add. Perform configuration on the page shown in Figure 43. Type ef_class as the classfier name. Click the icon corresponding to ef_class on the classifier list, and click Add. Perform configuration on the page shown in Figure 44. Select the ACL option, and then select 3002 from the drop-down list. Step3 Configure traffic behaviors # Create a behavior named af11_behav, and configure AF and set the minimum available bandwidth for the behavior. Select Firewall > QoS > Behavior from the navigation tree, and click Add. Perform configuration on the page shown in Figure 45. Figure 45 Create a traffic behavior named af11_behav Type af11_behav as the behavior name. Click the icon corresponding to af11_behav on the behavior list, and perform configuration on the page shown in Figure

39 Figure 46 Configure actions for behavior af11_behav Select the Queue option. Select the AF option. Select the Percent option, and then type 5. The configuration progress dialog box as shown in Figure 47 appears. 38

40 Figure 47 Configuration progress dialog box When OK appears, click Close. # Create a behavior named af21_behav, and configure AF and set the minimum available bandwidth for the behavior. On the page displaying behaviors, click Add. Perform configuration on the page shown in Figure 45. Type af21_behav as the behavior name. Click the icon corresponding to af21_behav on the behavior list, and perform configuration on the page shown in Figure 46. Select the Queue option. Select the AF option. Select the Percent option, and then type 5. The configuration progress dialog box as shown in Figure 47 appears. When OK appears, click Close. # Create a behavior named ef_behav, and configure EF and set the maximum available bandwidth for the behavior. For EF traffic, both bandwidth and delay are guaranteed. On the page displaying behaviors, click Add. Perform configuration on the page shown in Figure 45. Type ef_behav as the behavior name. Click the icon corresponding to ef_behav on the behavior list, and perform configuration on the page shown in Figure 46. Select the Queue option. Select the EF option. Select the Percent option, and then type 30. The configuration progress dialog box as shown in Figure 47 appears. When OK appears, click Close. 39

41 Step4 Configure a QoS policy # Create a policy named dscp, and configure class-behavior associations in the policy. Select Firewall > QoS > Policy from the navigation tree, and click Add. Perform configuration on the page shown in Figure 48. Figure 48 Create a policy named dscp Type dscp as the policy name. Select dscp from the Policy Name drop-down list above the policy list and then click Add Relation. Perform configuration on the page shown in Figure 49. Figure 49 Configure class-behavior associations for the policy named dscp Select af11_class from the Classifier Name drop-down list. Select af11_behav from the Behavior Name drop-down list. Select dscp from the Policy Name drop-down list and then click Add Relation. Perform configuration on the page shown in Figure 49. Select af21_class from the Classifier Name drop-down list. Select af21_behav from the Behavior Name drop-down list. Select dscp from the Policy Name drop-down list and then click Add Relation. Perform configuration on the page shown in Figure 49. Select ef_class from the Classifier Name drop-down list. Select ef_behav from the Behavior Name drop-down list. Step5 Apply the policy to an interface # Apply the policy named dscp to the outgoing packets of GigabitEthernet 0/1. 40

42 Select Firewall > Traffic Policing > Apply from the navigation tree, and click Apply Policy. Perform configuration on the page shown in Figure 50. Figure 50 Apply the policy named dscp to the outgoing packets of GigabitEthernet 0/1 Select GigabitEthernet 0/1 from the Interface Name drop-down list. Select dscp from the Policy Name drop-down list. Select Outbound from the Direction drop-down list. After the configuration is completed, you can see EF traffic is preferentially forwarded when congestion occurs. Packet Filtering Configuration Example Network requirements As shown in Figure 51, Host is connected to GigabitEthernet 0/1 of Device. Configure a QoS policy to filter the incoming packets whose TCP source port is not 21 on GigabitEthernet 0/1. Figure 51 Network diagram for packet filtering configuration Configuration procedure Step1 Configure ACLs # Create ACL 3000, and configure a rule to match packets whose TCP source port is not 21. Select Firewall > ACL from the navigation tree, and click Add. Perform configuration on the page shown in Figure

43 Figure 52 Create ACL 3000 Type 3000 as the ACL number. Click the icon corresponding to ACL 3000 on the ACL list, and click Add. Perform configuration on the page shown in Figure 53. Figure 53 Configure rules for ACL 3000 Select Permit from the Operation drop-down list. Select 6 TCP from the Protocol drop-down list. Select not equal to from the Source Operation drop-down list, and type 21 in the Port input box. Step2 Configure classes # Create a class named classifier_1, and reference ACL 3000 in the class. 42

44 Select Firewall > QoS > Classifier from the navigation tree, and click Add. Perform configuration on the page shown in Figure 54. Figure 54 Create a class named classifier_1 Type classifier_1 as the classfier name. Click the icon corresponding to classifier_1 on the classifier list, and click Add. Perform configuration on the page shown in Figure 55. Figure 55 Configure rules for class af11_class Select the ACL option, and then select 3000 from the drop-down list. Step3 Configure traffic behaviors # Create a behavior named behavior_1, and configure the packet filtering action for the behavior to drop packets. Select Firewall > QoS > Behavior from the navigation tree, and click Add. Perform configuration on the page shown in Figure 56. Figure 56 Create a traffic behavior named behavior_1 43

45 Type behavior_1 as the behavior name. Click the icon corresponding to behavior_1 on the behavior list, and perform configuration on the page shown in Figure 57. Figure 57 Configure actions for behavior behavior_1 Select the Packet Filter option, and then select Deny. The configuration progress dialog box as shown in Figure 58 appears. 44

46 Figure 58 Configuration progress dialog box When OK appears, click Close. Step4 Configure a QoS policy # Create a policy named policy, and configure class-behavior associations in the policy. Select Firewall > QoS > Policy from the navigation tree, and click Add. Perform configuration on the page shown in Figure 59. Figure 59 Create a policy named policy Type policy as the policy name. Select policy from the Policy Name drop-down list and then click Add Relation. Perform configuration on the page shown in Figure 60. Figure 60 Configure class-behavior associations for the policy named policy Select classifier_1 from the Classifier Name drop-down list. 45