Network Security Internet Technology Development Database Servers Mobile Phone Android Software Apple Software Computer Software News IT Information

In addition to Weibo, there is also WeChat

Please pay attention

WeChat public account

Shulou

1. QOS based on CISCO router

2025-03-28 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Network Security >

Share

Shulou(Shulou.com)06/01 Report--

1. QOS model

Best effort service model (Best-effort)

Integrated Service Model (Integrated Services)

Differentiated Services Model (Differentiated Services)

2. The structure of differentiated service model.

3. Classification and marking

Tags can be marked with the high three bits (IP priority) or the high six bits (DSCP) of TOS in the IP header.

Set the priority of ICMP traffic to 2 on R1, set the DSCP value of HTTP traffic to AF22, and set the priority of other mismatched traffic to 1. Check on ISP to see if the tag is valid.

The ISP configuration is as follows:

Ip http server

Access-list 100 permit ip any any dscp af22

Access-list 100 permit ip any any precedence 1

Access-list 100 permit ip any any precedence 2

Interface FastEthernet2/0

Service-policy input MARK

R1 is configured as follows:

Access-list 110 permit icmp any any

Access-list 120 permit tcp any any eq www

Class-map match-all ICMP

Match access-group 110

Class-map match-all WWW

Match access-group 120

Policy-map MARK

Class ICMP

Set precedence 2

Class WWW

Set dscp af22

Class class-default

Set precedence 1

Interface FastEthernet2/0

Service-policy input MARK

Test commands on TEST

Ping 33.1.1.1

Telnet 33.1.1.1 80

View command

Show ip access-lists

Show class-map

Show policy-map

Show policy-map interface s0/1

4. Queue technology (congestion management)

Queuing technology is applied to the exit direction of an interface, and only one queuing technology can be used for an interface.

The router has a software queue and a hardware queue on the interface. The packet first enters the soft queue, and then uses the queue technology to schedule the packet into the hardware queue. The hardware queue always uses the first-in-first-out method to send the packet.

Commonly used queuing techniques: FIFO, PQ, CQ, WFQ, and LLQ are all CLI tools, while CBWFQ is a MQC tool.

First in first out queue (FIFO)

Priority queue (PQ)

Custom team (CQ)

Weighted Fair queuing (WFQ)

Low latency queue (LLQ)

Real-time transmission queue (RTP PQ):

Based on class weighted fair queuing (CBWFQ)

Three major components of queue technology: classification component, insertion and discarding component, scheduling component

First in first out queue (FIFO)

By default: when the speed of the interface is faster than 2.048Mbps, the router uses FIFO for scheduling.

Priority queue (PQ)

Number of queues: 4 queues: high, medium, ordinary and low

Classification: put into different queues according to prior classification

Insert and discard: you can set the queue length. When the queue is full, the packet will be discarded by the tail.

Scheduling: scheduling according to the order of high, medium, ordinary and low. Only if the queue with high priority is listed as empty will the middle priority be scheduled, and so on.

Advantages: ensuring high priority packet forwarding priority

Disadvantages: high priority queues are not empty and low priority queues are never forwarded

Specify the queue that packets that do not match any type will enter (default normal)

Priority-list 1 default high

Classify packets according to their entry and put them in a queue

Priority-list 1 interface serial 0/0 high

Classify packets according to their protocol type and put them in a queue

Priority-list 1 protocol ip high tcp telnet

Specify the size of each queue

Priority-list 1 queue-limit 10 10 10

Apply queues on an interface

Priority-group 1

=

R1

=

Priority-list 1 interface FastEthernet2/0 high

Priority-list 1 protocol ip normal tcp www

Priority-list 1 default low

Priority-list 1 queue-limit 10 20 30 40

Interface Serial0/1

Priority-group 1

View queues on an interface

Show int s0/1

View queue configuration

Show queueing priority

Test whether the queue is in effect

Debug priority

Show queueing interface s0/1

Custom queue (CQ)

Number of queues: CQ has 17 queues, of which queue 0 is a priority queue. Only queue 0 is empty to serve other queues.

Classification: put into different queues according to prior classification

Insert and discard: you can set the queue length. When the queue is full, the packet will be discarded by the tail.

Scheduling: after forwarding a certain number of bytes for the first queue, it is forwarded for the second queue and polled in turn

Pros: ensure that each queue has a chance to be served

Specify the queue that packets that do not match any type will enter (default queue 1)

Queue-list 1 default 1

Classify packets according to their entry and put them in a queue

Queue-list 1 interface serial 0/0 1

Classify packets according to their protocol type and put them in a queue

Queue-list 1 protocol ip 1 tcp telnet

Specifies the number of packet bytes that are forwarded for each queue during each poll

Queue-list 1 queue 1 byte-count 100

Specify the size of each queue

Queue-list 1 queue 1 limit 100

Specify the priority queue (for example, if it is 2 at this time, queues 0 and 1 are priority queues)

Queue-list 1 lowest-custom 2

Apply queues on an interface

Custom-queue-list 1

=

R1

=

Queue-list 1 interface FastEthernet2/0 2

Queue-list 1 protocol ip 3 tcp www

Queue-list 1 queue 1 byte-count 100 limit 100

Queue-list 1 queue 2 byte-count 200 limit 200

Queue-list 1 queue 3 byte-count 300 limit 300

Queue-list 1 lowest-custom 4

Interface Serial0/1

Custom-queue-list 1

View queues on an interface

Show int s0/1

View queue configuration

Show queueing custom

Test whether the queue is in effect

Debug custom-queue

Show queueing interface s0/1

Weighted Fair queuing (WFQ)

By default: when the speed of the interface is less than 2.048Mbps, the router uses WFQ for scheduling.

Classification: packets with the same protocol type, source IP, destination IP, source port, destination port, and TOS value are regarded as one flow, and packets of the same flow will be placed in a queue.

Insert drop: when the queue is full, the packet will be discarded by WFQ, discarding the packet with the worst completion time

Scheduling: first schedule the packets that can be forwarded as quickly as possible, and the packet size is based on the virtual packet size (virtual packet size = actual packet size / (IP priority + 1))

Advantages: packets with higher priority and smaller packets are forwarded first

WFQ discarding mechanism: (discard packets with the worst completion time)

HQO (Hold Queue Out Limit): the maximum number of big data packets that can be stored in the entire WFQ system. This value is the sum of queues.

CDT (Congestive Discard Threshold): the threshold of the WFQ discarding mechanism that begins to drop packets when the sum of packets in each queue reaches CDT.

=

R1

=

Interface Serial0/1

Fair-queue 51264 (specify CDT 512, maximum sessions 64)

Hold-queue 1500 out (specify HQO as 1500)

View queues on an interface

Show int s0/1

Class-based weighted Fair queuing (CBWFQ)

Classification: allow custom classes, put data in different queues, up to 64 classes can be defined, and data that do not match classifications can be put into the system default class class-default

Insert and discard: you can set the queue length. When the queue is full, the packet will be discarded by the tail.

Scheduling: the specified bandwidth is reserved for each queue, and each queue is scheduled by FIFO by default, but it can also be scheduled in combination with WFQ. How to ensure the bandwidth and how each queue packet is scheduled to the hardware queue is unknown.

Advantages: guarantee the minimum bandwidth of traffic, rather than limit the maximum bandwidth

=

R1

=

Access-list 1 permit 192.168.1.100

Access-list 2 permit 192.168.1.1

Class-map match-all 100

Match access-group 1

Class-map match-all 1

Match access-group 2

Policy-map MARK

Class 100

Bandwidth 500

Class 1

Bandwidth 500

Interface Serial0/1

Service-policy output MARK

View command

Show class-map

Show policy-map

Show policy-map interface s0/1

Low latency queue (LLQ)

The LLQ configuration is similar to CBWFQ and the scheduling mechanism is similar to PQ. LLQ is usually used with CBWFQ.

=

R1

=

Class-map match-any CLASS-MAP3

Match ip precedence 5

Class-map match-all CLASS-MAP2

Match protocol telnet

Class-map match-any CLASS_MAP1

Match protocol http

Match protocol ftp

Policy-map MY-POLICY

Class CLASS_MAP1

Bandwidth 512

Class CLASS-MAP2

Bandwidth 128

Queue-limit 128

Class CLASS-MAP3

Priority 128

Interface Serial0/0

Bandwidth 1024

Service-policy output MY-POLICY

A combination of LLQ and CBWFQ is used in this example.

CLASS-MAP3 uses LLQ to guarantee bandwidth of 128kbps, which takes precedence over CLASS-MAP1,CLASS-MAP2 forwarding

CLASS-MAP1,CLASS-MAP2 uses WFQ, which ensures a bandwidth of 512kb psp per 128kbps respectively.

View command

Show class-map

Show policy-map

Show policy-map interface s0/0

RTP priority queue

RTP priority queue is a simple technology to solve the problem of voice quality of service. The principle of expectation is that the RTP packets carrying voice are sent into the priority queue to be forwarded first.

RTP recognizes the UDP packet port for voice, and these packets are usually sent using an even port of 16384' 32767.

The RTP priority queue can be used in conjunction with any of the previous queues, including FIFO, PQ, CQ, WFQ, CBWFQ, and LLQ, but it has the highest priority. Even if RTP is used with LLQ, RTP has a higher priority than LLQ.

Interface Serial0/0

Ip rtp priority 16384 16383 256

16384 lowest UDP port number, 16383 port increment, bandwidth 256kbps

5. Congestion avoidance

Random early pre-detection (RED)

Set two thresholds for the queue: the minimum threshold and the maximum threshold. When the average length of the queue is less than the minimum threshold, the packet is not dropped.

When the average queue length is between the minimum threshold and the maximum threshold, RED begins to drop packets randomly; when the average queue length is greater than the maximum threshold, all packets at the tail are discarded.

Weighted random early detection (WRED)

The principle of WRED and RED is the same, but WRED can set different minimum threshold, maximum threshold and drop probability according to different IP priority or DSCP value, so as to provide different drop characteristics for packets with different priority.

WRED cannot be used with PQ, CQ, and WFQ queues.

Configure IP Precedence-based WRED

Random-detect

Set the minimum threshold value, the maximum threshold value, and the drop probability of the dropped packet according to the IP priority (in this case, the probability should be 1 prime 10)

Random-detect precedence 1 10 20 10

Configure DSCP-based WRED

Random-detect dscp-based

Set the minimum threshold, maximum threshold, and drop probability of discarded packets according to DSCP (in this case, the probability should be 1max 10)

Random-detect dscp af22 10 20 10

Sets the weight factor for calculating the average queue length (default is 9)

Random-detect exponential-weighting-constant 9

View WRED queue configuration

Show queueing int s0/0

Flow-based weighted random early detection (FB-WRED)

In WRED, only TCP flow will react to packet loss and reduce the rate, while non-adaptive flows such as UDP will not respond to packet loss, so non-adaptive flows such as UDP will send packets at a much higher rate than adaptive flows when they are congested.

In addition to the improvement to WRED, FB-WRED will penalize the flow that takes up an extra fair share of queue resources.

FB-WRED data streams and IP priorities (or DSCP values) put incoming packets in different queues and calculate the fair queue resource share (queue length / number of active streams) for each active flow.

Flows that occupy an extra fair share of queue resources will be penalized. The method is to increase the packet discarding probability by reducing the maximum WRED threshold of the queue.

New maximum threshold = minimum threshold + {(maximum threshold-minimum threshold) / 2}

Configure FB-WRED (WRED must be configured first)

Random-detect flow

Set the average depth factor (that is, magnification factor, default is 4)

Random-detect flow average-depth-factor 4

Set the number of data streams for a stream-based WRED

Random-detect flow count 32

View WRED queue configuration

Show queueing int s0/0

Class-based weighted Random early pre-Detection (CB-WRED)

CB-WRED can combine with CBWFQ and Shaping, but not with FB-WRED, LLQ and Policing.

Class-map match-any HTTP-FTP

Match protocol http

Match protocol ftp

Policy-map MY-POLICY

Class HTTP-FTP

Bandwidth 512

Random-detect

Random-detect precedence 0 20 30 10

Interface Serial0/0

Bandwidth 1024

Service-policy output MY-POLICY

This example enables priority-based WRED and CBWFQ combination.

View command

Show class-map

Show policy-map

Show policy-map int s0/0

6. Traffic × × (Shaping)

The purpose of traffic × × is to smooth traffic. Traffic × × will buffer the data that exceeds the specified rate, not discard it. The average traffic rate of the link is larger, but it will cause data delay or delay jitter.

Related nouns for token bucket:

CIR: committed information rate (in bps)

PRI: committed information rate (in bps)

Bc: the size of the normal burst (in bytes)

Be: the size of the excess burst in bytes

Tc: interval

CIR=Bc/Tc

When a token bucket, the size of the bucket is Bc+Be

Tokens are added to the token bucket at the rate of CIR

When the packet is to be forwarded, if you cannot get enough tokens from the token bucket, the packet is cached and enough tokens are sent. The average rate of packet transmission does not exceed that of CIR, but at some point it can be sent by Bc+Be that exceeds the rate of CIR.

GTS general traffic is implemented by adding a queue before the software queue, which uses WFQ. GTS can be used with FIFO, PQ, CQ, and WFQ.

CLI configuration method

Interface Serial0/1

Traffic-shape rate 8000 1500 1000 1000

MQC configuration method

Access-list 100 permit icmp any any

Class-map match-all ICMP

Match access-group 100

Policy-map TEST

Class ICMP

Shape average 8000 1000 1000

Interface Serial0/1

Service-policy output TEST

View command

Show traffic-shape

Show traffic-shape statistics

7. Traffic Supervision (Policing)

Traffic regulation can be applied to both the outgoing and inbound directions of the interface. Divided into single-barrel single-speed two-color, double-barrel single-speed tricolor, double-bucket double-speed tricolor.

The purpose of traffic regulation is to limit the speed. Traffic regulation will discard or mark more than the specified rate to facilitate subsequent routers to deal with, the link traffic rate has a large fluctuation, the overall average bandwidth is low, but will not cause packet delay increase.

Related nouns for token bucket:

CIR: committed information rate (in bps)

PRI: committed information rate (in bps)

Bc: the size of the normal burst (in bytes)

Be: the size of the excess burst in bytes

Tc: interval

CIR=Bc/Tc

Single barrel, single speed, two colors

Single token bucket, the size of which is Be, not Bc+Be

Tokens are added to the token bucket at the rate of CIR

When the packet is to be forwarded, if enough tokens can be obtained from the token bucket, it becomes Conforn, and the number of tokens in the bucket is the number of tokens before minus the size of the packet; if enough tokens are obtained from the token bucket, it becomes Exceed, and the number of tokens in the bucket remains the same.

CLI configuration method

Interface Serial0/1

Rate-limit output 8000 1500 2000 conform-action transmit exceed-action drop

MQC configuration method

Access-list 100 permit icmp any any

Class-map match-all ICMP

Match access-group 100

Policy-map TEST

Class ICMP

Police cir 8000 bc 1500 be 1000

Conform-action transmit

Exceed-action drop

Interface Serial0/1

Service-policy input TEST

View command

Show class-map

Show policy-map

Show policy-map int s0/0

Double bucket single speed tricolor

Two token buckets, the size of TB1 is Bc,TB2, the size of Be

Tokens are added to the TB1 in the token bucket at the rate of CIR, and when the TB1 is full, the token overflows into the TB2.

When the packet is to be forwarded, it becomes Conforn if enough tokens can be obtained from the token bucket TB1. In this case, the number of tokens of TB1 is the previous number of tokens minus the size of the packet, and the number of tokens of TB2 remains the same.

When the packet is to be forwarded, if you cannot get enough tokens from the token bucket TB1, but can get enough tokens from the token bucket TB2, it becomes Exceed. In this case, the number of tokens of the TB1 remains the same, and the number of tokens of the TB2 minus the size of the packet.

When the packet is to be forwarded, if you cannot get enough tokens from the token bucket TB1 or enough tokens from the token bucket TB2, it becomes Violate, and the number of tokens of TB1 and TB2 remains the same.

Access-list 100 permit icmp any any

Class-map match-all ICMP

Match access-group 100

Policy-map TEST

Class ICMP

Police cir 8000 bc 1500 be 1000

Conform-action transmit

Exceed-action drop

Violate-action drop

Interface Serial0/1

Service-policy input TEST

View command

Show class-map

Show policy-map

Show policy-map int s0/0

Two buckets, two speeds, three colors.

Two token buckets, the size of TB1 is Be,TB2, the size of Bc

Tokens are added to the TB1 in the token bucket at the rate of PIR, and to TB2 in the token bucket at the rate of CIR, PIR > = CIR

When the packet is to be forwarded, if enough tokens can be obtained from the token bucket TB1 or enough tokens can be obtained from the token bucket TB2, it becomes Conforn. In this case, the number of tokens of TB1 is the number of previous tokens minus the size of the packet, and the number of tokens of TB2 is the number of previous tokens minus the size of the packet.

When the packet is to be forwarded, if enough tokens can be obtained from the token bucket TB1, but not enough tokens can be obtained from the token bucket TB2, it becomes Exceed. In this case, the number of tokens of TB1 is the number of previous tokens minus the size of the packet, and the number of tokens of TB2 remains the same.

When the packet is to be forwarded, if you cannot get enough tokens from the token bucket TB1 or enough tokens from the token bucket TB2, it becomes Violate, and the number of tokens of TB1 and TB2 remains the same.

Access-list 100 permit icmp any any

Class-map match-all ICMP

Match access-group 100

Policy-map TEST

Class ICMP

Police cir 8000 bc 1500 pir 8000 be 1500

Conform-action transmit

Exceed-action drop

Violate-action drop

Interface Serial0/1

Service-policy input TEST

View command

Show class-map

Show policy-map

Show policy-map int s0/0

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.

Views: 0

*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.

Share To

Network Security

Wechat

© 2024 shulou.com SLNews company. All rights reserved.

12
Report