Aruba R8M25A HPE FlexNetwork Switch User Guide
Werbung
Werbung
HPE FlexNetwork 5520 HI Switch Series
ACL and QoS Configuration Guide
Part number: 5200-8307
Software version: Release 6525 and later
Document version: 6W100-20210810
© Copyright 2021 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.
Contents
Configuring ACLs··························································································· 1
QoS overview ······························································································ 15
Configuring a QoS policy ············································································· 18
i
Configuring priority mapping ········································································ 25
Configuring traffic policing, GTS, and rate limit ············································ 35
Configuring congestion management ·························································· 45
Configuring congestion avoidance ······························································· 52
ii
Configuring traffic filtering ············································································ 57
Configuring protocol packet rate limiting ······················································ 60
Configuring priority marking ········································································· 62
Configuring nesting ······················································································ 66
Configuring traffic redirecting ······································································· 69
Configuring global CAR ··············································································· 73
Configuring class-based accounting ···························································· 76
Appendixes ·································································································· 79
Configuring data buffers ·············································································· 86
iii
Configuring time ranges ··············································································· 90
Document conventions and icons ································································ 92
Support and other resources ······································································· 94
Index ············································································································ 97
iv
Configuring ACLs
About ACLs
An access control list (ACL) is a set of rules for identifying traffic based on criteria such as source IP address, destination IP address, and port number. The rules are also called permit or deny statements.
ACLs are primarily used for packet filtering. You can also use ACLs in QoS, security, routing, and other modules for identifying traffic. The packet drop or forwarding decisions depend on the modules that use ACLs.
Numbering and naming ACLs
When creating an ACL, you must assign it a number or name for identification. You can specify an existing ACL by its number or name. Each ACL type has a unique range of ACL numbers.
For basic or advanced ACLs with the same number, you must use the ipv6 keyword to distinguish them. For ACLs with the same name, you must use the ipv6 or mac keywords to distinguish them.
ACL types
Type
Basic ACLs
Advanced ACLs
Layer 2 ACLs
ACL number IP version Match criteria
IPv4 Source IPv4 address.
2000 to 2999
IPv6 Source IPv6 address.
3000 to 3999
4000 to 4999
IPv4
IPv6
IPv4 and IPv6
Source IPv4 address, destination IPv4 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields.
Source IPv6 address, destination IPv6 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields.
Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority, and link layer protocol type.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the matching result and action to take depend on the rule order.
The following ACL match orders are available:
• config —Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule with a higher ID. If you use this method, check the rules and their order carefully.
• auto —Sorts ACL rules in depth-first order. Depth-first ordering makes sure any subset of a rule
is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first
ordering uses to sort rules for each type of ACL.
1
Table 1 Sort ACL rules in depth-first order
ACL type
IPv4 basic ACL
IPv4 advanced ACL
IPv6 basic ACL
IPv6 advanced ACL
Sequence of tie breakers
1. VPN instance.
2. More 0s in the source IPv4 address wildcard (more 0s means a narrower IPv4 address range).
3. Rule configured earlier.
4. VPN instance.
5. Specific protocol number.
6. More 0s in the source IPv4 address wildcard mask.
7. More 0s in the destination IPv4 address wildcard.
8. Narrower TCP/UDP service port number range.
9. Rule configured earlier.
10. VPN instance.
11. Longer prefix for the source IPv6 address (a longer prefix means a narrower IPv6 address range).
12. Rule configured earlier.
13. VPN instance.
14. Specific protocol number.
15. Longer prefix for the source IPv6 address.
16. Longer prefix for the destination IPv6 address.
17. Narrower TCP/UDP service port number range.
18. Rule configured earlier.
Layer 2 ACL
19. More 1s in the source MAC address mask (more 1s means a smaller
MAC address).
20. More 1s in the destination MAC address mask.
21. Rule configured earlier.
A wildcard mask, also called an inverse mask, is a 32-bit binary number represented in dotted decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent "do care" bits, and the 1 bits represent "don't care" bits. If the "do care" bits in an IP address are identical to the "do care" bits in an IP address criterion, the IP address matches the criterion. All "don't care" bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask.
Comments and remarks for rules
An ACL can have multiple rules. To identify rules, you can add a comment for each rule one by one, or add the same remark for multiple rules.
•
For rules requiring different identification, you can add a comment for a particular rule or add a different comment for each rule.
•
For a range of rules requiring the same identification, you can insesrt a remark before the start rule and a remark after the end rule. This configuration mode eliminates the need for configuring a comment for each rule one by one and improves configuration efficiency.
Rule numbering
ACL rules can be manually numbered or automatically numbered. This section describes how automatic ACL rule numbering works.
Rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID.
The rule numbering step sets the increment by which the system automatically numbers rules. For
2
example, the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of inserting rules in an ACL. This feature is important for a config-order ACL, where ACL rules are matched in ascending order of rule ID.
The rule numbering step sets the increment by which the system numbers rules automatically. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is
12, the rule is numbered 15.
The wider the numbering step, the more rules you can insert between two rules. Whenever the step or start rule ID changes, the rules are renumbered, starting from the start rule ID. For example, if there are five rules numbered 0, 5, 9, 10, and 15, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4, 6, and 8.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the current highest rule ID, starting with 0.
For example, if the step is 5, and there are five rules numbered 0, 5, 9, 10, and 12, the newly defined rule is numbered 15. If the ACL does not contain a rule, the first rule is numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, changing the step from 5 to 2 renumbers rules 5, 10, 13, and 15 as rules 0, 2, 4, and 6.
For an ACL of the match order auto , rules are sorted in depth-first order, and are renumbered based on the match order. For example, rules are in the match order of 0, 10, and 5. Changing the numbering step to 2 renumbers rules 0, 10, and 5 (not 0, 5, and 10) as rules 0, 2, 4.
Fragment filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid risks, the ACL feature is designed as follows:
•
Filters all fragments by default, including non-first fragments.
•
Allows for matching criteria modification for efficiency. For example, you can configure the ACL to filter only non-first fragments.
Restrictions and guidelines: ACL configuration
•
If you create a numbered ACL, you can enter the view of the ACL by using either of the following commands:
acl [ ipv6 ] number acl-number .
acl { [ ipv6 ] { advanced | basic } | mac } acl-number .
•
If you create a ACL by using the acl [ ipv6 ] number acl-number name acl-name command, you can enter the view of the ACL by using either of the following commands:
acl [ ipv6 ] name acl-name (for only basic ACLs and advanced ACLs).
acl [ ipv6 ] number acl-number [ name acl-name ] . acl { [ ipv6 ] { advanced | basic } | mac ] } name acl-name .
3
•
If you create a named ACL by using the acl { [ ipv6 ] { advanced | basic } | mac } name acl-name command, you can enter the view of the ACL by using either of the following commands:
acl [ ipv6 ] name acl-name (for only basic ACLs and advanced ACLs).
acl { [ ipv6 ] { advanced | basic } | mac } name acl-name .
•
Matching packets are forwarded through slow forwarding if an ACL rule contains match criteria or has functions enabled in addition to the following match criteria and functions:
Source and destination IP addresses.
Source and destination ports.
Transport layer protocol.
ICMP or ICMPv6 message type, message code, and message name.
Logging.
Time range.
Slow forwarding requires packets to be sent to the control plane for forwarding entry calculation, which affects the device forwarding performance.
ACL tasks at a glance
To configure an ACL, perform the following tasks:
•
Configure ACLs according to the characteristics of the packets to be matched
•
•
(Optional.) Configuring packet filtering with ACLs
Configuring a basic ACL
About basic ACLs
Basic ACLs match packets based only on source IP addresses.
Configuring an IPv4 basic ACL
1. Enter system view. system-view
2. Create an IPv4 basic ACL and enter its view. Choose one option as needed:
Create an IPv4 basic ACL by specifying an ACL number.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
Create an IPv4 basic ACL by specifying the basic keyword.
acl basic { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the IPv4 basic ACL. description text
4
By default, an IPv4 basic ACL does not have a description.
4. (Optional.) Set the rule numbering step. step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 0.
5. Create or edit a rule. rule [ rule-id ] { deny | permit } [ counting | fragment | [ flow-logging | logging ] | source { source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
The flow-logging or logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.
6. (Optional.) Add or edit a rule comment. rule rule-id comment text
By default, no rule comment is configured.
7. (Optional.) Add a rule remark. rule [ rule-id ] remark text
By default, no rule remark is configured.
Configuring an IPv6 basic ACL
Restrictions and guidelines
If an IPv6 basic ACL is used for QoS traffic classification or packet filtering, do not specify the fragment keyword.
Procedure
1. Enter system view. system-view
2. Create an IPv6 basic ACL view and enter its view. Choose one option as needed:
Create an IPv6 basic ACL by specifying an ACL number.
acl ipv6 number acl-number [ name acl-name ] [ match-order { auto | config } ]
Create an IPv6 basic ACL by specifying the basic keyword.
acl ipv6 basic { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the IPv6 basic ACL. description text
By default, an IPv6 basic ACL does not have a description.
4. (Optional.) Set the rule numbering step. step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 0.
5. Create or edit a rule. rule [ rule-id ] { deny | permit } [ counting | fragment | [ flow-logging | logging ] | routing [ type routing-type ] | source { source-address source-prefix | source-address / source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
The flow-logging or logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.
5
6. (Optional.) Add or edit a rule comment. rule rule-id comment text
By default, no rule comment is configured.
7. (Optional.) Add a rule remark. rule [ rule-id ] remark text
By default, no rule remark is configured.
Configuring an advanced ACL
About advanced ACLs
Advanced ACLs match packets based on the following criteria:
•
Source IP addresses.
•
Destination IP addresses.
•
Packet priorities.
•
Protocol types.
•
Other protocol header information, such as TCP/UDP source and destination port numbers,
TCP flags, ICMP message types, and ICMP message codes.
Compared to basic ACLs, advanced ACLs allow more flexible and accurate filtering.
Configuring an IPv4 advanced ACL
1. Enter system view. system-view
2. Create an IPv4 advanced ACL and enter its view. Choose one option as needed:
Create a numbered IPv4 advanced ACL by specifying an ACL number.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
Create an IPv4 advanced ACL by specifying the advanced keyword.
acl advanced { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the IPv4 advanced ACL. description text
By default, an IPv4 advanced ACL does not have a description.
4. (Optional.) Set the rule numbering step. step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 0.
5. Create or edit a rule. rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value }
* | established } | counting | destination { dest-address dest-wildcard | any } | destination-port operator port | { dscp dscp | { precedence precedence | tos tos } * } | fragment | icmp-type { icmp-type [ icmp-code ]
| icmp-message } | [ flow-logging | logging ] | source { source-address source-wildcard | any } | source-port operator port | time-range time-range-name | vpn-instance vpn-instance-name ] *
6
The flow-logging or logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.
6. (Optional.) Add or edit a rule comment. rule rule-id comment text
By default, no rule comment is configured.
7. (Optional.) Add a rule remark. rule [ rule-id ] remark text
By default, no rule remark is configured.
Configuring an IPv6 advanced ACL
Restrictions and guidelines
If an IPv6 advanced ACL is for QoS traffic classification or packet filtering:
•
Do not specify the fragment keyword.
•
Do not specify the routing , hop-by-hop , or flow-label keyword if the ACL is for outbound application.
•
Do not specify ipv6-ah for the protocol argument, or set its value to 0, 43, 44, 51, or 60 if the ACL is for outbound application.
Procedure
1. Enter system view. system-view
2. Create an IPv6 advanced ACL and enter its view. Choose one option as needed:
Create a numbered IPv6 advanced ACL by specifying an ACL number.
acl ipv6 number acl-number [ name acl-name ] [ match-order { auto | config } ]
Create an IPv6 advanced ACL by specifying the advanced keyword.
acl ipv6 advanced { acl-number | name acl-name } [ match-order { auto
| config } ]
3. (Optional.) Configure a description for the IPv6 advanced ACL. description text
By default, an IPv6 advanced ACL does not have a description.
4. (Optional.) Set the rule numbering step. step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 0.
5. Create or edit a rule. rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value }
* | established } | counting | destination { dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port operator port | | dscp dscp | flow-label flow-label-value | fragment | icmp6-type
{ icmp6-type icmp6-code | icmp6-message } | [ flow-logging | logging ] | routing [ type routing-type ] | hop-by-hop [ type hop-type ] | source
{ source-address source-prefix | source-address/source-prefix | any } | source-port operator port | time-range time-range-name | vpn-instance vpn-instance-name ] *
7
The flow-logging or logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.
6. (Optional.) Add or edit a rule comment. rule rule-id comment text
By default, no rule comment is configured.
7. (Optional.) Add a rule remark. rule [ rule-id ] remark text
By default, no rule remark is configured.
Configuring a Layer 2 ACL
About this task
Layer 2 ACLs, also called Ethernet frame header ACLs, match packets based on Layer 2 Ethernet header fields, such as:
•
Source MAC address.
•
Destination MAC address.
•
802.1p priority (VLAN priority).
•
Link layer protocol type.
•
Encapsulation type.
Procedure
1. Enter system view. system-view
2. Create a Layer 2 ACL and enter its view. Choose one option as needed:
Create a Layer 2 ACL by specifying an ACL number.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
Create a Layer 2 ACL by specifying the mac keyword.
acl mac { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the Layer 2 ACL. description text
By default, a Layer 2 ACL does not have a description.
4. (Optional.) Set the rule numbering step. step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 0.
5. Create or edit a rule. rule [ rule-id ] { deny | permit } [ cos dot1p | counting | dest-mac dest-address dest-mask | { lsap lsap-type lsap-type-mask | type protocol-type protocol-type-mask } | source-mac source-address source-mask | time-range time-range-name ] *
6. (Optional.) Add or edit a rule comment. rule rule-id comment text
By default, no rule comment is configured.
7. (Optional.) Add a rule remark. rule [ rule-id ] remark text
8
By default, no rule remark is configured.
Copying an ACL
About this task
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL) has the same properties and content as the source ACL, but uses a different number or name than the source ACL.
Restrictions and guidelines
To successfully copy an ACL, make sure:
•
The destination ACL is the same type as the source ACL.
•
The source ACL already exists, but the destination ACL does not.
Procedure
1. Enter system view. system-view
2. Copy an existing ACL to create a new ACL. acl [ ipv6 | mac ] copy { source-acl-number | name source-acl-name } to
{ dest-acl-number | name dest-acl-name }
Configuring packet filtering with ACLs
About packet filtering with ACLs
This section describes procedures for using an ACL to filtering packets. For example, you can apply an ACL to an interface to filter incoming or outgoing packets.
Applying an ACL to an interface for packet filtering
Restrictions and guidelines
To the same direction of an interface, you can apply a maximum of three ACLs: one IPv4 ACL, one
IPv6 ACL, and one Layer 2 ACL.
The term "interface" in this section collectively refers to Layer 2 Ethernet interfaces, Layer 3 Ethernet interfaces, Layer 3 Ethernet subinterfaces, VLAN interfaces, and VSI interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see
Layer 2 — LAN Switching Configuration Guide ). For information about VSI interfaces, see VX LAN
Configuration Guide .
Procedure
1. Enter system view. system-view
2. Enter interface view.
interface interface-type interface-number
3. Apply an ACL to the interface to filter packets. packet-filter [ ipv6 | mac ] { acl-number | name acl-name } { inbound | outbound } [ hardware-count ]
By default, an interface does not filter packets.
9
Applying an ACL to an Ethernet service instance for packet filtering
Restrictions and guidelines
For information about configuring Ethernet service instances, see MPLS L2VPN in MPLS
Configuration Guide .
Procedure
1. Enter system view. system-view
2. Enter interface view.
Enter Layer 2 Ethernet interface view.
interface interface-type interface-number
Enter Layer 2 aggregate interface view.
interface bridge-aggregation interface-number
3. Create an Ethernet service instance and enter Ethernet service instance view.
service-instance instance-id
4. Apply an ACL to the Ethernet service instance. packet-filter [ ipv6 | mac ] { acl-number | name acl-name } { inbound | outbound } [ hardware-count ]
By default, the system does not filter packets on an Ethernet service instance.
Configuring the applicable scope of packet filtering on a
VLAN interface
About this task
You can configure the packet filtering on a VLAN interface to filter the following packets:
•
Packets forwarded at Layer 3 by the VLAN interface.
•
All packets, including packets forwarded at Layer 3 by the VLAN interface and packets forwarded at Layer 2 by the physical ports associated with the VLAN interface.
Procedure
1. Enter system view. system-view
2. Create a VLAN interface and enter its view. interface vlan-interface vlan-interface-id
If the VLAN interface already exists, you directly enter its view.
By default, no VLAN interface exists.
3. Specify the applicable scope of packet filtering on the VLAN interface. packet-filter filter { route | all }
By default, the packet filtering filters packets forwarded at Layer 3.
10
Configuring logging and SNMP notifications for packet filtering
About this task
You can configure the ACL module to generate log entries or SNMP notifications for packet filtering and output them to the information center or SNMP module at the output interval. When the first packet of a flow matches an ACL rule, the output interval starts. At the end of the interval, the device outputs a log entry or notification to record the number of matching packets and the matched ACL rule during the interval.
For more information about the information center and SNMP, see Network Management and
Monitoring Configuration Guide.
Procedure
1. Enter system view. system-view
2. Set the interval for outputting packet filtering logs or notifications. acl { logging | trap } interval interval
The default setting is 0 minutes. By default, the device does not generate log entries or SNMP notifications for packet filtering.
Setting the packet filtering default action
1. Enter system view. system-view
2. Set the packet filtering default action to deny. packet-filter default deny
By default, the packet filter permits packets that do not match any ACL rule to pass.
Display and maintenance commands for ACL
Execute display commands in any view and reset commands in user view.
Task
Display ACL configuration and match statistics.
Display ACL application information for packet filtering.
Display match statistics for packet filtering ACLs.
Command display acl [ ipv6 | mac ] { acl-number | all | name acl-name } display packet-filter { interface [ interface-type interface-number ] | l2vpn-ac [ interface interface-type interface-number
[ service-instance instance-id ] ] } [ inbound | outbound ] [ slot slot-number ] display packet-filter statistics { interface interface-type interface-number | l2vpn-ac interface interface-type interface-number
service-instance instance-id } { inbound | outbound } [ [ ipv6 | mac ] { acl-number | name acl-name } ] [ brief ]
11
Task
Display the accumulated statistics for packet filtering
ACLs.
Command display packet-filter statistics sum { inbound | outbound } [ ipv6 | mac ] { acl-number | name acl-name } [ brief ]
Display detailed ACL packet filtering information. display packet-filter verbose { interface interface-type interface-number | l2vpn-ac
interface interface-type interface-number service-instance instance-id } { inbound | outbound } [ [ ipv6 | mac ] { acl-number | name acl-name } ] [ slot slot-number ]
Display QoS and ACL resource usage. display qos-acl resource [ slot slot-number ]
Clear ACL statistics.
Clear match statistics for packet filtering ACLs. reset acl [ ipv6 | mac ] counter { acl-number | all | name acl-name } reset packet-filter statistics { interface
[ interface-type interface-number ] | l2vpn-ac
[ interface interface-type interface-number
service-instance instance-id ] } { inbound | outbound } [ [ ipv6 | mac ] { acl-number | name acl-name } ]
ACL configuration examples
Example: Configuring interface-based packet filter
Network configuration
A company interconnects its departments through the device. Configure a packet filter to:
•
Permit access from the President's office at any time to the financial database server.
•
Permit access from the Finance department to the database server only during working hours
(from 8:00 to 18:00) on working days.
•
Deny access from any other department to the database server.
12
Figure 1 Network diagram
Financial database server
192.168.0.100/24
GE1/0/2
Device
GE1/0/1
GE1/0/4
GE1/0/3
President's office
192.168.1.0/24
Financial department
192.168.2.0/24
Marketing department
192.168.3.0/24
Procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<Device> system-view
[Device] time-range work 08:0 to 18:00 working-day
# Create an IPv4 advanced ACL numbered 3000.
[Device] acl advanced 3000
# Configure a rule to permit access from the President's office to the financial database server.
[Device-acl-ipv4-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination
192.168.0.100 0
# Configure a rule to permit access from the Finance department to the database server during working hours.
[Device-acl-ipv4-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination
192.168.0.100 0 time-range work
# Configure a rule to deny access to the financial database server.
[Device-acl-ipv4-adv-3000] rule deny ip source any destination 192.168.0.100 0
[Device-acl-ipv4-adv-3000] quit
# Apply IPv4 advanced ACL 3000 to filter outgoing packets on interface GigabitEthernet 1/0/1.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] packet-filter 3000 outbound
[Device-GigabitEthernet1/0/1] quit
Verifying the configuration
# Verify that a PC in the Finance department can ping the database server during working hours. (All
PCs in this example use Windows XP).
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Reply from 192.168.0.100: bytes=32 time=1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
13
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
# Verify that a PC in the Marketing department cannot ping the database server during working hours.
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
# Display configuration and match statistics for IPv4 advanced ACL 3000 on the device during working hours.
[Device] display acl 3000
Advanced IPv4 ACL 3000, 3 rules,
ACL's step is 5
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100 0
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100 0 time-range work
(Active)
rule 10 deny ip destination 192.168.0.100 0
The output shows that rule 5 is active. Rule 5 and rule 10 have been matched four times as the result of the ping operations.
14
QoS overview
In data communications, Quality of Service (QoS) provides differentiated service guarantees for diversified traffic in terms of bandwidth, delay, jitter, and drop rate, all of which can affect QoS.
QoS manages network resources and prioritizes traffic to balance system resources.
The following section describes typical QoS service models and widely used QoS techniques.
QoS service models
This section describes several typical QoS service models.
Best-effort service model
The best-effort model is a single-service model. The best-effort model is not as reliable as other models and does not guarantee delay-free delivery.
The best-effort service model is the default model for the Internet and applies to most network applications. It uses the First In First Out (FIFO) queuing mechanism.
IntServ model
The integrated service (IntServ) model is a multiple-service model that can accommodate diverse
QoS requirements. This service model provides the most granularly differentiated QoS by identifying and guaranteeing definite QoS for each data flow.
In the IntServ model, an application must request service from the network before it sends data.
IntServ signals the service request with the RSVP. All nodes receiving the request reserve resources as requested and maintain state information for the application flow.
The IntServ model demands high storage and processing capabilities because it requires all nodes along the transmission path to maintain resource state information for each flow. This model is suitable for small-sized or edge networks. However, it is not suitable for large-sized networks, for example, the core layer of the Internet, where billions of flows are present.
DiffServ model
The differentiated service (DiffServ) model is a multiple-service model that can meet diverse QoS requirements. It is easy to implement and extend. DiffServ does not signal the network to reserve resources before sending data, as IntServ does.
QoS techniques in a network
The QoS techniques include the following features:
•
Traffic classification.
•
Traffic policing.
•
Traffic shaping.
•
Rate limit.
•
Congestion management.
•
Congestion avoidance.
15
The following section briefly introduces these QoS techniques.
All QoS techniques in this document are based on the DiffServ model.
Figure 2 Position of the QoS techniques in a network
Traffic direction
Traffic classification
Traffic policing
Traffic policing
WAN
Congestion management
Congestion avoidance
Traffic shaping
Traffic policing
Congestion management
Congestion avoidance
Traffic shaping
Traffic policing
and congestion avoidance mainly implement the following functions:
•
Traffic classification —Uses match criteria to assign packets with the same characteristics to a traffic class. Based on traffic classes, you can provide differentiated services.
•
Traffic policing —Polices flows and imposes penalties to prevent aggressive use of network resources. You can apply traffic policing to both incoming and outgoing traffic of a port.
•
Traffic shaping —Adapts the output rate of traffic to the network resources available on the downstream device to eliminate packet drops. Traffic shaping usually applies to the outgoing traffic of a port.
•
Congestion management —Provides a resource scheduling policy to determine the packet forwarding sequence when congestion occurs. Congestion management usually applies to the outgoing traffic of a port.
•
Congestion avoidance —Monitors the network resource usage. It is usually applied to the outgoing traffic of a port. When congestion worsens, congestion avoidance reduces the queue length by dropping packets.
QoS processing flow in a device
Figure 3 briefly describes how the QoS module processes traffic.
1. Traffic classifier identifies and classifies traffic for subsequent QoS actions.
2. The QoS module takes various QoS actions on classified traffic as configured, depending on the traffic processing phase and network status. For example, you can configure the QoS module to perform the following operations:
Traffic policing for incoming traffic.
Traffic shaping for outgoing traffic.
Congestion avoidance before congestion occurs.
Congestion management when congestion occurs.
16
Figure 3 QoS processing flow
Tokens
Drop
Classify packets
CAR Mark
Other actions
Packets received on the interface
Classification
Token bucket
Traffic policing
Priority marking
Tokens
Drop Drop
Enqueue
Classify packets
CAR
GTS
Other actions
WRED Queuing
Queue 0
Queue 1
Queue 2
Dequeue
Packets sent out of the interface
Classification
Token bucket
Traffic policing
Traffic shaping
Send
Congestion avoidance
Queue N
Queues
Congestion management
QoS configuration approaches
You can configure QoS by using the MQC approach or non-MQC approach.
In the modular QoS configuration (MQC) approach, you configure QoS service parameters by using
QoS policies. A QoS policy defines QoS actions to take on different classes of traffic and can be applied to an object (such as an interface) to control traffic.
In the non-MQC approach, you configure QoS service parameters without using a QoS policy. For example, you can use the rate limit feature to set a rate limit on an interface without using a QoS policy.
17
Configuring a QoS policy
About QoS policies
A QoS policy has the following components:
•
Traffic class —Defines criteria to match packets.
•
Traffic behavior —Defines QoS actions to take on matching packets.
By associating a traffic class with a traffic behavior, a QoS policy can perform the QoS actions on matching packets.
A QoS policy can have multiple class-behavior associations.
QoS policy tasks at a glance
To configure a QoS policy, perform the following tasks:
1.
2.
3.
4.
Applying the QoS policy to an interface
Applying the QoS policy to a VSI
Applying the QoS policy to VLANs
Applying the QoS policy globally
Applying the QoS policy to a user profile
Applying the QoS policy to a control plane
Defining a traffic class
1. Enter system view. system-view
2. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ]
3. (Optional.) Configure a description for the traffic class. description text
By default, no description is configured for a traffic class.
4. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured.
For more information, see the if-match command in ACL and QoS Command Reference .
Defining a traffic behavior
1. Enter system view.
18
system-view
2. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name
3. Configure an action in the traffic behavior.
By default, no action is configured for a traffic behavior.
For more information about configuring an action, see the subsequent chapters for traffic policing, traffic filtering, priority marking, class-based accounting, and so on.
Defining a QoS policy
1. Enter system view. system-view
2. Create a QoS policy and enter QoS policy view. qos policy policy-name
3. Associate a traffic class with a traffic behavior to create a class-behavior association in the QoS policy. classifier classifier-name behavior behavior-name [ mode dcbx |
insert-before before-classifier-name ]
By default, a traffic class is not associated with a traffic behavior.
Repeat this step to create more class-behavior associations.
Parameter
mode dcbx
Description
Specifies that a class-behavior association applies only to DCBX. For more information about DCBX, see Layer 2—LAN Switching
Configuration Guide .
Applying the QoS policy
Application destinations
You can apply a QoS policy to the following destinations:
•
Ethernet service instance —The QoS policy takes effect on the traffic received on the Ethernet service instance.
•
Interface —The QoS policy takes effect on the traffic sent or received on the interface.
•
VSI —The QoS policy takes effect on the traffic received on the VSI.
•
VLAN —The QoS policy takes effect on the traffic sent or received on all ports in the VLAN.
•
Globally —The QoS policy takes effect on the traffic sent or received on all ports.
•
User profile —The QoS policy takes effect on the traffic sent or received by the online users of the user profile.
Restrictions and guidelines for applying a QoS policy
You can modify traffic classes, traffic behaviors, and class-behavior associations in a QoS policy even after it is applied (except that it is applied to a user profile). If a traffic class uses an ACL for traffic classification, you can delete or modify the ACL.
19
If a QoS policy containing a CAR action is applied to multiple interfaces, the actual rate limit that takes effect is the CIR plus the PIR specified in the CAR action multiplied by the number of IRF member devices where the interfaces reside.
Applying the QoS policy to an Ethernet service instance
Restrictions and guidelines
For configuration commands for Ethernet service instances, see MCE Command Reference .
Procedure
1. Enter system view. system-view
2. Enter Layer 2 Ethernet interface view or Layer 2 aggregate interface view.
Enter Layer 2 Ethernet interface view:
interface interface-type interface-number
Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number
3. Create an Ethernet service instance and enter Ethernet service instance view.
service-instance instance-id
4. Apply the QoS policy to the Ethernet service instance.
qos apply policy policy-name inbound
By default, no QoS policy is applied to an Ethernet service instance.
Applying the QoS policy to an interface
Restrictions and guidelines
A QoS policy can be applied to multiple interfaces. However, only one QoS policy can be applied to one direction (inbound or outbound) of an interface.
The QoS policy applied to the outgoing traffic on an interface does not regulate local packets. Local packets refer to critical protocol packets sent by the local system for operation maintenance. The most common local packets include link maintenance, RIP, LDP, and SSH packets.
The term "interface" in this section collectively refers to Layer 2 Ethernet interfaces and Layer 3
Ethernet interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide ).
Procedure
1. Enter system view. system-view
2. Enter interface view. interface interface-type interface-number
3. Apply the QoS policy to the interface.
qos apply policy policy-name { inbound | outbound }
By default, no QoS policy is applied to an interface.
20
Applying the QoS policy to a VSI
Restrictions and guidelines
For VSI configuration commands, see VXLAN Command Reference .
Procedure
1. Enter system view. system-view
2. Enter VSI view. vsi vsi-name [ hub-spoke ]
3. Apply the QoS policy to the VSI.
qos apply policy policy-name inbound
By default, no QoS policy is applied to a VSI.
Applying the QoS policy to VLANs
About this task
You can apply a QoS policy to VLANs to regulate the traffic on all ports of the VLANs.
Restrictions and guidelines
QoS policies cannot be applied to dynamic VLANs, including VLANs created by GVRP.
When you apply a QoS policy to VLANs, the QoS policy is applied to the specified VLANs on all IRF member devices. If the hardware resources of an IRF member device are insufficient, applying a
QoS policy to VLANs might fail on the IRF member device. The system does not automatically roll back the QoS policy configuration already applied to other IRF member devices. To ensure consistency, use the undo qos vlan-policy vlan command to manually remove the QoS policy configuration applied to them.
Procedure
1. Enter system view. system-view
2. Apply the QoS policy to VLANs. qos vlan-policy policy-name vlan vlan-id-list { inbound | outbound }
By default, no QoS policy is applied to a VLAN.
Applying the QoS policy globally
About this task
You can apply a QoS policy globally to the inbound or outbound direction of all ports.
Restrictions and guidelines
If the hardware resources of an IRF member device are insufficient, applying a QoS policy globally might fail on the IRF member device. The system does not automatically roll back the QoS policy configuration already applied to other IRF member devices. To ensure consistency, you must use the undo qos apply policy global command to manually remove the QoS policy configuration applied to them.
Procedure
1. Enter system view.
21
system-view
2. Apply the QoS policy globally.
qos apply policy policy-name global { inbound | outbound
By default, no QoS policy is applied globally.
Applying the QoS policy to a user profile
About this task
When a user profile is configured, you can perform traffic policing based on users. After a user passes authentication, the authentication server sends the name of the user profile associated with the user to the device. The QoS policy configured in user profile view takes effect only when users come online.
Restrictions and guidelines
You can apply a QoS policy to multiple user profiles. In one direction of each user profile, only one policy can be applied. To modify a QoS policy already applied to a direction, first remove the applied
QoS policy.
Procedure
1. Enter system view. system-view
2. Enter user profile view. user-profile profile-name
3. Apply the QoS policy to the user profile. qos apply policy policy-name { inbound | outbound }
By default, no QoS policy is applied to a user profile.
Parameter inbound outbound
Description
Applies a QoS policy to the traffic received by the device from the user profile.
Applies a QoS policy to the traffic sent by the device to the user profile.
Applying the QoS policy to a control plane
About this task
A device provides the user plane and the control plane.
•
User plane —The units at the user plane are responsible for receiving, transmitting, and switching (forwarding) packets, such as various dedicated forwarding chips. They deliver super processing speeds and throughput.
•
Control plane —The units at the control plane are processing units running most routing and switching protocols. They are responsible for protocol packet resolution and calculation, such as CPUs. Compared with user plane units, the control plane units allow for great packet processing flexibility but have lower throughput.
When the user plane receives packets that it cannot recognize or process, it transmits them to the control plane. If the transmission rate exceeds the processing capability of the control plane, the control plane will be busy handling undesired packets. As a result, the control plane will fail to handle legitimate packets correctly or timely. As a result, protocol performance is affected.
22
To address this problem, apply a QoS policy to the control plane to take QoS actions, such as traffic filtering or traffic policing, on inbound traffic. This ensures that the control plane can correctly receive, transmit, and process packets.
Procedure
1. Enter system view. system-view
2. Enter control plane view. control-plane slot slot-number
3. Apply the QoS policy to the control plane. qos apply policy policy-name inbound
By default, no QoS policy is applied to a control plane.
Display and maintenance commands for QoS policies
Execute display commands in any view and reset commands in user view.
Task
Display QoS policy configuration.
Command display qos policy user-defined [ policy-name
[ classifier classifier-name ] ] [ slot slot-number ]
Display information about
QoS policies applied globally.
Display information about
QoS policies applied to interfaces. display qos policy global
[ inbound | outbound ]
[ slot display qos policy interface interface-number ] [ inbound |
[ slot-number interface-type outbound ]
Display information about
QoS policies applied to
Ethernet service instances. display qos policy l2vpn-ac [ interface interface-type interface-number
[ service-instance instance-id ] [ slot slot-number ] ] [ inbound ]
Display information about
QoS policies applied to user profiles. display qos policy user-profile [ name profile-name ] [ user-id user-id ] [ slot slot-number ] [ inbound | outbound ]
]
Display information about
QoS policies applied to VSIs. display qos policy vsi [ name vsi-name ] [ inbound ]
[ slot slot-number ]
Display information about
QoS policies applied to
VLANs. display qos vlan-policy { name policy-name | vlan
[ vlan-id ] } [ slot slot-number ] [ inbound | outbound ]
Display information about the QoS policy applied to a control plane.
Display QoS and ACL resource usage. display qos policy control-plane display qos-acl resource [ slot
slot slot-number slot-number ]
Display traffic behavior configuration. display traffic behavior user-defined
[ behavior-name ] [ slot slot-number ]
23
Task
Display traffic class configuration.
Command display traffic classifier user-defined
[ classifier-name ] [ slot slot-number ]
Clear the statistics for a QoS policy applied globally. reset qos policy global [ inbound | outbound ]
Clear the statistics of the
QoS policy applied in a certain direction of a VLAN. reset qos vlan-policy outbound ]
[ vlan vlan-id ] [ inbound |
24
Configuring priority mapping
About priority mapping
When a packet arrives, a device assigns a set of QoS priority parameters to the packet based on either of the following:
•
A priority field carried in the packet.
•
The port priority of the incoming port.
This process is called priority mapping. During this process, the device can modify the priority of the packet according to the priority mapping rules. The set of QoS priority parameters decides the scheduling priority and forwarding priority of the packet.
Priority mapping is implemented with priority maps and involves the following priorities:
•
802.11e priority.
•
802.1p priority.
•
DSCP.
•
EXP.
•
IP precedence.
•
Local precedence.
•
Drop priority.
About priorities
Priorities include the following types: priorities carried in packets, and priorities locally assigned for scheduling only.
Packet-carried priorities include 802.1p priority, DSCP precedence, IP precedence, and EXP. These priorities have global significance and affect the forwarding priority of packets across the network.
For more information about these priorities, see " Appendixes ."
Locally assigned priorities only have local significance. They are assigned by the device only for scheduling. These priorities include the local precedence, drop priority, and user priority, as follows:
•
Local precedence —Used for queuing. A local precedence value corresponds to an output queue. A packet with higher local precedence is assigned to a higher priority output queue to be preferentially scheduled.
•
Drop priority —Used for making packet drop decisions. Packets with the highest drop priority are dropped preferentially.
•
User priority —Precedence that the device automatically extracts from a priority field of the packet according to its forwarding path. It is a parameter for determining the scheduling priority and forwarding priority of the packet. The user priority represents the following items:
The 802.1p priority for Layer 2 packets.
The IP precedence for Layer 3 packets.
The EXP for MPLS packets.
The device supports only local precedence and drop priority for scheduling.
25
Priority maps
The device provides various types of priority maps. By looking through a priority map, the device decides which priority value to assign to a packet for subsequent packet processing.
The default priority maps (as shown in Appendix B Default priority maps ) are available for priority
mapping. They are adequate in most cases. If a default priority map cannot meet your requirements, you can modify the priority map as required.
Priority mapping configuration methods
You can configure priority mapping by using any of the following methods:
•
Configuring priority trust mode —In this method, you can configure a port to look up a trusted priority type (802.1p, for example) in incoming packets in the priority maps. Then, the system maps the trusted priority to the target priority types and values.
•
Changing port priority —If no packet priority is trusted, the port priority of the incoming port is used. By changing the port priority of a port, you change the priority of the incoming packets on the port.
Priority mapping process
On receiving an Ethernet packet on a port, the switch marks the scheduling priorities (local precedence and drop precedence) for the Ethernet packet. This procedure is done according to the priority trust mode of the receiving port and the 802.1Q tagging status of the packet, as shown in
26
Figure 4 Priority mapping process for an Ethernet packet
Receive a packet on a port
Should the
packet be marked with local precedence and drop priority ?
No
Yes
Mark it with local precedence and drop priority
802.1p in packets
Which priority is trusted on the port?
Port priority
Use port priority as
802.1p priority for priority mapping
No Is the packet
802.1q tagged?
Yes
Look up dot1p-dp and dot1p-lp mapping tables
Look up dot1p-dp and dot1p-lp mapping tables
DSCP in packets
Look up dscp-dp, dscp-dot1p, and dscp-dscp mapping tables
Mark the packet with 802.1p priority, drop priority, and new DSCP precedence
Use port priority as 802.1p priority for priority mapping
Look up dot1p-dp and dot1p-lp mapping tables
Mark the packet with local precedence and drop priority
Mark the packet with local precedence and drop priority
Mark the packet with local precedence and drop priority
Look up dot1p-lp mapping table
Mark the packet with local precedence
Schedule the packet according to its local precedence and drop priority
The switch marks a received MPLS packet with a scheduling priority based on the priority trust mode
and the packet EXP value, as shown in Figure 5 .
27
Figure 5 Priority mapping process for an MPLS packet
Receive a packet with MPLS labels
802.1p or DSCP
Should the
packet be marked with local Yes precedence and drop
priority?
No
Which priority
is trusted on the port?
Port priority
Mark the packet with local precedence and drop priority
Look up expdot1p mapping table
Look up expdot1p mapping table
Use port priority as EXP priority for priority mapping
Mark the packet with 802.1p priority
Mark the packet with 802.1p priority
Look up exp-dot1p mapping table
Look up exp-dp mapping table
Mark the packet with 802.1p priority
Look up dot1p-dp mapping table
Look up dot1p-lp mapping table
Mark the packet with drop priority
Look up dot1p-lp mapping table
Mark the packet with drop priority
Mark the packet with local precedence
Mark the packet with local precedence
Schedule the packet based on its local precedence and drop priority
For information about priority marking, see " Configuring priority marking ."
Priority mapping tasks at a glance
To configure priority mapping, perform the following tasks:
1.
(Optional.) Configuring a priority map
2. Configure a priority mapping method:
Configuring a port to trust packet priority for priority mapping
Changing the port priority of an interface
Configuring a priority map
1. Enter system view.
28
system-view
2. Enter priority map view. qos map-table { dot1p-dp | dot1p-exp | dot1p-lp | dscp-dot1p | dscp-dp | dscp-dscp | exp-dot1p | exp-dp }
3. Configure mappings for the priority map. import import-value-list export export-value
By default, the default priority maps are used. For more information, see
"Appendix B Default priority maps."
If you execute this command multiple times, the most recent configuration takes effect.
Configuring a port to trust packet priority for priority mapping
About this task
You can configure the device to trust a particular priority field carried in packets for priority mapping on ports or globally. When you configure the trusted packet priority type on an interface, use the following available keywords:
• dot1p —Uses the 802.1p priority of received packets for mapping.
• dscp —Uses the DSCP precedence of received IP packets for mapping.
Restrictions and guidelines
The term "interface" in this section collectively refers to Layer 2 and Layer 3 Ethernet interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide ).
Procedure
1. Enter system view. system-view
2. Enter interface view. interface interface-type interface-number
3. Configure the trusted packet priority type. qos trust { dot1p | dscp }
By default, an interface does not trust any packet priority and uses the port priority as the
802.1p priority for mapping.
Changing the port priority of an interface
About this task
If an interface does not trust any packet priority, the device uses its port priority to look for priority parameters for the incoming packets. By changing port priority, you can prioritize traffic received on different interfaces.
Procedure
1. Enter system view. system-view
2. Enter interface view. interface interface-type interface-number
29
3. Set the port priority of the interface. qos priority priority-value
The default setting is 0.
Display and maintenance commands for priority mapping
Execute display commands in any view.
Task
Display priority map configuration.
Display the trusted packet priority type on a port.
Command display qos map-table [ dot1p-dp | dot1p-exp | dot1p-lp | dscp-dot1p | dscp-dp | dscp-dscp | exp-dot1p | exp-dp ] display qos trust interface [ interface-type interface-number ]
Priority mapping configuration examples
Example: Configuring a priority trust mode
Network configuration
•
The 802.1p priority of traffic from Device A to Device C is 3.
•
The 802.1p priority of traffic from Device B to Device C is 1.
Configure Device C to preferentially process packets from Device A to the server when
GigabitEthernet 1/0/3 of Device C is congested.
Figure 6 Network diagram
Device A
GE
Dot
1/0
1p
3
/1
Internet
GE
1/0
/1
GE
1/0
/2
Device C
GE1/0/3
Server
GE
1/0
Dot
/2
1p
1
Device B
Procedure
(Method 1) Configure Device C to trust packet priority
# Configure GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 to trust the 802.1p priority for priority mapping.
30
<DeviceC> system-view
[DeviceC] interface gigabitethernet 1/0/1
[DeviceC-GigabitEthernet1/0/1] qos trust dot1p
[DeviceC-GigabitEthernet1/0/1] quit
[DeviceC] interface gigabitethernet 1/0/2
[DeviceC-GigabitEthernet1/0/2] qos trust dot1p
[DeviceC-GigabitEthernet1/0/2] quit
(Method 2) Configure Device C to trust port priority
# Assign port priority to GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2. Make sure the following requirements are met:
•
The priority of GigabitEthernet 1/0/1 is higher than that of GigabitEthernet 1/0/2.
•
No trusted packet priority type is configured on GigabitEthernet 1/0/1 or GigabitEthernet 1/0/2.
<DeviceC> system-view
[DeviceC] interface gigabitethernet 1/0/1
[DeviceC-GigabitEthernet1/0/1] qos priority 3
[DeviceC-GigabitEthernet1/0/1] quit
[DeviceC] interface gigabitethernet 1/0/2
[DeviceC-GigabitEthernet1/0/2] qos priority 1
[DeviceC-GigabitEthernet1/0/2] quit
Example: Configuring priority mapping tables and priority marking
Network configuration
•
The Marketing department connects to GigabitEthernet 1/0/1 of Device, which sets the 802.1p priority of traffic from the Marketing department to 3.
•
The R&D department connects to GigabitEthernet 1/0/2 of Device, which sets the 802.1p priority of traffic from the R&D department to 4.
•
The Management department connects to GigabitEthernet 1/0/3 of Device, which sets the
802.1p priority of traffic from the Management department to 5.
Configure port priority, 802.1p-to-local mapping table, and priority marking to implement the plan as
Table 2 Configuration plan
Queuing plan
Traffic destination
Internet
Traffic priority order
Public servers
Traffic source
R&D department >
Management department >
Marketing department
Management department >
Marketing department > R&D department
R&D department
Management department
Marketing department
R&D department
Management department
Marketing department
2
6
4
4
2
Output queue
6
Queue priority
High
Medium
Low
Low
High
Medium
31
Figure 7 Network diagram
Internet
Host
Server
Mgmt Dept
Data server
Host
Server
GE1/0/3
GE1/0/5
GE1/0/2
GE1/0/4
Device
GE1/0/1
R&D Dept
Host
Mail server Server
Public servers Marketing Dept
Procedure
1. Configure trusting port priority:
# Set the port priority of GigabitEthernet 1/0/1 to 3.
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] qos priority 3
[Device-GigabitEthernet1/0/1] quit
# Set the port priority of GigabitEthernet 1/0/2 to 4.
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] qos priority 4
[Device-GigabitEthernet1/0/2] quit
# Set the port priority of GigabitEthernet 1/0/3 to 5.
[Device] interface gigabitethernet 1/0/3
[Device-GigabitEthernet1/0/3] qos priority 5
[Device-GigabitEthernet1/0/3] quit
2. Configure the 802.1p-to-local mapping table to map 802.1p priority values 3, 4, and 5 to local precedence values 2, 6, and 4.
This guarantees the R&D department, Management department, and Marketing department decreased priorities to access the public servers.
[Device] qos map-table dot1p-lp
[Device-maptbl-dot1p-lp] import 3 export 2
[Device-maptbl-dot1p-lp] import 4 export 6
[Device-maptbl-dot1p-lp] import 5 export 4
[Device-maptbl-dot1p-lp] quit
32
3. Configure priority marking to mark the packets from Management department, Marketing department, and R&D department to the Internet with 802.1p priority values 4, 5, and 3.
This guarantees the Management department, Marketing department, and R&D department decreased priorities to access the Internet.
# Create ACL 3000, and configure a rule to match HTTP packets.
[Device] acl advanced 3000
[Device-acl-adv-3000] rule permit tcp destination-port eq 80
[Device-acl-adv-3000] quit
# Create a traffic class named http , and use ACL 3000 as a match criterion.
[Device] traffic classifier http
[Device-classifier-http] if-match acl 3000
[Device-classifier-http] quit
# Create a traffic behavior named admin , and configure a marking action for the Management department.
[Device] traffic behavior admin
[Device-behavior-admin] remark dot1p 4
[Device-behavior-admin] quit
# Create a QoS policy named admin , and associate traffic class http with traffic behavior admin in QoS policy admin .
[Device] qos policy admin
[Device-qospolicy-admin] classifier http behavior admin
[Device-qospolicy-admin] quit
# Apply QoS policy admin to the inbound direction of GigabitEthernet 1/0/3.
[Device] interface gigabitethernet 1/0/3
[Device-GigabitEthernet1/0/3] qos apply policy admin inbound
# Create a traffic behavior named market , and configure a marking action for the Marketing department.
[Device] traffic behavior market
[Device-behavior-market] remark dot1p 5
[Device-behavior-market] quit
# Create a QoS policy named market , and associate traffic class http with traffic behavior market in QoS policy market .
[Device] qos policy market
[Device-qospolicy-market] classifier http behavior market
[Device-qospolicy-market] quit
# Apply QoS policy market to the inbound direction of GigabitEthernet 1/0/1.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] qos apply policy market inbound
# Create a traffic behavior named rd , and configure a marking action for the R&D department.
[Device] traffic behavior rd
[Device-behavior-rd] remark dot1p 3
[Device-behavior-rd] quit
# Create a QoS policy named rd , and associate traffic class http with traffic behavior rd in QoS policy rd .
[Device] qos policy rd
[Device-qospolicy-rd] classifier http behavior rd
[Device-qospolicy-rd] quit
# Apply QoS policy rd to the inbound direction of GigabitEthernet 1/0/2.
33
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] qos apply policy rd inbound
34
Configuring traffic policing, GTS, and rate limit
About traffic policing, GTS, and rate limit
Traffic limit helps assign network resources (including bandwidth) and increase network performance. For example, you can configure a flow to use only the resources committed to it in a certain time range. This avoids network congestion caused by burst traffic.
Traffic policing, Generic Traffic Shaping (GTS), and rate limit control the traffic rate and resource usage according to traffic specifications. You can use token buckets for evaluating traffic specifications.
Traffic evaluation and token buckets
Token bucket features
A token bucket is analogous to a container that holds a certain number of tokens. Each token represents a certain forwarding capacity. The system puts tokens into the bucket at a constant rate.
When the token bucket is full, the extra tokens cause the token bucket to overflow.
Evaluating traffic with the token bucket
A token bucket mechanism evaluates traffic by looking at the number of tokens in the bucket. If the number of tokens in the bucket is enough for forwarding the packets:
•
The traffic conforms to the specification (called conforming traffic).
•
The corresponding tokens are taken away from the bucket.
Otherwise, the traffic does not conform to the specification (called excess traffic).
A token bucket has the following configurable parameters:
•
Mean rate at which tokens are put into the bucket, which is the permitted average rate of traffic.
It is usually set to the committed information rate (CIR).
•
Burst size or the capacity of the token bucket. It is the maximum traffic size permitted in each burst. It is usually set to the committed burst size (CBS). The set burst size must be greater than the maximum packet size.
Each arriving packet is evaluated.
Complicated evaluation
You can set two token buckets, bucket C and bucket E, to evaluate traffic in a more complicated environment and achieve more policing flexibility. The following are main mechanisms used for complicated evaluation:
•
Single rate two color —Uses one token bucket and the following parameters:
CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.
CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.
When a packet arrives, the following rules apply:
If bucket C has enough tokens to forward the packet, the packet is colored green.
Otherwise, the packet is colored red.
•
Single rate three color —Uses two token buckets and the following parameters:
35
CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.
CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.
EBS —Size of bucket E minus size of bucket C, which specifies the transient burst of traffic that bucket E can forward. The EBS cannot be 0. The size of E bucket is the sum of the CBS and EBS.
When a packet arrives, the following rules apply:
If bucket C has enough tokens, the packet is colored green.
If bucket C does not have enough tokens but bucket E has enough tokens, the packet is colored yellow.
If neither bucket C nor bucket E has sufficient tokens, the packet is colored red.
•
Two rate three color —Uses two token buckets and the following parameters:
CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.
CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.
PIR —Rate at which tokens are put into bucket E, which specifies the average packet transmission or forwarding rate allowed by bucket E.
EBS —Size of bucket E, which specifies the transient burst of traffic that bucket E can forward.
When a packet arrives, the following rules apply:
If bucket C has enough tokens, the packet is colored green.
If bucket C does not have enough tokens but bucket E has enough tokens, the packet is colored yellow.
If neither bucket C nor bucket E has sufficient tokens, the packet is colored red.
Traffic policing
Traffic policing supports policing the inbound traffic and the outbound traffic.
A typical application of traffic policing is to supervise the specification of traffic entering a network and limit it within a reasonable range. Another application is to "discipline" the extra traffic to prevent aggressive use of network resources by an application. For example, you can limit bandwidth for
HTTP packets to less than 50% of the total. If the traffic of a session exceeds the limit, traffic policing
can drop the packets or reset the IP precedence of the packets. Figure 8 shows an example of
policing outbound traffic on an interface.
36
Figure 8 Traffic policing
Put tokens into the bucket at the set rate
Packets to be sent out this interface
Packets sent
Classify
Token bucket
Drop
Traffic policing is widely used in policing traffic entering the ISP networks. It can classify the policed traffic and take predefined policing actions on each packet depending on the evaluation result:
•
Forwarding the packet if the evaluation result is "conforming."
•
Dropping the packet if the evaluation result is "excess."
•
Forwarding the packet with its precedence re-marked if the evaluation result is "conforming."
GTS
GTS supports shaping the outbound traffic. GTS limits the outbound traffic rate by buffering exceeding traffic. You can use GTS to adapt the traffic output rate on a device to the input traffic rate of its connected device to avoid packet loss.
The differences between traffic policing and GTS are as follows:
•
Packets to be dropped with traffic policing are retained in a buffer or queue with GTS, as shown
in Figure 9 . When enough tokens are in the token bucket, the buffered packets are sent at an
even rate.
•
GTS can result in additional delay and traffic policing does not.
37
Figure 9 GTS
Packets to be sent through this interface
Tokens are put into the bucket at the set rate
Packets sent
Packet classification
Token bucket
Queue
Packets dropped
For example, in Figure 10 , Device B performs traffic policing on packets from Device A and drops
packets exceeding the limit. To avoid packet loss, you can perform GTS on the outgoing interface of
Device A so that packets exceeding the limit are cached in Device A. Once resources are released,
GTS takes out the cached packets and sends them out.
Figure 10 GTS application
Device A Device B
Physical link
Rate limit
Rate limit controls the rate of inbound and outbound traffic. The outbound traffic is taken for example.
The rate limit of an interface specifies the maximum rate for forwarding packets (excluding critical packets).
Rate limit also uses token buckets for traffic control. When rate limit is configured on an interface, a token bucket handles all packets to be sent through the interface for rate limiting. If enough tokens are in the token bucket, packets can be forwarded. Otherwise, packets are put into QoS queues for congestion management. In this way, the traffic passing the interface is controlled.
38
Figure 11 Rate limit implementation
Put tokens to the bucket at the set rate
Packets to be sent
Packets sent
Queue
Token bucket
Buffer
The token bucket mechanism limits traffic rate when accommodating bursts. It allows bursty traffic to be transmitted if enough tokens are available. If tokens are scarce, packets cannot be transmitted until efficient tokens are generated in the token bucket. It restricts the traffic rate to the rate for generating tokens.
Rate limit controls the total rate of all packets on an interface. It is easier to use than traffic policing in controlling the total traffic rate.
Restrictions and guidelines: Traffic policing, GTS, and rate limit configuration
The specified CIR does not take traffic transmitted in interframe gaps into account, and the actually allowed rate on an interface is greater than the specified CIR.
An interframe gap is a time interval for transmitting 12 bits between frames. This gap serves the following roles:
•
Allows the device to differentiate one frame from another.
•
Allows for time for the device to process the current frame and to prepare for receiving the next frame.
Configuring traffic policing
Restrictions and guidelines
The device supports the following application destinations for traffic policing:
•
Interface.
•
VLANs.
•
Globally.
•
User profile.
Procedure
1. Enter system view. system-view
2. Define a traffic class.
39
a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured.
For more information about the if-match command, see ACL and QoS Command
Reference . c. Return to system view. quit
3. Define a traffic behavior. a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Configure a traffic policing action. car cir committed-information-rate [ cbs committed-burst-size [ ebs excess-burst-size ] ] [ green action | red action | yellow action ] * car cir committed-information-rate [ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] [ green action | red action | yellow action ] *
By default, no traffic policing action is configured. c. Return to system view. quit
4. Define a QoS policy. a. Create a QoS policy and enter QoS policy view. qos policy policy-name b. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name
By default, a traffic class is not associated with a traffic behavior. c. Return to system view. quit
5. Apply the QoS policy.
For more information, see " Applying the QoS policy ."
By default, no QoS policy is applied.
Configuring GTS
Restrictions and guidelines
The term "interface" in this section collectively refers to Layer 2 and Layer 3 Ethernet interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide ).
Procedure
1. Enter system view. system-view
2. Enter interface view. interface interface-type interface-number
40
3. Configure GTS for a queue.
qos gts queue queue-id cir committed-information-rate [ cbs committed-burst-size ]
By default, GTS is not configured on an interface.
Configuring the rate limit
Restrictions and guidelines
The term "interface" in this section collectively refers to Layer 2 and Layer 3 Ethernet interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide ).
Procedure
1. Enter system view. system-view
2. Enter interface view. interface interface-type interface-number
3. Configure the rate limit for the interface. qos lr { inbound | outbound } cir committed-information-rate [ cbs committed-burst-size ]
By default, no rate limit is configured on an interface.
Display and maintenance commands for traffic policing, GTS, and rate limit
Execute display commands in any view.
Task
Display GTS configuration and statistics for interfaces.
Display rate limit configuration and statistics.
Display QoS and ACL resource usage.
Command display qos gts interface [ interface-type interface-number ] display qos lr interface [ interface-type interface-number ] display qos-acl resource [ slot slot-number ]
Display traffic behavior configuration. display traffic behavior user-defined
[ behavior-name ]
41
Traffic policing, GTS, and rate limit configuration examples
Example: Configuring traffic policing
Network requirements
•
The server, Host A, and Host B can access the Internet through Device A and Device B.
•
The server, Host A, and GigabitEthernet 1/0/1 of Device A are in the same network segment.
•
Host B and GigabitEthernet 1/0/2 of Device A are in the same network segment.
Perform traffic control for the packets that GigabitEthernet 1/0/1 of Device A receives from the server and Host A using the following guidelines:
•
Limit the rate of packets from the server to 10240 kbps. When the traffic rate is below 10240 kbps, the traffic is forwarded. When the traffic rate exceeds 10240 kbps, the excess packets are marked with DSCP value 0 and then forwarded.
•
Limit the rate of packets from Host A to 2560 kbps. When the traffic rate is below 2560 kbps, the traffic is forwarded. When the traffic rate exceeds 2560 kbps, the excess packets are dropped.
Perform traffic control on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 of Device B using the following guidelines:
•
Limit the incoming traffic rate on GigabitEthernet 1/0/1 to 20480 kbps, and the excess packets are dropped.
•
Limit the outgoing traffic rate on GigabitEthernet 1/0/2 to 10240 kbps, and the excess packets are dropped.
Figure 12 Network diagram
Server
1.1.1.1/8 Ethernet
Host A
1.1.1.2/8 GE1/0/1
Device B
GE1/0/2
Internet
GE1/0/1
Device A
GE1/0/3
Host B
GE1/0/2
Configuration procedure
1. Configure Device A:
# Configure ACL 2001 and ACL 2002 to permit the packets from the server and Host A, respectively.
[DeviceA] acl basic 2001
[DeviceA-acl-ipv4-basic-2001] rule permit source 1.1.1.1 0
[DeviceA-acl-ipv4-basic-2001] quit
[DeviceA] acl basic 2002
[DeviceA-acl-ipv4-basic-2002] rule permit source 1.1.1.2 0
[DeviceA-acl-ipv4-basic-2002] quit
# Create a traffic class named server , and use ACL 2001 as the match criterion.
42
[DeviceA] traffic classifier server
[DeviceA-classifier-server] if-match acl 2001
[DeviceA-classifier-server] quit
# Create a traffic class named host , and use ACL 2002 as the match criterion.
[DeviceA] traffic classifier host
[DeviceA-classifier-host] if-match acl 2002
[DeviceA-classifier-host] quit
# Create a traffic behavior named server , and configure a traffic policing action (CIR 10240 kbps).
[DeviceA] traffic behavior server
[DeviceA-behavior-server] car cir 10240 red remark-dscp-pass 0
[DeviceA-behavior-server] quit
# Create a traffic behavior named host , and configure a traffic policing action (CIR 2560 kbps).
[DeviceA] traffic behavior host
[DeviceA-behavior-host] car cir 2560
[DeviceA-behavior-host] quit
# Create a QoS policy named car , and associate traffic classes server and host with traffic behaviors server and host in QoS policy car , respectively.
[DeviceA] qos policy car
[DeviceA-qospolicy-car] classifier server behavior server
[DeviceA-qospolicy-car] classifier host behavior host
[DeviceA-qospolicy-car] quit
# Apply QoS policy car to the inbound direction of GigabitEthernet 1/0/1.
[DeviceA] interface gigabitethernet 1/0/1
[DeviceA-GigabitEthernet1/0/1] qos apply policy car inbound
2. Configure Device B:
# Create ACL 3001, and configure a rule to match HTTP packets.
<DeviceB> system-view
[DeviceB] acl advanced 3001
[DeviceB-acl-adv-3001] rule permit tcp destination-port eq 80
[DeviceB-acl-adv-3001] quit
# Create a traffic class named http , and use ACL 3001 as a match criterion.
[DeviceB] traffic classifier http
[DeviceB-classifier-http] if-match acl 3001
[DeviceB-classifier-http] quit
# Create a traffic class named class , and configure the traffic class to match all packets.
[DeviceB] traffic classifier class
[DeviceB-classifier-class] if-match any
[DeviceB-classifier-class] quit
# Create a traffic behavior named car_inbound , and configure a traffic policing action (CIR
20480 kbps).
[DeviceB] traffic behavior car_inbound
[DeviceB-behavior-car_inbound] car cir 20480
[DeviceB-behavior-car_inbound] quit
# Create a traffic behavior named car_outbound , and configure a traffic policing action (CIR
10240 kbps).
[DeviceB] traffic behavior car_outbound
[DeviceB-behavior-car_outbound] car cir 10240
43
[DeviceB-behavior-car_outbound] quit
# Create a QoS policy named car_inbound , and associate traffic class class with traffic behavior car_inbound in QoS policy car_inbound .
[DeviceB] qos policy car_inbound
[DeviceB-qospolicy-car_inbound] classifier class behavior car_inbound
[DeviceB-qospolicy-car_inbound] quit
# Create a QoS policy named car_outbound , and associate traffic class http with traffic behavior car_outbound in QoS policy car_outbound .
[DeviceB] qos policy car_outbound
[DeviceB-qospolicy-car_outbound] classifier http behavior car_outbound
[DeviceB-qospolicy-car_outbound] quit
# Apply QoS policy car_inbound to the inbound direction of GigabitEthernet 1/0/1.
[DeviceB] interface gigabitethernet 1/0/1
[DeviceB-GigabitEthernet1/0/1] qos apply policy car_inbound inbound
# Apply QoS policy car_outbound to the outbound direction of GigabitEthernet 1/0/2.
[DeviceB] interface gigabitethernet 1/0/2
[DeviceB-GigabitEthernet1/0/2] qos apply policy car_outbound outbound
44
Configuring congestion management
About congestion management
Cause, negative results, and countermeasure of congestion
Congestion occurs on a link or node when traffic size exceeds the processing capability of the link or node. It is typical of a statistical multiplexing network and can be caused by link failures, insufficient resources, and various other causes.
Figure 13 shows two typical congestion scenarios.
Figure 13 Traffic congestion scenarios
100M
100M 10M 100M 10M
100M > 10M
(1)
50M
(100M + 10M + 50M) > 100M
(2)
Congestion produces the following negative results:
•
Increased delay and jitter during packet transmission.
•
Decreased network throughput and resource use efficiency.
•
Network resource (memory, in particular) exhaustion and even system breakdown.
Congestion is unavoidable in switched networks and multiuser application environments. To improve the service performance of your network, take measures to manage and control it.
The key to congestion management is defining a resource dispatching policy to prioritize packets for forwarding when congestion occurs.
Congestion management methods
Congestion management uses queuing and scheduling algorithms to classify and sort traffic leaving a port.
The device supports the following queuing mechanisms:
•
SP.
•
WRR.
SP queuing
SP queuing is designed for mission-critical applications that require preferential service to reduce the response delay when congestion occurs.
45
Figure 14 SP queuing
Queue 7
High priority
Packets to be sent through this port
Queue 6 Sent packets
Interface
……
Queue 1
Packet classification
Queue scheduling
Sending queue
Queue 0
Low priority
In Figure 14 , SP queuing classifies eight queues on a port into eight classes, numbered 7 to 0 in
descending priority order.
SP queuing schedules the eight queues in the descending order of priority. SP queuing sends packets in the queue with the highest priority first. When the queue with the highest priority is empty, it sends packets in the queue with the second highest priority, and so on. You can assign mission-critical packets to a high priority queue to make sure they are always served first. Common service packets can be assigned to low priority queues to be transmitted when high priority queues are empty.
The disadvantage of SP queuing is that packets in the lower priority queues cannot be transmitted if packets exist in the higher priority queues. In the worst case, lower priority traffic might never get serviced.
WRR queuing
WRR queuing schedules all the queues in turn to ensure that every queue is served for a certain time,
Figure 15 WRR queuing
Queue 0 Weight 1
Packets to be sent through this port Queue 1 Weight 2 Sent packets
Interface
……
Queue N-2 Weight N-1
Packet classification
Queue N-1 Weight N
Queue scheduling
Sending queue
46
Assume a port provides eight output queues. WRR assigns each queue a weight value (represented by w7, w6, w5, w4, w3, w2, w1, or w0). The weight value of a queue decides the proportion of resources assigned to the queue. On a 100 Mbps port, you can set the weight values to 50, 30, 10,
10, 50, 30, 10, and 10 for w7 through w0. In this way, the queue with the lowest priority can get a minimum of 5 Mbps of bandwidth. WRR solves the problem that SP queuing might fail to serve packets in low-priority queues for a long time.
Another advantage of WRR queuing is that when the queues are scheduled in turn, the service time for each queue is not fixed. If a queue is empty, the next queue will be scheduled immediately. This improves bandwidth resource use efficiency.
You can also assign some queues to the SP group and all other queues to the WRR group.
•
If the highest queue ID in the SP group is lower than the lowest queue ID in the WRR group, the
WRR group is scheduled before the SP group. For example, if queue 0 and queue 1 belong to the SP group and queues 2 through 7 belong to the WRR group, queue 0 and queue 1 are not scheduled until all queues in the WRR group become empty.
•
In all other cases, the queues in the SP group with queue IDs higher than the queue in the WRR group with the lowest queue ID are first scheduled, then the queues in the WRR group, and finally the other queues in the SP group. For example, if queues 0, 1, 3, and 4 belong to the SP group and queues 2, 5, 6, and 7 belong to the WRR group, queues 3 and 4 are first scheduled.
When queues 3 and 4 are empty, queues 2, 5, 6, and 7 are scheduled. When queues 2, 5, 6, and 7 are empty, if queue 0 and queue 1 are scheduled.
Congestion management tasks at a glance
To configure congestion management, perform the following tasks:
•
Configuring queuing on an interface
•
Configuring a queue scheduling profile
Configuring queuing on an interface
Restrictions and guidelines for queuing configuration
The term "interface" in this section collectively refers to Layer 2 and Layer 3 Ethernet interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide ).
Configuring SP queuing
1. Enter system view. system-view
2. Enter interface view.
interface interface-type interface-number
3. Configure SP queuing. qos sp
By default, an interface uses byte-count WRR queuing.
47
Configuring WRR queuing
1. Enter system view. system-view
2. Enter interface view.
interface interface-type interface-number
3. Enable WRR queuing. qos wrr weight
By default, an interface uses packet-count WRR queuing.
4. Assign a queue to a WRR group, and configure scheduling parameters for the queue.
qos wrr queue-id group 1 weight schedule-value
By default, all queues on a WRR-enabled interface are in WRR group 1, and queues 0 through
7 have a weight of 1, 2, 3, 4, 5, 9, 13, and 15, respectively.
Configuring SP+WRR queuing
Restrictions and guidelines
To configure the scheduling weight, you must specify the same scheduling unit as specified when enabling WRR queuing.
Procedure
1. Enter system view. system-view
2. Enter interface view.
interface interface-type interface-number
3. Enable byte-count or packet-count WRR queuing. qos wrr weight
By default, an interface uses packet-count WRR queuing.
4. Assign a queue to the SP group.
qos wrr queue-id group sp
By default, all queues on a WRR-enabled interface are in WRR group 1.
5. Assign a queue to a WRR group, and configure a scheduling weight for the queue.
qos wrr queue-id group 1 weight schedule-value
By default, all queues on a WRR-enabled interface are in WRR group 1, and queues 0 through
7 have a weight of 1, 2, 3, 4, 5, 9, 13, and 15, respectively.
Configuring a queue scheduling profile
About queue scheduling profiles
In a queue scheduling profile, you can configure scheduling parameters for each queue. By applying the queue scheduling profile to an interface or session group profile, you can implement congestion management on the interface or session group profile.
Queue scheduling profiles support two queue scheduling algorithms: SP and WRR. In a queue scheduling profile, you can also configure SP+WRR. For information about each scheduling
48
algorithm, see " About congestion management ." When SP and WRR groups are configured in a
queue scheduling profile, Figure 16 shows the scheduling order.
Figure 16 Queue scheduling profile configured with both SP and WRR
Q7 Q6 Q5 Q4 Q3 Q2 Q1 Q0
SP group WRR group 1
•
Queue 7 has the highest priority in the SP group. Its packets are sent preferentially.
•
Queue 5 has the second highest priority in the SP group. Packets in queue 5 are sent when queue 7 is empty.
•
All queues in WRR group 1 are scheduled according to their weights. When queue 7 and queue
5 are empty, WRR group 1 is scheduled.
Restrictions and guidelines for queue scheduling profile configuration
When you configure a queue scheduling profile, follow these restrictions and guidelines:
•
The term "interface" in this section collectively refers to Layer 2 and Layer 3 Ethernet interfaces.
You can use the port link-mode command to configure an Ethernet port as a Layer 2 or
Layer 3 interface (see Layer 2 — LAN Switching Configuration Guide ).
•
Only one queue scheduling profile can be applied to an interface or session group profile.
•
You can modify the scheduling parameters in a queue scheduling profile already applied to an interface, the switching fabric module, or a session group profile.
Configuring a queue scheduling profile
1. Enter system view. system-view
2. Create a queue scheduling profile and enter queue scheduling profile view. qos qmprofile profile-name
3. (Optional.) Configure queue scheduling parameters.
Configure a queue to use SP.
queue queue-id sp
Configure a queue to use WRR.
queue queue-id wrr group group-id { weight | byte-count } schedule-value
By default, all queues in a queue scheduling profile use SP queuing.
Applying a queue scheduling profile
1. Enter system view.
49
system-view
2. Enter interface view.
interface interface-type interface-number
3. Apply a queue scheduling profile to the outbound direction of the interface. qos apply qmprofile profile-name
By default, no queue scheduling profile is applied to an interface.
Example: Configuring a queue scheduling profile
Network configuration
Configure a queue scheduling profile to meet the following requirements on GigabitEthernet 1/0/1:
•
Queue 7 has the highest priority, and its packets are sent preferentially.
•
Queue 0 through queue 6 are in the WRR group and are scheduled according to their packet-count weights, which are 2, 1, 2, 4, 6, 8, and 10, respectively. When queue 7 is empty, the WRR group is scheduled.
Procedure
# Enter system view.
<Sysname> system-view
# Create a queue scheduling profile named qm1 .
[Sysname] qos qmprofile qm1
[Sysname-qmprofile-qm1]
# Configure queue 7 to use SP queuing.
[Sysname-qmprofile-qm1] queue 7 sp
# Assign queue 0 through queue 6 to WRR group 1, with their packet-count weights as 2, 1, 2, 4, 6,
8, and 10, respectively.
[Sysname-qmprofile-qm1] queue 0 wrr group 1 weight 2
[Sysname-qmprofile-qm1] queue 1 wrr group 1 weight 1
[Sysname-qmprofile-qm1] queue 2 wrr group 1 weight 2
[Sysname-qmprofile-qm1] queue 3 wrr group 1 weight 4
[Sysname-qmprofile-qm1] queue 4 wrr group 1 weight 6
[Sysname-qmprofile-qm1] queue 5 wrr group 1 weight 8
[Sysname-qmprofile-qm1] queue 6 wrr group 1 weight 10
[Sysname-qmprofile-qm1] quit
# Apply queue scheduling profile qm1 to GigabitEthernet 1/0/1.
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] qos apply qmprofile qm1
After the configuration is completed, GigabitEthernet 1/0/1 performs queue scheduling as specified in queue scheduling profile qm1 .
Display and maintenance commands for congestion management
Execute display commands in any view.
50
Task
Display the configuration of queue scheduling profiles.
Command display qos qmprofile configuration
[ profile-name ] [ slot slot-number ]
Display the queue scheduling profiles applied to interfaces. display qos qmprofile interface interface-number ]
[ interface-type
Display outbound queue-based traffic statistics for interfaces. display qos queue-statistics interface outbound
Display SP queuing configuration. display qos queue sp interface [ interface-type interface-number ]
Display WRR queuing configuration. display qos queue wrr interface [ interface-type interface-number ]
51
Configuring congestion avoidance
About congestion avoidance
Avoiding congestion before it occurs is a proactive approach to improving network performance. As a flow control mechanism, congestion avoidance:
•
Actively monitors network resources (such as queues and memory buffers).
•
Drops packets when congestion is expected to occur or deteriorate.
When dropping packets from a source end, congestion avoidance cooperates with the flow control mechanism at the source end to regulate the network traffic size. The combination of the local packet drop policy and the source-end flow control mechanism implements the following functions:
•
Maximizes throughput and network use efficiency.
•
Minimizes packet loss and delay.
Tail drop
Congestion management techniques drop all packets that are arriving at a full queue. This tail drop mechanism results in global TCP synchronization. If packets from multiple TCP connections are dropped, these TCP connections go into the state of congestion avoidance and slow start to reduce traffic. However, traffic peak occurs later. Consequently, the network traffic jitters all the time.
RED and WRED
You can use Random Early Detection (RED) or Weighted Random Early Detection (WRED) to avoid global TCP synchronization.
Both RED and WRED avoid global TCP synchronization by randomly dropping packets. When the sending rates of some TCP sessions slow down after their packets are dropped, other TCP sessions remain at high sending rates. Link bandwidth is efficiently used, because TCP sessions at high sending rates always exist.
The RED or WRED algorithm sets an upper threshold and lower threshold for each queue, and processes the packets in a queue as follows:
•
When the queue size is shorter than the lower threshold, no packet is dropped.
•
When the queue size reaches the upper threshold, all subsequent packets are dropped.
•
When the queue size is between the lower threshold and the upper threshold, the received packets are dropped at random. The drop probability in a queue increases along with the queue size under the maximum drop probability.
If the current queue size is compared with the upper threshold and lower threshold to determine the drop policy, burst traffic is not fairly treated. To solve this problem, WRED compares the average queue size with the upper threshold and lower threshold to determine the drop probability.
The average queue size reflects the queue size change trend but is not sensitive to burst queue size changes, and burst traffic can be fairly treated.
52
Relationship between WRED and queuing mechanisms
Figure 17 Relationship between WRED and queuing mechanisms
WRED drop
Queue 1 weight 1
Packets to be sent through this interface
Queue 2 weight 2 Packets sent
Classify
……
Interface
……
Queue N-1 weight N-1
Schedule Sending queue
Queue N weight N
Packets dropped
ECN
By dropping packets, WRED alleviates the influence of congestion on the network. However, the network resources for transmitting packets from the sender to the device which drops the packets are wasted. When congestion occurs, it is a better idea to perform the following actions:
•
Inform the sender of the congestion status.
•
Have the sender proactively slow down the packet sending rate or decrease the window size of packets.
This better utilizes the network resources.
RFC 2482 defined an end-to-end congestion notification mechanism named Explicit Congestion
Notification (ECN). ECN uses the DS field in the IP header to mark the congestion status along the packet transmission path. An ECN-capable terminal can determine whether congestion occurs on the transmission path according to the packet contents. Then, it adjusts the packet sending speed to avoid deteriorating congestion. ECN defines the last two bits (ECN field) in the DS field of the IP header as follows:
•
Bit 6 indicates whether the sending terminal device supports ECN, and is called the
ECN-Capable Transport (ECT) bit.
•
Bit 7 indicates whether the packet has experienced congestion along the transmission path, and is called the Congestion Experienced (CE) bit.
For more information about the DS field, see " Appendixes ."
In actual applications, the following packets are considered as packets that an ECN-capable endpoint transmits:
•
Packets with ECT set to 1 and CE set to 0.
•
Packets with ECT set to 0 and CE set to 1.
To enable ECN, do not specify ToS field bit 6 as the flag bit in iNQA, and vice versa. For more information about iNQA, see Network Management and Monitoring Configuration Guide .
After you enable ECN on a device, congestion management processes packets as follows:
53
•
When the average queue size is below the lower threshold, no packet is dropped, and the ECN fields of packets are not identified or marked.
•
When the average queue size is between the lower threshold and the upper threshold, the device performs the following operations: a. Picks out packets to be dropped according to the drop probability. b. Examines the ECN fields of these packets and determines whether to drop these packets.
If the ECN field shows that the packet is sent out of ECN-capable terminal, the device performs the following operations:
−
Sets both the ECT bit and the CE bit to 1.
−
Forwards the packet.
If both the ECT bit and the CE bit are 1 in the packet, the device forwards the packet without modifying the ECN field. The combination of ECT bit 1 and CE bit 1 indicates that the packet has experienced congestion along the transmission path.
If both the ECT bit and the CE bit is 0 in the packet, the device drops the packet.
•
When the average queue size exceeds the upper threshold, the device drops the packet, regardless of whether the packet is sent from an ECN-capable terminal.
WRED parameters
Determine the following parameters before configuring WRED:
•
Upper threshold and lower threshold —When the average queue size is smaller than the lower threshold, packets are not dropped. When the average queue size is between the lower threshold and the upper threshold, the packets are dropped at random. The longer the queue, the higher the drop probability. When the average queue size exceeds the upper threshold, subsequent packets are dropped.
•
Drop precedence —A parameter used for packet drop. The value 0 corresponds to green packets, the value 1 corresponds to yellow packets, and the value 2 corresponds to red packets.
Red packets are dropped preferentially.
•
Exponent for average queue size calculation —The greater the exponent, the less sensitive the average queue size is to real-time queue size changes. The formula for calculating the average queue size is:
Average queue size = ( previous average queue size x (1 – 2
–n
) ) + (current queue size x 2
–n
), where n is the exponent.
•
Drop probability —Drop probability in percentage. The greater the value, the higher the drop probability. (Applicable when you configure a WRED table on an interface.)
Configuring and applying a queue-based WRED table
Restrictions and guidelines
By using a WRED table, WRED randomly drops packets during congestion based on the queues that hold packets.
One WRED table can be applied to multiple interfaces. You can modify the parameters of a WRED table applied to an interface, but you cannot delete the WRED table.
The term "interface" in this section collectively refers to Layer 2 and Layer 3 Ethernet interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2 — LAN Switching Configuration Guide ).
54
Procedure
1. Enter system view. system-view
2. Create a WRED table and enter its view.
qos wred queue table table-name
3. (Optional.) Set the WRED exponent for average queue size calculation. queue queue-id weighting-constant exponent
The default setting is 9.
4. (Optional.) Configure the other WRED parameters. queue queue-id [ drop-level drop-level ] low-limit low-limit high-limit high-limit [ discard-probability discard-prob ]
By default, the lower limit is 100, the higher limit is 1000, and the drop probability is 10%.
5. (Optional.) Enable ECN for a queue. queue queue-id ecn
By default, ECN is disabled for a queue.
To enable ECN, do not specify ToS field bit 6 as the flag bit in iNQA, and vice versa. For more information about iNQA, see Network Management and Monitoring Configuration Guide .
6. Return to system view. quit
7. Enter interface view. interface interface-type interface-number
8. Apply the WRED table to the interface. qos wred apply [ table-name ]
By default, no WRED table is applied to an interface, and tail drop is used on an interface.
Example: Configuring and applying a queue-based WRED table
Network configuration
Apply a WRED table to GigabitEthernet 1/0/2, so that the packets are dropped as follows when congestion occurs:
•
For the interface to preferentially forward higher-priority traffic, set a lower drop probability for a queue with a greater queue number. Set different drop parameters for queue 0, queue 3, and queue 7.
•
Drop packets according to their colors.
In queue 0, set the drop probability to 25%, 50%, and 75% for green, yellow, and red packets, respectively.
In queue 3, set the drop probability to 5%, 10%, and 25% for green, yellow, and red packets, respectively.
In queue 7, set the drop probability to 1%, 5%, and 10% for green, yellow, and red packets, respectively.
•
Enable ECN for queue 7.
55
Procedure
# Configure a queue-based WRED table, and set different drop parameters for packets with different drop levels in different queues.
<Sysname> system-view
[Sysname] qos wred queue table queue-table1
[Sysname-wred-table-queue-table1] queue 0 drop-level 0 low-limit 128 high-limit 512 discard-probability 25
[Sysname-wred-table-queue-table1] queue 0 drop-level 1 low-limit 128 high-limit 512 discard-probability 50
[Sysname-wred-table-queue-table1] queue 0 drop-level 2 low-limit 128 high-limit 512 discard-probability 75
[Sysname-wred-table-queue-table1] queue 3 drop-level 0 low-limit 256 high-limit 640 discard-probability 5
[Sysname-wred-table-queue-table1] queue 3 drop-level 1 low-limit 256 high-limit 640 discard-probability 10
[Sysname-wred-table-queue-table1] queue 3 drop-level 2 low-limit 256 high-limit 640 discard-probability 25
[Sysname-wred-table-queue-table1] queue 7 drop-level 0 low-limit 512 high-limit 1024 discard-probability 1
[Sysname-wred-table-queue-table1] queue 7 drop-level 1 low-limit 512 high-limit 1024 discard-probability 5
[Sysname-wred-table-queue-table1] queue 7 drop-level 2 low-limit 512 high-limit 1024 discard-probability 10
[Sysname-wred-table-queue-table1] queue 7 ecn
[Sysname-wred-table-queue-table1] quit
# Apply the queue-based WRED table to GigabitEthernet 1/0/2.
[Sysname] interface gigabitethernet 1/0/2
[Sysname-GigabitEthernet1/0/2] qos wred apply queue-table1
[Sysname-GigabitEthernet1/0/2] quit
Display and maintenance commands for WRED
Execute display commands in any view.
Task
Display WRED configuration and statistics for an interface.
Display the configuration of a
WRED table or all WRED tables.
Command display qos wred interface [ interface-type interface-number ] display qos wred table [ name table-name ] [ slot slot-number ]
56
Configuring traffic filtering
About traffic filtering
You can filter in or filter out traffic of a class by associating the class with a traffic filtering action. For example, you can filter packets sourced from an IP address according to network status.
Restrictions and guidelines: Traffic filtering configuration
The device supports the following application destinations for traffic filtering:
•
Interface.
•
VLANs.
•
Globally.
•
User profile.
Procedure
1. Enter system view. system-view
2. Define a traffic class. a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured.
For more information about configuring match criteria, see ACL and QoS Command
Reference . c. Return to system view. quit
3. Define a traffic behavior. a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Configure the traffic filtering action. filter { deny | permit }
By default, no traffic filtering action is configured. c. Return to system view. quit
4. Define a QoS policy. a. Create a QoS policy and enter QoS policy view. qos policy policy-name b. Associate the traffic class with the traffic behavior in the QoS policy.
57
classifier classifier-name behavior behavior-name
By default, a traffic class is not associated with a traffic behavior. c. Return to system view. quit
5. Apply the QoS policy.
For more information, see " Applying the QoS policy ."
By default, no QoS policy is applied.
6. (Optional.) Display the traffic filtering configuration. display traffic behavior user-defined [ behavior-name ]
This command is available in any view.
Traffic filtering configuration examples
Example: Configuring traffic filtering
Network configuration
As shown in Figure 18 , configure traffic filtering on GigabitEthernet 1/0/1 to deny the incoming
packets with destination port number 21.
Figure 18 Network diagram
Host
Device
GE1/0/1
Procedure
# Create advanced ACL 3000, and configure a rule to match packets with destination port number
21.
<Device> system-view
[Device] acl advanced 3000
[Device-acl-ipv4-adv-3000] rule 0 permit tcp destination-port eq 21
[Device-acl-ipv4-adv-3000] quit
# Create a traffic class named classifier_1 , and use ACL 3000 as the match criterion in the traffic class.
[Device] traffic classifier classifier_1
[Device-classifier-classifier_1] if-match acl 3000
[Device-classifier-classifier_1] quit
# Create a traffic behavior named behavior_1 , and configure the traffic filtering action to drop packets.
[Device] traffic behavior behavior_1
[Device-behavior-behavior_1] filter deny
[Device-behavior-behavior_1] quit
# Create a QoS policy named policy , and associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.
[Device] qos policy policy
[Device-qospolicy-policy] classifier classifier_1 behavior behavior_1
[Device-qospolicy-policy] quit
58
# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] qos apply policy policy inbound
59
Configuring protocol packet rate limiting
About protocol packet rate limiting
The protocol packet processing rate of a CPU is limited. When a large number of protocol packets are sent to the CPU, the CPU might be occupied by the protocol packets and cannot process other tasks. The protocol packet rate limiting feature limits the rate of protocol packets sent to the CPU, and it guarantees the normal operation of the CPU.
Procedure
1. Enter system view. system-view
2. Define a traffic class. a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion. if-match match-criteria
By default, no match criteria are configured.
For more information, see the if-match command in ACL and QoS Command
Reference . c. Return to system view. quit
3. Define a traffic behavior. a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Configure protocol packet rate limiting. packet-rate { value | attack-defense-threshold threshold-value }
*
By default, protocol packet rate limiting is not configured. c. Return to system view. quit
4. Define a QoS policy. a. Create a QoS policy and enter QoS policy view. qos policy policy-name b. Associate the class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name
By default, a class is not associated with any behavior. c. Return to system view. quit
5. Apply the QoS policy to a control plane.
For more information, see " Applying the QoS policy to a control plane ."
By default, no QoS policy is applied to a control plane.
60
6. (Optional.) Display the protocol packet rate limiting configuration. display traffic behavior user-defined [ behavior-name ]
This command is available in any view.
61
Configuring priority marking
About priority marking
Priority marking sets the priority fields or flag bits of packets to modify the priority of packets. For example, you can use priority marking to set IP precedence or DSCP for a class of IP packets to control the forwarding of these packets.
To configure priority marking to set the priority fields or flag bits for a class of packets, perform the following tasks:
1. Configure a traffic behavior with a priority marking action.
2. Associate the traffic class with the traffic behavior.
Configuring priority marking
Restrictions and guidelines
The device supports the following application destinations for priority marking:
•
Interface.
•
VLANs.
•
Globally.
•
User profile.
Procedure
1. Enter system view. system-view
2. Define a traffic class. a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured.
For more information about the if-match command, see ACL and QoS Command
Reference . c. Return to system view. quit
3. Define a traffic behavior. a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Configure a priority marking action.
For configurable priority marking actions, see the remark commands in ACL and QoS
Command Reference . c. Return to system view. quit
62
4. Define a QoS policy. a. Create a QoS policy and enter QoS policy view. qos policy policy-name b. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name
By default, a traffic class is not associated with a traffic behavior. c. Return to system view. quit
5. Apply the QoS policy.
For more information, see " Applying the QoS policy ."
By default, no QoS policy is applied.
6. (Optional.) Display the priority marking configuration. display traffic behavior user-defined [ behavior-name ]
This command is available in any view.
Priority marking configuration examples
Example: Configuring priority marking
Network configuration
As shown in Figure 19 , configure priority marking on the device to meet the following requirements:
Traffic source
Host A, B
Host A, B
Destination
Data server
Mail server
Host A, B
Figure 19 Network diagram
File server
Processing priority
High
Medium
Low
Internet
Host A Data server
192.168.0.1/24
GE1/0/1 GE1/0/2 Mail server
192.168.0.2/24
Host B
Device
File server
192.168.0.3/24
Procedure
# Create advanced ACL 3000, and configure a rule to match packets with destination IP address
192.168.0.1.
<Device> system-view
[Device] acl advanced 3000
63
[Device-acl-ipv4-adv-3000] rule permit ip destination 192.168.0.1 0
[Device-acl-ipv4-adv-3000] quit
# Create advanced ACL 3001, and configure a rule to match packets with destination IP address
192.168.0.2.
[Device] acl advanced 3001
[Device-acl-ipv4-adv-3001] rule permit ip destination 192.168.0.2 0
[Device-acl-ipv4-adv-3001] quit
# Create advanced ACL 3002, and configure a rule to match packets with destination IP address
192.168.0.3.
[Device] acl advanced 3002
[Device-acl-ipv4-adv-3002] rule permit ip destination 192.168.0.3 0
[Device-acl-ipv4-adv-3002] quit
# Create a traffic class named classifier_dbserver , and use ACL 3000 as the match criterion in the traffic class.
[Device] traffic classifier classifier_dbserver
[Device-classifier-classifier_dbserver] if-match acl 3000
[Device-classifier-classifier_dbserver] quit
# Create a traffic class named classifier_mserver , and use ACL 3001 as the match criterion in the traffic class.
[Device] traffic classifier classifier_mserver
[Device-classifier-classifier_mserver] if-match acl 3001
[Device-classifier-classifier_mserver] quit
# Create a traffic class named classifier_fserver , and use ACL 3002 as the match criterion in the traffic class.
[Device] traffic classifier classifier_fserver
[Device-classifier-classifier_fserver] if-match acl 3002
[Device-classifier-classifier_fserver] quit
# Create a traffic behavior named behavior_dbserver , and configure the action of setting the local precedence value to 4.
[Device] traffic behavior behavior_dbserver
[Device-behavior-behavior_dbserver] remark local-precedence 4
[Device-behavior-behavior_dbserver] quit
# Create a traffic behavior named behavior_mserver , and configure the action of setting the local precedence value to 3.
[Device] traffic behavior behavior_mserver
[Device-behavior-behavior_mserver] remark local-precedence 3
[Device-behavior-behavior_mserver] quit
# Create a traffic behavior named behavior_fserver , and configure the action of setting the local precedence value to 2.
[Device] traffic behavior behavior_fserver
[Device-behavior-behavior_fserver] remark local-precedence 2
[Device-behavior-behavior_fserver] quit
# Create a QoS policy named policy_server , and associate traffic classes with traffic behaviors in the QoS policy.
[Device] qos policy policy_server
[Device-qospolicy-policy_server] classifier classifier_dbserver behavior behavior_dbserver
64
[Device-qospolicy-policy_server] classifier classifier_mserver behavior behavior_mserver
[Device-qospolicy-policy_server] classifier classifier_fserver behavior behavior_fserver
[Device-qospolicy-policy_server] quit
# Apply QoS policy policy_server to the incoming traffic of GigabitEthernet 1/0/1.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] qos apply policy policy_server inbound
[Device-GigabitEthernet1/0/1] quit
65
Configuring nesting
About nesting
Nesting adds a VLAN tag to the matching packets to allow the VLAN-tagged packets to pass through the corresponding VLAN. For example, you can add an outer VLAN tag to packets from a customer network to a service provider network. This allows the packets to pass through the service provider network by carrying a VLAN tag assigned by the service provider.
Restrictions and guidelines: Nesting configuration
The device supports applying nesting to the inbound direction of an interface.
Do not enable QinQ and apply a QoS policy containing a nesting action on the same interface.
Otherwise, QinQ or the QoS policy does not take effect.
To use the nesting action to add an outer VLAN tag to packets with the specified VLAN ID, you must use the if-match customer-vlan-id vlan-id-list command to match the single-tagged packets.
Procedure
1. Enter system view. system-view
2. Define a traffic class. a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured for a traffic class.
For more information about the match criteria, see the if-match command in ACL and
QoS Command Reference . c. Return to system view. quit
3. Define a traffic behavior. a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Configure an outer VLAN tag adding action.
nest top-most vlan vlan-id
By default, no outer VLAN tag adding action is configured for a traffic behavior. c. Return to system view. quit
4. Define a QoS policy. a. Create a QoS policy and enter QoS policy view. qos policy policy-name b. Associate the traffic class with the traffic behavior in the QoS policy.
66
classifier classifier-name behavior behavior-name
By default, a traffic class is not associated with a traffic behavior. c. Return to system view. quit
5. Apply the QoS policy.
For more information, see " Applying the QoS policy ."
By default, no QoS policy is applied.
6. (Optional.) Display the nesting configuration. display traffic behavior user-defined [ behavior-name ]
This command is available in any view.
Nesting configuration examples
Example: Configuring nesting
Network configuration
•
Site 1 and Site 2 in VPN A are two branches of a company. They use VLAN 5 to transmit traffic.
•
Because Site 1 and Site 2 are located in different areas, the two sites use the VPN access service of a service provider. The service provider assigns VLAN 100 to the two sites.
Configure nesting, so that the two branches can communicate through the service provider network.
Figure 20 Network diagram
PE 1
GE1/0/1
Public network
GE1/0/2
VLAN 100 VLAN 5 Data
IP network
GE1/0/2
VLAN 100 VLAN 5 Data
PE 2
GE1/0/1
VLAN 5 Data VLAN 5 Data
CE 1
VLAN 5
VPN A
Site 1
VPN A
Site 2
CE 2
Procedure
1. Configuring PE 1:
# Create a traffic class named test to match traffic with VLAN ID 5.
<PE1> system-view
[PE1] traffic classifier test
[PE1-classifier-test] if-match customer-vlan-id 5
[PE1-classifier-test] quit
# Configure an action to add outer VLAN tag 100 in traffic behavior test .
67
[PE1] traffic behavior test
[PE1-behavior-test] nest top-most vlan 100
[PE1-behavior-test] quit
# Create a QoS policy named test , and associate class test with behavior test in the QoS policy.
[PE1] qos policy test
[PE1-qospolicy-test] classifier test behavior test
[PE1-qospolicy-test] quit
# Configure the downlink port (GigabitEthernet 1/0/1) as a hybrid port, and assign the port to
VLAN 100 as an untagged member.
[PE1] interface gigabitethernet 1/0/1
[PE1-GigabitEthernet1/0/1] port link-type hybrid
[PE1-GigabitEthernet1/0/1] port hybrid vlan 100 untagged
# Apply QoS policy test to the incoming traffic of GigabitEthernet 1/0/1.
[PE1-GigabitEthernet1/0/1] qos apply policy test inbound
[PE1-GigabitEthernet1/0/1] quit
# Configure the uplink port (GigabitEthernet 1/0/2) as a trunk port, and assign it to VLAN 100.
[PE1] interface gigabitethernet 1/0/2
[PE1-GigabitEthernet1/0/2] port link-type trunk
[PE1-GigabitEthernet1/0/2] port trunk permit vlan 100
[PE1-GigabitEthernet1/0/2] quit
2. Configuring PE 2:
Configure PE 2 in the same way PE 1 is configured.
68
Configuring traffic redirecting
About traffic redirecting
Traffic redirecting redirects packets matching the specified match criteria to a location for processing.
You can redirect packets to the following destinations:
•
CPU.
•
Interface.
Restrictions and guidelines: Traffic redirecting configuration
•
The device supports the following application destinations in the inbound direction for traffic redirecting:
Interface.
VLANs.
Globally.
User profile.
•
If you execute the redirect command multiple times, the most recent configuration takes effect.
•
For traffic redirecting to an Ethernet interface, the switch does not display the redirecting action after the interface module or interface expansion card that hosts the interface is removed. After the interface module or interface expansion card is reinserted, the switch can display the redirecting action.
Procedure
1. Enter system view. system-view
2. Define a traffic class. a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured for a traffic class.
For more information about the match criteria, see the if-match command in ACL and
QoS Command Reference . c. Return to system view. quit
3. Define a traffic behavior. a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Configure a traffic redirecting action.
69
redirect { cpu | interface interface-type interface-number }
By default, no traffic redirecting action is configured for a traffic behavior. c. Return to system view. quit
4. Define a QoS policy. a. Create a QoS policy and enter QoS policy view. qos policy policy-name b. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name
By default, a traffic class is not associated with a traffic behavior. c. Return to system view. quit
5. Apply the QoS policy.
For more information, see " Applying the QoS policy ."
By default, no QoS policy is applied.
6. (Optional.) Display traffic redirecting configuration. display traffic behavior user-defined [ behavior-name ]
This command is available in any view.
Traffic redirecting configuration examples
Example: Configuring traffic redirecting
Network configuration
•
Device A is connected to Device B through two links. Device A and Device B are each connected to other devices.
•
GigabitEthernet 1/0/1 of Device A is a trunk port and belongs to VLAN 200 and VLAN 201.
•
GigabitEthernet 1/0/2 of Device A and GigabitEthernet 1/0/2 of Device B belong to VLAN 200.
•
GigabitEthernet 1/0/3 of Device A and GigabitEthernet 1/0/3 of Device B belong to VLAN 201.
•
On Device A, the IP address of VLAN-interface 200 is 200.1.1.1/24, and that of VLAN-interface
201 is 201.1.1.1/24.
•
On Device B, the IP address of VLAN-interface 200 is 200.1.1.2/24, and that of VLAN-interface
201 is 201.1.1.2/24.
Configure the actions of redirecting traffic to an interface to meet the following requirements:
•
Packets with source IP address 2.1.1.1 received on GigabitEthernet 1/0/1 of Device A are forwarded to GigabitEthernet 1/0/2.
•
Packets with source IP address 2.1.1.2 received on GigabitEthernet 1/0/1 of Device A are forwarded to GigabitEthernet 1/0/3.
•
Other packets received on GigabitEthernet 1/0/1 of Device A are forwarded according to the routing table.
70
Figure 21 Network diagram
GE1/0/1
Device A
GE1/0/2
VLAN 200
Vlan-int200
200.1.1.1/24
GE1/0/2
VLAN 200
Vlan-int200
200.1.1.2/24
Device B
GE1/0/1
GE1/0/3
VLAN 201
Vlan-int201
201.1.1.1/24
GE1/0/3
VLAN 201
Vlan-int201
201.1.1.2/24
Procedure
# Create basic ACL 2000, and configure a rule to match packets with source IP address 2.1.1.1.
<DeviceA> system-view
[DeviceA] acl basic 2000
[DeviceA-acl-ipv4-basic-2000] rule permit source 2.1.1.1 0
[DeviceA-acl-ipv4-basic-2000] quit
# Create basic ACL 2001, and configure a rule to match packets with source IP address 2.1.1.2.
[DeviceA] acl basic 2001
[DeviceA-acl-ipv4-basic-2001] rule permit source 2.1.1.2 0
[DeviceA-acl-ipv4-basic-2001] quit
# Create a traffic class named classifier_1 , and use ACL 2000 as the match criterion in the traffic class.
[DeviceA] traffic classifier classifier_1
[DeviceA-classifier-classifier_1] if-match acl 2000
[DeviceA-classifier-classifier_1] quit
# Create a traffic class named classifier_2 , and use ACL 2001 as the match criterion in the traffic class.
[DeviceA] traffic classifier classifier_2
[DeviceA-classifier-classifier_2] if-match acl 2001
[DeviceA-classifier-classifier_2] quit
# Create a traffic behavior named behavior_1 , and configure the action of redirecting traffic to
GigabitEthernet 1/0/2.
[DeviceA] traffic behavior behavior_1
[DeviceA-behavior-behavior_1] redirect interface gigabitethernet 1/0/2
[DeviceA-behavior-behavior_1] quit
# Create a traffic behavior named behavior_2 , and configure the action of redirecting traffic to
GigabitEthernet 1/0/3.
[DeviceA] traffic behavior behavior_2
[DeviceA-behavior-behavior_2] redirect interface gigabitethernet 1/0/3
[DeviceA-behavior-behavior_2] quit
# Create a QoS policy named policy .
[DeviceA] qos policy policy
# Associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.
[DeviceA-qospolicy-policy] classifier classifier_1 behavior behavior_1
# Associate traffic class classifier_2 with traffic behavior behavior_2 in the QoS policy.
[DeviceA-qospolicy-policy] classifier classifier_2 behavior behavior_2
[DeviceA-qospolicy-policy] quit
# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.
71
[DeviceA] interface gigabitethernet 1/0/1
[DeviceA-GigabitEthernet1/0/1] qos apply policy policy inbound
72
Configuring global CAR
About global CAR
Global committed access rate (CAR) is an approach to policing traffic flows globally. It adds flexibility to common CAR where traffic policing is performed only on a per-traffic class or per-interface basis.
In this approach, CAR actions are created in system view and each can be used to police multiple traffic flows as a whole.
Global CAR provides the following CAR actions: aggregate CAR and hierarchical CAR.
Aggregate CAR
An aggregate CAR action is created globally. It can be directly applied to interfaces or used in the traffic behaviors associated with different traffic classes to police multiple traffic flows as a whole.
The total rate of the traffic flows must conform to the traffic policing specifications set in the aggregate CAR action.
Hierarchical CAR
A hierarchical CAR action is created globally. It must be used in conjunction with a common CAR or aggregate CAR action. With a hierarchical CAR action, you can limit the total traffic of multiple traffic classes.
A hierarchical CAR action can be used in the common or aggregate CAR action for a traffic class in either AND mode or OR mode.
•
In AND mode, the rate of the traffic class is strictly limited under the common or aggregate CAR.
This mode applies to flows that must be strictly rate limited.
•
In OR mode, the traffic class can use idle bandwidth of other traffic classes associated with the hierarchical CAR. This mode applies to high priority, bursty traffic like video.
By using the two modes appropriately, you can improve bandwidth efficiency.
For example, suppose two flows exist: a low priority data flow and a high priority, bursty video flow.
Their total traffic rate cannot exceed 4096 kbps and the video flow must be assured of at least 2048 kbps bandwidth. You can perform the following tasks:
•
Configure common CAR actions to set the traffic rate to 2048 kbps for the two flows.
•
Configure a hierarchical CAR action to limit their total traffic rate to 4096 kbps.
•
Use the action in AND mode in the common CAR action for the data flow.
•
Use the action in OR mode in the common CAR action for the video flow.
The video flow is assured of 2048 kbps bandwidth and can use idle bandwidth of the data flow.
In a bandwidth oversubscription scenario, the uplink port bandwidth is lower than the total downlink port traffic rate. You can use hierarchical CAR to meet the following requirements:
•
Limit the total rate of downlink port traffic.
•
Allow each downlink port to forward traffic at the maximum rate when the other ports are idle.
For example, you can perform the following tasks:
•
Use common CAR actions to limit the rates of Internet access flow 1 and flow 2 to both 128 kbps.
•
Use a hierarchical CAR action to limit their total traffic rate to 192 kbps.
73
•
Use the hierarchical CAR action for both flow 1 and flow 2 in AND mode.
When flow 1 is not present, flow 2 is transmitted at the maximum rate, 128 kbps. When both flows are present, the total rate of the two flows cannot exceed 192 kbps. As a result, the traffic rate of flow 2 might drop below 128 kbps.
Restrictions and guidelines: Global CAR configuration
•
Only aggregate CAR is supported in the current software version.
•
The device supports the following application destinations in the inbound direction for aggregate CAR:
Interface.
VLANs.
Globally.
User profile.
•
If a QoS policy containing an aggregate CAR action is applied to multiple interfaces, the actual rate limit that takes effect is the CIR plus the PIR specified in the CAR action multiplied by the number of IRF member devices where the interfaces reside.
Configuring aggregate CAR
1. Enter system view. system-view
2. Define a traffic class. a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured.
For configurable match criteria, see the if-match command in ACL and QoS Command
Reference . c. Return to system view. quit
3. Configure an aggregate CAR action.
qos car car-name aggregative cir committed-information-rate [ cbs
committed-burst-size [ ebs excess-burst-size ] ] [ green action | red action | yellow action ] *
qos car car-name aggregative cir committed-information-rate [ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] [ green action | red action | yellow action ] *
By default, no aggregate CAR action is configured.
4. Define a traffic behavior. a. Enter traffic behavior view. traffic behavior behavior-name b. Use the aggregate CAR in the traffic behavior.
74
car name car-name
By default, no aggregate CAR action is used in a traffic behavior.
5. Apply the QoS policy.
For more information, see " Applying the QoS policy ."
By default, no QoS policy is applied.
Display and maintenance commands for global
CAR
Execute display commands in any view and reset commands in user view.
Task
Display statistics for global CAR actions.
Clear statistics for global CAR actions.
Command display qos car name [ car-name ] reset qos car name [ car-name ]
75
Configuring class-based accounting
About class-based accounting
Class-based accounting collects statistics on a per-traffic class basis. For example, you can define the action to collect statistics for traffic sourced from a certain IP address. By analyzing the statistics, you can determine whether anomalies have occurred and what action to take.
Restrictions and guidelines: Class-based accounting configuration
The device supports the following application destinations for class-based accounting:
•
Interface.
•
VLANs.
•
Globally.
•
User profile.
Procedure
1. Enter system view. system-view
2. Define a traffic class. a. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator { and | or } ] b. Configure a match criterion.
if-match match-criteria
By default, no match criterion is configured.
For more information about the if-match command, see ACL and QoS Command
Reference . c. Return to system view. quit
3. Define a traffic behavior. a. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name b. Configure an accounting action. accounting { byte | packet }
By default, no traffic accounting action is configured. c. Return to system view. quit
4. Define a QoS policy. a. Create a QoS policy and enter QoS policy view. qos policy policy-name
76
b. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name
By default, a traffic class is not associated with a traffic behavior. c. Return to system view. quit
5. Apply the QoS policy.
For more information, see " Applying the QoS policy ."
By default, no QoS policy is applied.
6. (Optional.) Display the class-based accounting configuration. display traffic behavior user-defined [ behavior-name ]
Class-based accounting configuration examples
Example: Configuring class-based accounting
Network configuration
As shown in Figure 22 , configure class-based accounting on GigabitEthernet 1/0/1 to collect
statistics for incoming traffic from 1.1.1.1/24.
Figure 22 Network diagram
Host
1.1.1.1/24
Device
GE1/0/1
Procedure
# Create basic ACL 2000, and configure a rule to match packets with source IP address 1.1.1.1.
<Device> system-view
[Device] acl basic 2000
[Device-acl-ipv4-basic-2000] rule permit source 1.1.1.1 0
[Device-acl-ipv4-basic-2000] quit
# Create a traffic class named classifier_1 , and use ACL 2000 as the match criterion in the traffic class.
[Device] traffic classifier classifier_1
[Device-classifier-classifier_1] if-match acl 2000
[Device-classifier-classifier_1] quit
# Create a traffic behavior named behavior_1 , and configure the class-based accounting action.
[Device] traffic behavior behavior_1
[Device-behavior-behavior_1] accounting packet
[Device-behavior-behavior_1] quit
# Create a QoS policy named policy , and associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.
[Device] qos policy policy
[Device-qospolicy-policy] classifier classifier_1 behavior behavior_1
[Device-qospolicy-policy] quit
# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.
77
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] qos apply policy policy inbound
[Device-GigabitEthernet1/0/1] quit
# Display traffic statistics to verify the configuration.
[Device] display qos policy interface gigabitethernet 1/0/1
Interface: GigabitEthernet1/0/1
Direction: Inbound
Policy: policy
Classifier: classifier_1
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: behavior_1
Accounting enable:
28529 (Packets)
78
Appendixes
Appendix A Acronyms
Table 3 Appendix A Acronyms
Acronym
AF
BE
FIFO
FQ
GMB
GTS
IntServ
ISP
LLQ
LSP
MPLS
PE
PIR
PQ
PW
QoS
QPPB
RED
BQ
CAR
CBS
CBQ
CE
CIR
CQ
DCBX
DiffServ
DSCP
EBS
ECN
EF
Full spelling
Assured Forwarding
Best Effort
Bandwidth Queuing
Committed Access Rate
Committed Burst Size
Class Based Queuing
Congestion Experienced
Committed Information Rate
Custom Queuing
Data Center Bridging Exchange Protocol
Differentiated Service
Differentiated Services Code Point
Excess Burst Size
Explicit Congestion Notification
Expedited Forwarding
First in First out
Fair Queuing
Guaranteed Minimum Bandwidth
Generic Traffic Shaping
Integrated Service
Internet Service Provider
Low Latency Queuing
Label Switched Path
Multiprotocol Label Switching
Provider Edge
Peak Information Rate
Priority Queuing
Pseudowire
Quality of Service
QoS Policy Propagation Through the Border Gateway Protocol
Random Early Detection
79
Acronym
RSVP
RTP
SP
ToS
VoIP
VPN
WFQ
WRED
WRR
Full spelling
Resource Reservation Protocol
Real-Time Transport Protocol
Strict Priority
Type of Service
Voice over IP
Virtual Private Network
Weighted Fair Queuing
Weighted Random Early Detection
Weighted Round Robin
Appendix B Default priority maps
For the default dot1p-exp and dscp-dscp priority maps, an input value yields a target value equal to it.
Table 4 Default dot1p-lp, dot1p-dp, and dot1p-dscp priority maps
4
5
6
2
3
Input priority value dot1p-lp map dot1p lp
0 2
1 0
4
5
6
1
3
0
0
0
0
0 dot1p-dp map dp
0
0
7 7 0
Table 5 Default dscp-dp and dscp-dot1p priority maps
Input priority value dscp
0 to 7
8 to 15
16 to 23
24 to 31
32 to 39
40 to 47
48 to 55
56 to 63
0
0
0
0
0
0
0 dscp-dp map dp
0
3
4
1
2
5
6
7 dscp-dot1p map dot1p
0
16
24
32
40
48
56 dot1p-dscp map dscp
0
8
80
Table 6 Default exp-dp priority map
0
1
2
3
4
5
Input priority value
EXP value
6 0
7 0
Table 7 Default port priority-local priority map
0
0
0
0
0
0 exp-dp map dp
4
5
6
7
1
2
3
Port priority
0
4
5
6
7
1
2
3
Local precedence
0
Appendix C Introduction to packet precedence
IP precedence and DSCP values
Figure 23 ToS and DS fields
Bits:
IPv4 ToS
byte
0 1
Preced ence
2 3 4 5
Type of
Service
6 7
M
B
Z
RFC 1122
RFC 1349
Must
Be
Zero
Bits: 0 1 2 3 4 5 6 7
DS-Field
(for IPv4,ToS octet,and for
IPv6,Traffic
Class octet )
DSCP
Class Selector codepoints
CU
Currently
Unused
IP Type of Service (ToS)
RFC 791
Differentiated Services
Codepoint (DSCP)
RFC 2474
IP precedence from 0 to 7. According to RFC 2474, the ToS field is redefined as the differentiated
81
services (DS) field. A DSCP value is represented by the first 6 bits (0 to 5) of the DS field and is in the range 0 to 63. The remaining 2 bits (6 and 7) are reserved.
Table 8 IP precedence
4
5
6
2
3
IP precedence (decimal)
0
1
7
Table 9 DSCP values
IP precedence (binary)
000
001
010
011
100
101
110
111
Description
Routine priority immediate flash flash-override critical internet network
DSCP value (decimal)
46
48
56
0
36
38
8
16
24
32
40
26
28
30
34
10
12
14
18
20
22
DSCP value (binary)
101110
100100
100110
001000
010000
011000
100000
101000
110000
111000
000000
001010
001100
001110
010010
010100
010110
011010
011100
011110
100010
Description ef af42 af43 cs1 cs2 cs3 cs4 cs5 cs6 cs7 be (default) af11 af12 af13 af21 af22 af23 af31 af32 af33 af41
82
802.1p priority
802.1p priority lies in the Layer 2 header. It applies to occasions where Layer 3 header analysis is not needed and QoS must be assured at Layer 2.
Figure 24 An Ethernet frame with an 802.1Q tag header
Destination
Address
Source
Address
802.1Q header
TPID TCI
Length
/Type
Data
FCS(CRC-
32)
6 bytes 6 bytes 4 bytes 2 bytes 46~1500 bytes 4 bytes
format of the 802.1Q tag header. The Priority field in the 802.1Q tag header is called 802.1p priority,
because its use is defined in IEEE 802.1p. Table 10 shows the values for 802.1p priority.
Figure 25 802.1Q tag header
Byte 1 Byte 2 Byte 3 Byte 4
TPID(Tag protocol identifier) TCI(Tag control information)
1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 Priority
C
F
I
VLAN ID
7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
Table 10 Description on 802.1p priority
5
6
7
1
2
3
4
802.1p priority (decimal)
0
802.1p priority (binary)
000
001
010
011
100
101
110
111
Description best-effort background spare excellent-effort controlled-load video voice network-management
EXP values
The EXP field is in MPLS labels for MPLS QoS purposes. As shown in Figure 26 , the EXP field is
3-bit long and is in the range of 0 to 7.
Figure 26 MPLS label structure
83
84
85
Configuring data buffers
About data buffers
Data buffer types
Data buffers temporarily store packets to avoid packet loss.
The following data buffers are available:
•
Ingress buffer —Stores incoming packets when the CPU is busy.
•
Egress buffer —Stores outgoing packets when network congestion occurs.
Figure 27 Data buffer structure
Fixed area
Ingress/Egress buffer
Cell resources
Shared area
Cell resources
A buffer uses cell resources to store packets based on packet sizes. A cell resource is 256 bytes. The buffer allocates one cell resource to a 128-byte packet and two cell resources to a 300-byte packet.
Fixed area and shared area
The cell resources have a fixed area and a shared area.
•
Fixed area —Partitioned into queues, each of which is equally divided by all the interfaces on
the switch, as shown in Figure 28 . When congestion occurs or the CPU is busy, the following
rules apply: a. An interface first uses the relevant queues of the fixed area to store packets. b. When a queue is full, the interface uses the corresponding queue of the shared area. c. When the queue in the shared area is also full, the interface discards subsequent packets.
The system allocates the fixed area among queues as specified by the user. Even if a queue is not full, other queues cannot preempt its space. Similarly, the share of a queue for an interface cannot be preempted by other interfaces even if it is not full.
•
Shared area —Partitioned into queues, each of which is not equally divided by the interfaces,
as shown in Figure 28 . The system determines the actual shared-area space for each queue
according to user configuration and the number of packets actually received and sent. If a queue is not full, other queues can preempt its space.
The system puts packets received or sent on all interfaces into a queue in the order they arrive.
When the queue is full, subsequent packets are dropped.
86
Figure 28 Fixed area and shared area
Shared area
Queue 0
Queue 1
Queue 2
Queue 3
Queue 4
Queue 5
Queue 6
Queue 7
Port 1 Port 2 Port 3 Port 4 …
Fixed area
Restrictions and guidelines: Data buffer configuration
You can configure data buffers either manually or automatically by enabling the Burst feature. If you have configured data buffers in one way, delete the configuration before using the other way.
Otherwise, the new configuration does not take effect.
Inappropriate data buffer changes can cause system problems. Before manually changing data buffer settings, make sure you understand its impact on your device. As a best practice, use the burst-mode enable command if the system requires large buffer spaces.
Data buffer tasks at a glance
To configure the data buffer, perform the following tasks:
•
•
Configuring data buffers manually
Enabling the Burst feature
About this task
The Burst feature enables the device to automatically allocate cell and packet resources. It is well suited to the following scenarios:
•
Broadcast or multicast traffic is intensive, resulting in bursts of traffic.
•
Traffic comes in and goes out in one of the following ways:
Enters a device from a high-speed interface and goes out of a low-speed interface.
Enters from multiple same-rate interfaces at the same time and goes out of an interface with the same rate.
The default data buffer settings are changed after the Burst feature is enabled. You can display the data buffer settings by using the display buffer command.
Procedure
1. Enter system view.
87
system-view
2. Enable the Burst feature. burst-mode enable
By default, the Burst feature is disabled.
Configuring data buffers manually
About this task
Each type of resources of a buffer, packet or cell, has a fixed size. After you set the shared-area size for a type of resources, the rest is automatically assigned to the fixed area.
By default, all queues have an equal share of the shared area and the fixed area. You can change the maximum shared-area space and the fixed-area for a queue. The unconfigured queues use the default settings.
Procedure
1. Enter system view. system-view
2. Configure buffer assignment rules. Choose the options to configure as needed:
Set the total shared-area ratio. buffer egress [ slot slot-number ] cell total-shared ratio ratio
If this command is not configured, you can display the default value by using the display buffer command.
Set the maximum shared-area ratio for a queue. buffer egress [ slot slot-number ] cell [ queue queue-id ] shared ratio ratio
The default settings for a port and for a queue are both 33% of the total shared-area size.
The actual maximum shared-area space for each queue is determined based on your configuration and the number of packets to be received and sent.
Set the fixed-area ratio for a queue. buffer egress [ slot slot-number ] cell queue queue-id guaranteed ratio ratio
The default setting is 12%.
The sum of fixed-area ratios configured for all queues cannot exceed the total fixed-area ratio. Otherwise, the configuration fails.
3. Apply buffer assignment rules. buffer apply
You cannot directly modify the applied configuration. To modify the configuration, you must cancel the application, reconfigure data buffers, and reapply the configuration.
Display and maintenance commands for data buffers
Execute display commands in any view.
88
Task
Display buffer size settings.
Display data buffer usage.
Command display buffer [ slot slot-number ] [ queue
[ queue-id ] ] display buffer usage [ slot slot-number ]
89
Configuring time ranges
About time ranges
You can implement a service based on the time of the day by applying a time range to it. A time-based service takes effect only in time periods specified by the time range. For example, you can implement time-based ACL rules by applying a time range to them.
The following basic types of time ranges are available:
•
Periodic time range —Recurs periodically on a day or days of the week.
•
Absolute time range —Represents only a period of time and does not recur.
The active period of a time range is calculated as follows:
1. Combining all periodic statements.
2. Combining all absolute statements.
3. Taking the intersection of the two statement sets as the active period of the time range.
Restrictions and guidelines: Time range configuration
When you configure the ACL hardware mode, follow these restrictions and guidelines:
•
If a time range does not exist, the service based on the time range does not take effect.
•
You can create a maximum of 1024 time ranges, each with a maximum of 32 periodic statements and 12 absolute statements.
Procedure
1. Enter system view. system-view
2. Create or edit a time range. time-range time-range-name { start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] | from time1 date1 [ to time2 date2 ] | to time2 date2 }
If an existing time range name is provided, this command adds a statement to the time range.
Display and maintenance commands for time ranges
Execute the display command in any view.
Task
Display time range configuration and status.
Command display time-range
{ time-range-name | all }
90
Time range configuration examples
Example: Configuring a time range
Network configuration
As shown in Figure 29 , configure an ACL on the device to allow Host A to access the server only
during 8:00 and 18:00 on working days from June 2015 to the end of the year.
Figure 29 Network diagram
Server
Host A
192.168.1.2/24
GE1/0/1 GE1/0/2
Device 192.168.0.100/24
Host B
192.168.1.3/24
Procedure
# Create a periodic time range during 8:00 and 18:00 on working days from June 2015 to the end of the year.
<Device> system-view
[Device] time-range work 8:0 to 18:0 working-day from 0:0 6/1/2015 to 24:00 12/31/2015
# Create an IPv4 basic ACL numbered 2001, and configure a rule in the ACL to permit packets only from 192.168.1.2/32 during the time range work .
[Device] acl basic 2001
[Device-acl-ipv4-basic-2001] rule permit source 192.168.1.2 0 time-range work
[Device-acl-ipv4-basic-2001] rule deny source any time-range work
[Device-acl-ipv4-basic-2001] quit
# Apply IPv4 basic ACL 2001 to filter outgoing packets on GigabitEthernet 1/0/2.
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] packet-filter 2001 outbound
[Device-GigabitEthernet1/0/2] quit
Verifying the configuration
# Verify that the time range work is active on the device.
[Device] display time-range all
Current time is 13:58:35 6/19/2015 Friday
Time-range : work (Active)
08:00 to 18:00 working-day
from 00:00 6/1/2015 to 00:00 1/1/2016
91
Document conventions and icons
Conventions
This section describes the conventions used in the documentation.
Command conventions
Convention
Boldface
Italic
[ ]
{ x | y | ... }
[ x | y | ... ]
{ x | y | ... } *
[ x | y | ... ] *
Description
Bold text represents commands and keywords that you enter literally as shown.
Italic text represents arguments that you replace with actual values.
Square brackets enclose syntax choices (keywords or arguments) that are optional.
Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.
Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none.
Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.
Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none.
The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.
A line that starts with a pound (#) sign is comments.
&<1-n>
#
GUI conventions
Convention
Boldface
Description
Window names, button names, field names, and menu items are in Boldface. For example, the New User window opens; click OK .
Multi-level menus are separated by angle brackets. For example, File > Create >
Folder .
Symbols
>
Convention
WARNING!
CAUTION:
IMPORTANT:
NOTE:
TIP:
Description
An alert that calls attention to important information that if not understood or followed can result in personal injury.
An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software.
An alert that calls attention to essential information.
An alert that contains additional or supplementary information.
An alert that provides helpful information.
92
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
Examples provided in this document
Examples in this document might use devices that differ from your device in hardware model, configuration, or software version. It is normal that the port numbers, sample output, screenshots, and other information in the examples differ from what you have on your device.
93
Support and other resources
Accessing Hewlett Packard Enterprise Support
•
For live assistance, go to the Contact Hewlett Packard Enterprise Worldwide website: www.hpe.com/assistance
•
To access documentation and support services, go to the Hewlett Packard Enterprise Support
Center website: www.hpe.com/support/hpesc
Information to collect
•
Technical support registration number (if applicable)
•
Product name, model or version, and serial number
•
Operating system name and version
•
Firmware version
•
Error messages
•
Product-specific reports and logs
•
Add-on products or components
•
Third-party products or components
Accessing updates
•
Some software products provide a mechanism for accessing software updates through the product interface. Review your product documentation to identify the recommended software update method.
•
To download product updates, go to either of the following:
Hewlett Packard Enterprise Support Center Get connected with updates page: www.hpe.com/support/e-updates
Software Depot website: www.hpe.com/support/softwaredepot
•
To view and update your entitlements, and to link your contracts, Care Packs, and warranties with your profile, go to the Hewlett Packard Enterprise Support Center More Information on
Access to Support Materials page: www.hpe.com/support/AccessToSupportMaterials
IMPORTANT:
Access to some updates might require product entitlement when accessed through the Hewlett
Packard Enterprise Support Center. You must have an HP Passport set up with relevant entitlements.
94
Websites
Website
Networking websites
Hewlett Packard Enterprise Information Library for
Networking
Hewlett Packard Enterprise Networking website
Hewlett Packard Enterprise My Networking website
Hewlett Packard Enterprise My Networking Portal
Hewlett Packard Enterprise Networking Warranty
General websites
Hewlett Packard Enterprise Information Library
Hewlett Packard Enterprise Support Center
Hewlett Packard Enterprise Support Services Central
Contact Hewlett Packard Enterprise Worldwide
Subscription Service/Support Alerts
Software Depot
Customer Self Repair (not applicable to all devices)
Insight Remote Support (not applicable to all devices)
Link www.hpe.com/networking/resourcefinder www.hpe.com/info/networking www.hpe.com/networking/support www.hpe.com/networking/mynetworking www.hpe.com/networking/warranty www.hpe.com/info/enterprise/docs www.hpe.com/support/hpesc ssc.hpe.com/portal/site/ssc/ www.hpe.com/assistance www.hpe.com/support/e-updates www.hpe.com/support/softwaredepot www.hpe.com/support/selfrepair www.hpe.com/info/insightremotesupport/docs
Customer self repair
Hewlett Packard Enterprise customer self repair (CSR) programs allow you to repair your product. If a CSR part needs to be replaced, it will be shipped directly to you so that you can install it at your convenience. Some parts do not qualify for CSR. Your Hewlett Packard Enterprise authorized service provider will determine whether a repair can be accomplished by CSR.
For more information about CSR, contact your local service provider or go to the CSR website: www.hpe.com/support/selfrepair
Remote support
Remote support is available with supported devices as part of your warranty, Care Pack Service, or contractual support agreement. It provides intelligent event diagnosis, and automatic, secure submission of hardware event notifications to Hewlett Packard Enterprise, which will initiate a fast and accurate resolution based on your product’s service level. Hewlett Packard Enterprise strongly recommends that you register your device for remote support.
For more information and device support details, go to the following website: www.hpe.com/info/insightremotesupport/docs
Documentation feedback
Hewlett Packard Enterprise is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation
Feedback ( [email protected]
). When submitting your feedback, include the document title,
95
part number, edition, and publication date located on the front cover of the document. For online help content, include the product name, product version, help edition, and publication date located on the legal notices page.
96
Index
Numerics
802
QoS packet 802.1p priority, 83
A
absolute time range (ACL), 90 ,
access control list.
Use
ACL
IPv4 advanced configuration, 6
IPv6 advanced configuration, 7
match order, 1 naming, 1 numbering, 1
packet filter configuration (interface-based),
packet filtering application (Ethernet service
packet filtering application (interface), 9
packet filtering application restrictions
(Ethernet service instance), 10
packet filtering application restrictions
(interface), 9 packet filtering configuration, 9
packet filtering default action, 11
packet filtering logging+SNMP notifications,
packet filtering scope (VLAN interface), 10
QoS ACL-based configuration, 40
rule comment, 2 rule numbering, 2 rule remark, 2
time range configuration, 90 , 90 ,
action
ACL packet filtering default action, 11
advanced ACL
aggregate CAR
Appendix A
Appendix B
Appendix C
applying
ACL packet filtering (Ethernet service instance),
ACL packet filtering (interface), 9
QoS CA queue-based WRED table, 54 ,
QoS policy (control plane), 22
QoS policy (Ethernet service instance), 20
area
auto
ACL automatic rule numbering, 3
B bandwidth
basic ACL
behavior
QoS traffic behavior definition, 18
best-effort QoS service model, 15
buffering data.
See
C
CAR
97
aggregate CAR (MQC approach), 74
global CAR display, 75 global CAR maintain, 75
cell
changing
QoS priority mapping interface port priority, 29
class-based accounting
configuration restrictions, 76
classifying
QoS class-based accounting, 76 ,
QoS traffic class definition, 18
comment
committed access rate.
Use
configuring
ACL packet filter (interface-based), 12
ACL packet filtering logging+SNMP
ACL packet filtering scope (VLAN interface),
QoS aggregate CAR (MQC approach), 74
QoS CA queue-based WRED table, 54 ,
QoS CA WRED table (queue-based), 55
QoS class-based accounting, 76 ,
QoS congestion management SP+WRR
QoS HCM queue scheduling profile, 48 ,
QoS priority mapping priority trust mode, 30
QoS priority mapping table+priority marking, 31
QoS priority mapping trusted port packet priority,
QoS protocol packet rate limiting, 60
congestion avoidance (QoS CA)
WRED table configuration (queue-based), 55
congestion management
congestion management methods, 45
SP+WRR queuing configuration, 48
congestion management (CM)
control plane
copying
D data buffer.
See
data buffer
configuration restrictions and guidelines, 87
default
ACL packet filtering default action, 11
defining
98
detecting
device
ACL packet filtering configuration, 9
ACL packet filtering logging+SNMP
ACL packet filtering scope (VLAN interface),
QoS policy application (control plane), 22
QoS policy application (Ethernet service
QoS policy application (global), 21
QoS policy application (interface), 20
QoS policy application (user profile), 22
QoS policy application (VLAN), 21
QoS policy application (VSI), 21
DiffServ QoS service model, 15
displaying
drop priority (QoS priority mapping), 25
DSCP
QoS packet IP precedence and DSCP values,
E
ECN
enabling
Ethernet service instance
ACL packet filtering application (Ethernet
evaluating
QoS traffic with token bucket, 35 , 35 , 35
Explicit Congestion Notification.
Use
F filtering
ACL packet filtering logging+SNMP notifications,
QoS traffic filtering configuration, 57 ,
fixed area
forwarding
ACL configuration (advanced), 6
ACL configuration (Layer 2), 8
fragment
G
Generic Traffic Shaping.
Use
global
QoS policy application restrictions, 21
global CAR
aggregate CAR (MQC approach), 74
configuration restrictions, 74
GTS
guideline data buffer configuration restrictions and
policy application restrictions and guidelines, 19
H hardware congestion management (HCM)
queue scheduling profile, 48 ,
queue scheduling profile configuration restrictions,
queuing on interface configuration, 47
hierarchical CAR
99
I interface
ACL packet filter configuration
IP addressing
ACL configuration (advanced), 6
ACL configuration (Layer 2), 8
QoS class-based accounting configuration, 76 ,
QoS traffic filtering configuration, 57 ,
IPv4
ACL configuration (IPv4 advanced), 6
IPv6
ACL configuration (IPv4 basic), 4
ACL packet filtering configuration, 9
ACL configuration (IPv6 advanced), 7
ACL configuration (IPv6 basic), 5
ACL packet filtering configuration, 9
L
Layer 2
limiting
QoS protocol packet rate limiting, 60
QoS rate limit configuration, 41
local
QoS priority mapping local precedence, 25
logging
ACL packet filtering logging, 11
M maintaining
mapping priority mapping.
See
matching
mode
QoS priority mapping priority trust, 30
MPLS QoS
MQC
MQC QoS
traffic policing configuration, 39
N naming
nesting
configuration restrictions, 66
network
ACL configuration (advanced), 6
ACL configuration (Layer 2), 8
ACL packet filter configuration (interface-based),
ACL packet filtering application (Ethernet service
ACL packet filtering configuration, 9
ACL packet filtering logging+SNMP notifications,
ACL packet filtering scope (VLAN interface), 10
ACL packet fragment filtering, 3
QoS aggregate CAR (MQC approach), 74
QoS CA WRED queue-based table, 54 ,
QoS CA WRED table configuration
QoS CA WRED-queuing relationship, 53
QoS class-based accounting configuration, 76 ,
QoS congestion management SP+WRR queuing
QoS global CAR configuration, 73
QoS HCM queue scheduling profile, 48 ,
QoS nesting configuration, 66 ,
100
QoS priority mapping configuration, 25 ,
QoS priority mapping drop priority, 25
QoS priority mapping interface port priority, 29
QoS priority mapping priority trust mode, 30
QoS priority mapping table+priority marking
QoS priority mapping trusted port packet
QoS priority marking configuration, 62 ,
QoS protocol packet rate limiting, 60
QoS rate limit configuration, 35 ,
QoS traffic behavior definition, 18
QoS traffic class definition, 18
QoS traffic filtering configuration, 57 ,
QoS traffic policing configuration, 35 ,
QoS traffic redirection configuration, 69 ,
network management
QoS priority mapping configuration, 30
time range configuration, 90 ,
non-MQC
QoS traffic policing configuration, 39
notifying
ACL packet filtering logging+SNMP
numbering
ACL automatic rule numbering, 3
P packet
QoS aggregate CAR (MQC approach), 74
QoS class-based accounting configuration, 76 ,
QoS global CAR configuration, 73
QoS nesting configuration, 66 ,
QoS priority mapping configuration, 25 ,
QoS priority mapping priority trust mode, 30
QoS priority marking configuration, 62 ,
QoS protocol packet rate limiting, 60
QoS traffic filtering configuration, 57 ,
QoS traffic redirection configuration, 69 ,
QoS trusted port packet priority, 29
packet filtering
ACL configuration (advanced), 6
ACL configuration (Layer 2), 8
ACL filtering application (Ethernet service
ACL filtering application (interface), 9
ACL logging+SNMP notifications, 11
ACL packet filter (interface-based), 12
ACL packet fragment filtering, 3
ACL scope (VLAN interface), 10
parameter
periodic time range (ACL), 90 ,
policing
QoS traffic policing configuration, 39
policy
QoS application (control plane), 22
QoS application (Ethernet service instance), 20
QoS application (interface), 20
QoS application (user profile), 22
policy application
restrictions and guidelines, 19
port
101
QoS priority mapping configuration methods,
QoS priority mapping interface port priority, 29
QoS trusted port packet priority, 29
precedence
QoS priority mapping configuration, 25 ,
QoS priority mapping local precedence, 25
QoS priority mapping priority trust mode, 30
QoS priority mapping table+priority marking
priority mapping.
See
marking.
See
QoS packet 802.1p priority, 83
QoS packet IP precedence and DSCP values,
priority mapping
mapping table+priority marking configuration,
trusted port packet priority, 29
priority marking
procedure applying ACL packet filtering (Ethernet service
applying ACL packet filtering (interface), 9
applying QoS CA queue-based WRED table,
applying QoS policy (control plane), 22
applying QoS policy (Ethernet service
applying QoS policy (global), 21
applying QoS policy (interface), 20
applying QoS policy (user profile), 22
applying QoS policy (VLAN), 21 applying QoS policy (VSI), 21
changing QoS priority mapping interface port
102
configuring ACL (IPv4 advanced), 6
configuring ACL (IPv4 basic), 4
configuring ACL (IPv6 advanced), 7
configuring ACL (IPv6 basic), 5
configuring ACL packet filter (interface-based), 12
configuring ACL packet filtering, 9
configuring ACL packet filtering logging+SNMP
configuring ACL packet filtering scope (VLAN
configuring data buffers manually, 88
configuring QoS aggregate CAR (MQC approach),
configuring QoS CA queue-based WRED table,
configuring QoS CA WRED table (queue-based),
configuring QoS class-based accounting, 77 , 77
configuring QoS congestion management
configuring QoS HCM queue scheduling profile,
configuring QoS HCM queuing on interface, 47 configuring QoS HCM SP queuing, 47
configuring QoS HCM WRR queuing, 48
configuring QoS nesting, 67 , 67
configuring QoS priority mapping, 28 configuring QoS priority mapping map, 28
configuring QoS priority mapping priority trust
configuring QoS priority mapping table+priority
configuring QoS priority mapping trusted port
configuring QoS priority marking, 63 , 63
configuring QoS rate limit, 41
configuring QoS traffic filtering, 58 , 58
configuring QoS traffic policing, 39 ,
configuring QoS traffic redirection, 69 ,
defining QoS traffic behavior, 18 defining QoS traffic class, 18
displaying QoS priority mapping, 30
displaying QoS rate limit, 41 displaying QoS traffic policing, 41
enabling data buffer burst, 87
maintaining QoS global CAR, 75
setting ACL packet filtering default action, 11
profile
QoS HCM queue scheduling profile, 48 ,
protocols and standards
QoS protocol packet rate limiting, 60
Q
QoS
aggregate CAR (MQC approach), 74
Appendix B, Default priority maps, 80
Appendix C, Packet precedence, 81
CA WRED table configuration (queue-based),
class-based accounting configuration, 76 ,
complicated traffic evaluation with token
congestion avoidance (CA) WRED
congestion avoidance (CA) WRED-queuing
relationship, 53 congestion avoidance (CA)+ECN, 53
congestion avoidance (CA)WRED display, 56
congestion management (CM) configuration,
congestion management SP+WRR queuing
103
data buffer configuration (manual), 88 data buffer display, 88
global CAR display, 75 global CAR maintain, 75
hardware congestion management (HCM)
hardware congestion management (HCM) display,
hardware congestion management (HCM) queue
hardware congestion management (HCM) queue
scheduling profile configuration restrictions, 49
hardware congestion management (HCM) SP
hardware congestion management (HCM) WRR
MQC traffic policing configuration restrictions, 39
policy application (control plane), 22
policy application (Ethernet service instance), 20
policy application (global), 21
policy application (interface), 20
policy application (user profile), 22
policy application (VLAN), 21 policy application (VSI), 21
policy application restrictions, 19
policy application restrictions (Ethernet service
policy application restrictions (global), 21
policy application restrictions (interface), 20
policy application restrictions (user profile), 22
policy application restrictions (VLAN), 21 policy application restrictions (VSI), 21
policy display, 23 policy maintain, 23
priority mapping configuration, 25 ,
priority mapping configuration methods, 26
priority mapping drop priority, 25
priority mapping interface port priority, 29
priority mapping local precedence, 25
priority mapping priority trust mode, 30
priority mapping table+priority marking
priority mapping trusted port packet priority, 29
priority mapping trusted port packet priority
priority mapping user priority, 25
priority marking configuration, 62 ,
protocol packet rate limiting, 60
rate limit configuration, 35 ,
service models, 15 techniques, 15
traffic behavior definition, 18 traffic class definition, 18
traffic evaluation, 35 traffic evaluation with token bucket, 35 , 35
traffic filtering configuration, 57 ,
traffic policing configuration, 35 ,
traffic redirection configuration, 69 ,
QoS configuration approach
QoS group
congestion management methods, 45
Quality of Service.
Use
queuing
QoS CA WRED-queuing relationship, 53
QoS congestion management SP+WRR
QoS HCM queue scheduling profile, 49 , 49
QoS HCM scheduling profile, 48 ,
QoS queue-based GTS configuration, 40
R random early detection.
Use RED rate limiting
QoS protocol packet rate limiting, 60
QoS rate limit configuration, 41
QoS rate limiting configuration, 35 ,
redirecting
remark
restriction data buffer configuration restrictions and
restrictions
ACL packet filtering application (Ethernet service
ACL packet filtering application (interface), 9
class-based accounting configuration, 76
QoS HCM queue scheduling profile configuration,
QoS MQC traffic policing configuration, 39
QoS policy application (Ethernet service instance),
QoS policy application (global), 21
QoS policy application (interface), 20
QoS policy application (user profile), 22
QoS policy application (VLAN), 21
QoS policy application (VSI), 21
QoS priority mapping trusted port packet priority,
traffic filtering configuration, 57
traffic redirecting configuration, 69
routing
ACL configuration (advanced), 6
ACL configuration (Layer 2), 8
QoS priority mapping configuration, 25 ,
QoS priority mapping priority trust mode, 30
QoS rate limit configuration, 35 ,
QoS traffic policing configuration, 35 ,
rule
104
ACL automatic rule numbering, 3
ACL config match order sort, 1
S scheduling
QoS HCM queue scheduling profile, 48 ,
security
ACL configuration (advanced), 6
ACL configuration (IPv4 advanced), 6
ACL configuration (IPv4 basic), 4
ACL configuration (IPv6 advanced), 7
ACL configuration (IPv6 basic), 5
ACL configuration (Layer 2), 8
service
QoS best-effort service model, 15
QoS DiffServ service model, 15
QoS global CAR configuration, 73
QoS nesting configuration, 66 ,
QoS priority marking configuration, 62 ,
QoS traffic filtering configuration, 57 ,
setting
ACL packet filtering default action, 11
shared area
SNMP
ACL packet filtering SNMP notifications, 11
sorting
ACL config match order sort, 1
SP queuing
SP+WRR queuing
statistics
QoS class-based accounting configuration, 76 ,
switching
QoS HCM queue scheduling profile, 49 , 49
T table
QoS CA WRED queue-based table, 54 ,
TCP
time range
configuration restrictions, 90 display, 90
token bucket
QoS complicated traffic evaluation, 35
QoS traffic evaluation, 35 , 35
traffic
ACL configuration (advanced), 6
ACL configuration (Layer 2), 8
ACL packet filter configuration (interface-based),
QoS aggregate CAR (MQC approach), 74
QoS CA WRED queue-based table, 54 ,
QoS CA WRED table configuration
QoS CA WRED-queuing relationship, 53
QoS class-based accounting configuration, 76 ,
QoS congestion management SP+WRR queuing
QoS global CAR configuration, 73
See also under hardware congestion management (HCM)
QoS HCM queue scheduling profile, 48 ,
QoS nesting configuration, 66 ,
QoS policy application (control plane), 22
105
QoS policy application (Ethernet service
QoS policy application (global), 21
QoS policy application (interface), 20
QoS policy application (user profile), 22
QoS policy application (VLAN), 21
QoS policy application (VSI), 21
QoS priority mapping configuration, 30
QoS priority mapping interface port priority, 29
QoS priority mapping priority trust mode, 30
QoS priority mapping process, 26
QoS priority mapping table+priority marking
QoS priority mapping trusted port packet
QoS priority marking configuration, 62 ,
QoS rate limit configuration, 35 ,
QoS traffic behavior definition, 18
QoS traffic class definition, 18
QoS traffic filtering configuration, 57 ,
QoS traffic policing configuration, 35 ,
QoS traffic redirection configuration, 69 ,
traffic filtering
configuration restrictions, 57
traffic policing
traffic redirecting
configuration restrictions, 69
trapping
ACL packet filtering logging+SNMP
trusted
QoS trusted port packet priority, 29
type
ACL config match order sort, 1
U user
QoS priority mapping user priority, 25
user profile
user-defined ACL
V
VLAN
ACL packet filtering scope (VLAN interface), 10
QoS nesting configuration, 66 ,
QoS policy application (VLAN), 21
VSI
VXLAN
QoS priority mapping trusted port packet priority
W weighted random early detection.
Use
WRED
QoS CA queue-based WRED table, 54 ,
QoS CA WRED-queuing relationship, 53
table configuration (queue-based), 55
WRR queuing
QoS HCM group-based queuing, 46
106
Herunterladen
Öffentlicher Link aktualisiert
Der öffentliche Link zu Ihrem Chat wurde aktualisiert. Sie können Ihre Chat-Links nach der Registrierung hier einsehen und verwalten.
Öffentlicher Dokumentenlink
Werbung