Aruba JC611A HPE FlexNetwork Switch Installation Guide

HPE FlexNetwork 10500 Switch Series

ACL and QoS Configuration Guide

Part number: 5200-1877a

Software version: 10500-CMW710-R7557P01

Document version: 6W101-20171020

© Copyright 2017 Hewlett Packard Enterprise Development LP

The information contained herein is subject to change without notice. The only warranties for Hewlett Packard

Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett

Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.

Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software

Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license.

Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard

Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website.

Acknowledgments

Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the

United States and other countries.

Microsoft® and Windows® are trademarks of the Microsoft group of companies.

Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.

Java and Oracle are registered trademarks of Oracle and/or its affiliates.

UNIX® is a registered trademark of The Open Group.

Contents

Configuring ACLs··························································································· 1

Overview ···························································································································································· 1

ACL types ··················································································································································· 1

Numbering and naming ACLs ···················································································································· 1

Match order ················································································································································ 1

Rule numbering ·········································································································································· 2

Fragment filtering with ACLs ······················································································································ 3

Configuration task list ········································································································································· 3

Configuring a basic ACL ···································································································································· 3

Configuring an IPv4 basic ACL ·················································································································· 3

Configuring an IPv6 basic ACL ·················································································································· 4

Configuring an advanced ACL ··························································································································· 5

Configuring an IPv4 advanced ACL ··········································································································· 5

Configuring an IPv6 advanced ACL ··········································································································· 6

Configuring a Layer 2 ACL ································································································································· 7

Configuring a user-defined ACL ························································································································· 8

Copying an ACL ················································································································································· 9

Configuring packet filtering with ACLs ··············································································································· 9

Applying an ACL to an interface for packet filtering ················································································· 10

Configuring the applicable scope of packet filtering on a VLAN interface ··············································· 10

Configuring logging and SNMP notifications for packet filtering ······························································ 10

Setting the packet filtering default action ································································································· 11

Displaying and maintaining ACLs ···················································································································· 11

ACL configuration examples ···························································································································· 12

Interface-based packet filtering configuration example ············································································ 12

QoS overview ······························································································ 14

QoS service models ········································································································································· 14

Best-effort service model ························································································································· 14

IntServ model ··········································································································································· 14

DiffServ model ·········································································································································· 14

QoS techniques overview ································································································································ 14

Deploying QoS in a network ····················································································································· 15

QoS processing flow in a device ·············································································································· 15

Configuring a QoS policy ············································································· 17

Non-MQC approach ········································································································································· 17

MQC approach ················································································································································· 17

Configuration procedure diagram····················································································································· 17

Defining a traffic class ······································································································································ 18

Defining a traffic behavior ································································································································ 18

Defining a QoS policy······································································································································· 18

Applying the QoS policy ··································································································································· 19

Applying the QoS policy to an interface ··································································································· 19

Applying the QoS policy to a VLAN·········································································································· 19

Applying the QoS policy globally ·············································································································· 20

Applying the QoS policy to a control plane ······························································································ 20

Displaying and maintaining QoS policies ········································································································· 21

Configuring priority mapping ········································································ 23

Overview ·························································································································································· 23

Introduction to priorities ···························································································································· 23

Priority maps ············································································································································ 23

Priority trust mode ···································································································································· 24

Priority mapping process ·························································································································· 24

Priority mapping configuration task list············································································································· 26

Configuring a priority map ································································································································ 26

i

Configuring an interface to trust packet priority for priority mapping ································································ 27

Changing the port priority of an interface ········································································································· 27

Displaying and maintaining priority mapping···································································································· 28

Priority mapping configuration examples ········································································································· 28

Port priority configuration example··········································································································· 28

Priority map and priority marking configuration example ········································································· 29

Configuring traffic policing, GTS, and rate limit ············································ 32

Overview ·························································································································································· 32

Traffic evaluation and token buckets········································································································ 32

Traffic policing ·········································································································································· 33

GTS ·························································································································································· 34

Rate limit ·················································································································································· 35

Configuring traffic policing ································································································································ 36

Configuring GTS ·············································································································································· 37

Configuring the rate limit ·································································································································· 37

Displaying and maintaining traffic policing, GTS, and rate limit ······································································· 38

Traffic policing configuration example ·············································································································· 38

Network requirements ······························································································································ 38

Configuration procedure ··························································································································· 39

Configuring congestion management ·························································· 41

Overview ·························································································································································· 41

SP queuing ··············································································································································· 41

WRR queuing ··········································································································································· 42

WFQ queuing ··········································································································································· 43

SP+WRR queuing ···································································································································· 43

SP+WFQ queuing ···································································································································· 44

Configuration approaches and task list ············································································································ 44

Configuring per-queue congestion management ····························································································· 44

Configuring SP queuing ··························································································································· 44

Configuring WRR queuing ······················································································································· 45

Configuring WFQ queuing ························································································································ 46

Configuring SP+WRR queuing ················································································································ 48

Configuring SP+WFQ queuing ················································································································· 49

Configuring a queue scheduling profile ············································································································ 51

Configuration procedure ··························································································································· 52

Queue scheduling profile configuration example for SF interface modules ············································· 53

Queue scheduling profile configuration example for other interface modules ········································· 54

Displaying and maintaining queue statistics ···································································································· 55

Displaying and maintaining congestion management ······················································································ 55

Configuring congestion avoidance ······························································· 56

Overview ·························································································································································· 56

Tail drop ··················································································································································· 56

RED and WRED ······································································································································· 56

ECN ·························································································································································· 56

Configuration restrictions and guidelines ········································································································· 57

Configuring and applying a queue-based WRED table ··················································································· 57

Displaying and maintaining WRED ·················································································································· 58

WRED configuration example ·························································································································· 59

Network requirements ······························································································································ 59

Configuration procedure ··························································································································· 59

Configuring traffic filtering ············································································ 61

Configuration procedure··································································································································· 61

Traffic filtering configuration example ·············································································································· 61

Network requirements ······························································································································ 61

Configuration procedure ··························································································································· 62

Configuring priority marking ········································································· 63

Color-based priority marking ···························································································································· 63

ii

Packet coloring methods ·························································································································· 63

Configuring color-based priority marking ································································································· 63

Configuration procedure··································································································································· 64

Priority marking configuration example ············································································································ 66

Network requirements ······························································································································ 66

Configuration procedure ··························································································································· 66

Configuring nesting ······················································································ 69

Configuration procedure··································································································································· 69

Nesting configuration example ························································································································· 69

Network requirements ······························································································································ 69

Configuration procedure ··························································································································· 70

Configuring traffic redirecting ······································································· 72

Configuration procedure··································································································································· 72

Traffic redirecting configuration example ········································································································· 73

Network requirements ······························································································································ 73

Configuration procedure ··························································································································· 73

Configuring global CAR ··············································································· 75

Overview ·························································································································································· 75

Aggregate CAR ········································································································································ 75

Hierarchical CAR ······································································································································ 75

Configuring aggregate CAR ····························································································································· 76

Configuring hierarchical CAR ··························································································································· 76

Displaying and maintaining global CAR ··········································································································· 77

Aggregate CAR configuration example ············································································································ 77

Network requirements ······························································································································ 77

Configuration procedure ··························································································································· 78

Configuring class-based accounting ···························································· 80

Configuration procedure··································································································································· 80

Class-based accounting configuration example ······························································································ 81

Network requirements ······························································································································ 81

Configuration procedure ··························································································································· 81

Appendixes ·································································································· 83

Appendix A Acronym········································································································································ 83

Appendix B Default priority maps ····················································································································· 83

Appendix C Introduction to packet precedence ······························································································· 84

IP precedence and DSCP values ············································································································· 84

802.1p priority ·········································································································································· 86

EXP values ··············································································································································· 86

Configuring time ranges ··············································································· 88

Configuration procedure··································································································································· 88

Displaying and maintaining time ranges ·········································································································· 88

Time range configuration example ··················································································································· 88

Document conventions and icons ································································ 90

Conventions ····················································································································································· 90

Network topology icons ···································································································································· 91

Support and other resources ······································································· 92

Accessing Hewlett Packard Enterprise Support······························································································· 92

Accessing updates ··········································································································································· 92

Websites ·················································································································································· 93

Customer self repair ································································································································· 93

Remote support ········································································································································ 93

Documentation feedback ························································································································· 93

iii

Index ············································································································ 95

iv

Configuring ACLs

Overview

An access control list (ACL) is a set of rules for identifying traffic based on criteria such as source IP address, destination IP address, and port number. The rules are also called permit or deny statements.

ACLs are primarily used for packet filtering. " Configuring packet filtering with ACLs " provides an

example. You can use ACLs in QoS, security, routing, and other modules for identifying traffic. The packet drop or forwarding decisions depend on the modules that use ACLs.

ACL types

Type

Basic ACLs

Advanced ACLs

Layer 2 ACLs

ACL number IP version Match criteria

IPv4 Source IPv4 address.

2000 to 2999

IPv6 Source IPv6 address.

IPv4

Source IPv4 address, destination IPv4 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields.

3000 to 3999

IPv6

Source IPv6 address, destination IPv6 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields.

4000 to 4999

User-defined ACLs 5000 to 5999

IPv4 and IPv6

IPv4 and IPv6

Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority, and link layer protocol type.

User specified matching patterns in protocol headers.

Numbering and naming ACLs

When creating an ACL, you must assign it a number or name for identification. You can specify an existing ACL by its number or name. Each ACL type has a unique range of ACL numbers.

For an IPv4 basic or advanced ACL, its ACL number or name must be unique in IPv4. For an IPv6 basic or advanced ACL, its ACL number and name must be unique in IPv6. For a Layer 2 or user-defined ACL, its number or name must be globally unique.

Match order

The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the matching result and action to take depend on the rule order.

The following ACL match orders are available:

• config —Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule with a higher ID. If you use this method, check the rules and their order carefully.

1

NOTE:

The match order of user-defined ACLs can only be config .

• auto —Sorts ACL rules in depth-first order. Depth-first ordering makes sure any subset of a rule

is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first

ordering uses to sort rules for each type of ACL.

Table 1 Sort ACL rules in depth-first order

ACL type

IPv4 basic ACL

Sequence of tie breakers

1. VPN instance.

2. More 0s in the source IPv4 address wildcard (more 0s means a narrower IPv4 address range).

3. Rule configured earlier.

IPv4 advanced ACL

IPv6 basic ACL

IPv6 advanced ACL

Layer 2 ACL

4. VPN instance.

5. Specific protocol number.

6. More 0s in the source IPv4 address wildcard mask.

7. More 0s in the destination IPv4 address wildcard.

8. Narrower TCP/UDP service port number range.

9. Rule configured earlier.

10. VPN instance.

11. Longer prefix for the source IPv6 address (a longer prefix means a narrower IPv6 address range).

12. Rule configured earlier.

13. VPN instance.

14. Specific protocol number.

15. Longer prefix for the source IPv6 address.

16. Longer prefix for the destination IPv6 address.

17. Narrower TCP/UDP service port number range.

18. Rule configured earlier.

19. More 1s in the source MAC address mask (more 1s means a smaller

MAC address).

20. More 1s in the destination MAC address mask.

21. Rule configured earlier.

A wildcard mask, also called an inverse mask, is a 32-bit binary number represented in dotted decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent "do care" bits, and the 1 bits represent "don't care" bits. If the "do care" bits in an IP address are identical to the "do care" bits in an IP address criterion, the IP address matches the criterion. All "don't care" bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask.

Rule numbering

ACL rules can be manually numbered or automatically numbered. This section describes how automatic ACL rule numbering works.

Rule numbering step

If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID.

The rule numbering step sets the increment by which the system automatically numbers rules. For example, the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert between two rules.

2

By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of inserting rules in an ACL. This feature is important for a config-order ACL, where ACL rules are matched in ascending order of rule ID.

Automatic rule numbering and renumbering

The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the current highest rule ID, starting with 0.

For example, if the step is 5, and there are five rules numbered 0, 5, 9, 10, and 12, the newly defined rule is numbered 15. If the ACL does not contain a rule, the first rule is numbered 0.

Whenever the step changes, the rules are renumbered, starting from 0. For example, changing the step from 5 to 2 renumbers rules 5, 10, 13, and 15 as rules 0, 2, 4, and 6.

Fragment filtering with ACLs

Traditional packet filtering matches only first fragments of packets, and allows all subsequent non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks.

To avoid risks, the ACL feature is designed as follows:

•

Filters all fragments by default, including non-first fragments.

•

Allows for matching criteria modification for efficiency. For example, you can configure the ACL to filter only non-first fragments.

Configuration task list

Tasks at a glance

(Required.) Configure ACLs according to the characteristics of the packets to be matched:

•

Configuring a basic ACL



Configuring an IPv4 basic ACL



Configuring an IPv6 basic ACL

•

Configuring an advanced ACL



Configuring an IPv4 advanced ACL



Configuring an IPv6 advanced ACL

•

Configuring a Layer 2 ACL

•

Configuring a user-defined ACL

(Optional.) Copying an ACL

(Optional.) Configuring packet filtering with ACLs

Configuring a basic ACL

This section describes procedures for configuring IPv4 and IPv6 basic ACLs.

Configuring an IPv4 basic ACL

IPv4 basic ACLs match packets based only on source IP addresses.

To configure an IPv4 basic ACL:

Step

1. Enter system view.

Command system-view

Remarks

N/A

3

Step

2. Create an IPv4 basic ACL and enter its view.

Command acl basic { acl-number | name acl-name } [ match-order { auto | config } ] acl number acl-number

[ match-order { auto | config } ]

Remarks

By default, no ACLs exist.

The value range for a numbered

IPv4 basic ACL is 2000 to 2999.

Use the acl number acl-number or acl basic acl-number command to create a numbered

IPv4 basic ACL.

Use the acl number acl-number or acl basic acl-number command to enter the view of a numbered IPv4 basic ACL.

Use the acl basic name acl-name command to enter the view of a named IPv4 basic ACL.

3. (Optional.) Configure a description for the IPv4 basic

ACL.

4. (Optional.) Set the rule numbering step. description text step step-value

5. Create or edit a rule. rule [ rule-id ] { deny | permit }

[ counting | fragment | logging |

source { source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *

6. (Optional.) Add or edit a rule comment. rule rule-id comment text

By default, an IPv4 basic ACL does not have a description.

The default setting is 5.

By default, no IPv4 basic ACL rules exist.

The logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.

By default, no rule comment is configured.

Configuring an IPv6 basic ACL

IPv6 basic ACLs match packets based only on source IP addresses.

To configure an IPv6 basic ACL:

Step

1. Enter system view.

Command system-view

2. Create an IPv6 basic ACL view and enter its view. acl ipv6 basic { acl-number | name acl-name } [ match-order

{ auto | config } ] acl ipv6 number acl-number

[ match-order { auto | config } ]

Remarks

N/A

By default, no ACLs exist.

The value range for a numbered

IPv6 basic ACL is 2000 to 2999.

Use the acl ipv6 number acl-number or acl ipv6 basic acl-number command to create a numbered IPv6 basic ACL.

Use the acl ipv6 number acl-number or acl ipv6 basic acl-number command to enter the view of a numbered IPv6 basic

ACL.

Use the acl ipv6 basic name acl-name command to enter the view of a named IPv6 basic ACL.

4

Step

3. (Optional.) Configure a description for the IPv6 basic

ACL.

4. (Optional.) Set the rule numbering step.

Command description text step step-value

5. Create or edit a rule. rule [ rule-id ] { deny | permit }

[ counting | logging | routing | source { source-address source-prefix | source-address / source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *

6. (Optional.) Add or edit a rule comment. rule rule-id comment text

Remarks

By default, an IPv6 basic ACL does not have a description.

The default setting is 5.

By default, no IPv6 basic ACL rules exist.

The logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.

By default, no rule comment is configured.

Configuring an advanced ACL

This section describes procedures for configuring IPv4 and IPv6 advanced ACLs.

Configuring an IPv4 advanced ACL

IPv4 advanced ACLs match packets based on the following criteria:

•

Source IP addresses.

•

Destination IP addresses.

•

Packet priorities.

•

Protocol numbers.

•

Other protocol header information, such as TCP/UDP source and destination port numbers,

TCP flags, ICMP message types, and ICMP message codes.

Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.

To configure an IPv4 advanced ACL:

Step

1. Enter system view.

Command system-view

Remarks

N/A

5

Step

2. Create an IPv4 advanced

ACL and enter its view.

Command acl advanced { acl-number | name acl-name } [ match-order

{ auto | config } ] acl number acl-number

[ match-order { auto | config } ]

Remarks

By default, no ACLs exist.

The value range for a numbered

IPv4 advanced ACL is 3000 to

3999.

Use the acl number acl-number or acl advanced acl-number command to create a numbered

IPv4 advanced ACL.

Use the acl number acl-number or acl advanced acl-number command to enter the view of a numbered IPv4 advanced ACL.

Use the acl advanced name acl-name command to enter the view of a named IPv4 advanced

ACL.

3. (Optional.) Configure a description for the IPv4 advanced ACL.

4. (Optional.) Set the rule numbering step. description step text step-value

By default, an IPv4 advanced ACL does not have a description.

The default setting is 5.

5. Create or edit a rule.

6. (Optional.) Add or edit a rule comment. rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination

{ dest-address dest-wildcard | any } | destination-port operator port1 [ port2 ] | { dscp dscp |

{ precedence precedence | tos tos } * } | fragment | icmp-type

{ icmp-type [ icmp-code ] | icmp-message } | logging | qos-local-id local-id-value | source { source-address source-wildcard | any } | source-port operator port1

[ port2 ] | time-range time-range-name | vpn-instance vpn-instance-name ] *

By default, no IPv4 advanced ACL rules exist.

The logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging. rule rule-id comment text

By default, no rule comment is configured.

Configuring an IPv6 advanced ACL

IPv6 advanced ACLs match packets based on the following criteria:

•

Source IPv6 addresses.

•

Destination IPv6 addresses.

•

Packet priorities.

•

Protocol numbers.

•

Other protocol header fields such as the TCP/UDP source port number, TCP/UDP destination port number, ICMPv6 message type, and ICMPv6 message code.

6

Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.

To configure an IPv6 advanced ACL:

Step

1. Enter system view.

2. Create an IPv6 advanced

ACL and enter its view.

Command system-view

Remarks

N/A acl ipv6 advanced { acl-number | name acl-name } [ match-order

{ auto | config } ] acl ipv6 number acl-number

[ match-order { auto | config } ]

By default, no ACLs exist.

The value range for a numbered

IPv6 advanced ACL is 3000 to

3999.

Use the acl ipv6 number acl-number or acl ipv6 advanced acl-number command to create a numbered IPv6 advanced ACL.

Use the acl ipv6 number acl-number or acl ipv6 advanced acl-number command to enter the view of a numbered IPv6 advanced ACL.

Use the acl ipv6 advanced name acl-name command to enter the view of a named IPv6 advanced

ACL.

3. (Optional.) Configure a description for the IPv6 advanced ACL.

4. (Optional.) Set the rule numbering step. description step text step-value

By default, an IPv6 advanced ACL does not have a description.

The default setting is 5.

5. Create or edit a rule.

6. (Optional.) Add or edit a rule comment. rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination

{ dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port operator port1

[ port2 ] | dscp dscp | flow-label flow-label-value | icmp6-type

{ icmp6-type icmp6-code | icmp6-message } | logging | qos-local-id local-id-value | routing | hop-by-hop [ type hop-type ] | source

{ source-address source-prefix |

source-address/source-prefix | any } | source-port operator port1

[ port2 ] | time-range time-range-name | vpn-instance vpn-instance-name ] *

By default, no IPv6 advanced ACL rules exist.

The logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging. rule rule-id comment text

By default, no rule comment is configured.

Configuring a Layer 2 ACL

Layer 2 ACLs, also called Ethernet frame header ACLs, match packets based on Layer 2 Ethernet header fields, such as:

7

•

Source MAC address.

•

Destination MAC address.

•

802.1p priority (VLAN priority).

•

Link layer protocol type.

To configure a Layer 2 ACL:

Step

1. Enter system view.

2. Create a Layer 2 ACL and enter its view.

Command system-view

Remarks

N/A acl mac { acl-number | name acl-name } [ match-order { auto | config } ] acl number acl-number

[ match-order { auto | config } ]

By default, no ACLs exist.

The value range for a numbered

Layer 2 ACL is 4000 to 4999.

Use the acl number acl-number or acl mac acl-number command to create a numbered Layer 2

ACL.

Use the acl number acl-number or acl mac acl-number command to enter the view of a numbered

Layer 2 ACL.

Use the acl mac name acl-name command to enter the view of a named Layer 2 ACL.

3. (Optional.) Configure a description for the Layer 2

ACL.

4. (Optional.) Set the rule numbering step. description text step step-value

By default, a Layer 2 ACL does not have a description.

The default setting is 5.

5. Create or edit a rule.

6. (Optional.) Add or edit a rule comment. rule [ rule-id ] { deny | permit }

[ cos dot1p | counting | dest-mac dest-address dest-mask | { lsap lsap-type lsap-type-mask | type protocol-type protocol-type-mask } | source-mac source-address source-mask | time-range time-range-name ] *

By default , no Layer 2 ACL rules exist. rule rule-id comment text

By default, no rule comment is configured.

Configuring a user-defined ACL

User-defined ACLs allow you to customize rules based on information in protocol headers. You can define a user-defined ACL to match packets. A specific number of bytes after an offset (relative to the specified header) are compared against a match pattern after being ANDed with a match pattern mask.

To configure a user-defined ACL:

Step

1. Enter system view.

Command system-view

Remarks

N/A

8

Step

2. Create a user-defined ACL and enter its view.

Command acl user-defined { acl-number | name acl-name } acl number acl-number

[ match-order { auto | config } ]

Remarks

By default, no ACLs exist.

The value range for a numbered user-defined ACL is 5000 to 5999.

Use the acl number acl-number or acl user-defined acl-number command to create a numbered user-defined ACL.

Use the acl number acl-number or acl user-defined acl-number command to enter the view of a numbered user-defined ACL.

Use the acl user-defined name acl-name command to enter the view of a named user-defined

ACL.

By default, a user-defined ACL does not have a description.

3. (Optional.) Configure a description for the user-defined ACL. description text

4. Create or edit a rule. rule [ rule-id ] { deny | permit }

[ { l2 rule-string rule-mask offset }&<1-8> ] [ counting |

time-range time-range-name ] *

5. (Optional.) Add or edit a rule comment. rule rule-id comment text

By default, no user-defined ACL rules exist.

By default, no rule comment is configured.

Copying an ACL

You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL) has the same properties and content as the source ACL, but uses a different number or name than the source ACL.

To successfully copy an ACL, make sure:

•

The destination ACL number is from the same type as the source ACL number.

•

The source ACL already exists, but the destination ACL does not.

To copy an ACL:

Step

1. Enter system view.

2. Copy an existing ACL to create a new ACL.

Command system-view acl [ ipv6 | mac | user-defined ] copy

{ source-acl-number | name source-acl-name } to

{ dest-acl-number | name dest-acl-name }

Configuring packet filtering with ACLs

This section describes procedures for using an ACL to filter packets. For example, you can apply an

ACL to an interface to filter incoming or outgoing packets.

9

Applying an ACL to an interface for packet filtering

Step

1. Enter system view.

2. Enter interface view.

Command system-view

interface interface-type interface-number

3. Apply an ACL to the interface to filter packets. packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } { inbound | outbound } [ hardware-count ]

Remarks

N/A

N/A

By default, an interface does not filter packets.

Configuring the applicable scope of packet filtering on a

VLAN interface

You can configure the packet filtering on a VLAN interface to filter the following packets:

•

Packets forwarded at Layer 3 by the VLAN interface.

•

All packets, including packets forwarded at Layer 3 by the VLAN interface and packets forwarded at Layer 2 by the physical ports associated with the VLAN interface.

To configure the applicable scope of packet filtering on a VLAN interface:

Step

1. Enter system view.

2. Create a VLAN interface and enter its view.

Command system-view interface vlan-interface

vlan-interface-id

Remarks

N/A

If the VLAN interface already exists, you directly enter its view.

By default, no VLAN interface exists.

3. Specify the applicable scope of packet filtering on the VLAN interface. packet-filter filter [ route | all ]

By default, the packet filtering filters all packets.

Configuring logging and SNMP notifications for packet filtering

You can configure the ACL module to generate log entries or SNMP notifications for packet filtering and output them to the information center or SNMP module at the output interval. The log entry or notification records the number of matching packets and the matched ACL rules. If an ACL is matched for the first time, the device immediately outputs a log entry or notification to record the matching packet.

For more information about the information center and SNMP, see Network Management and

Monitoring Configuration Guide.

To configure logging and SNMP notifications for packet filtering:

Step

1. Enter system view.

Command system-view

Remarks

N/A

10

Step Command

2. Set the interval for outputting packet filtering logs or notifications. acl { logging | trap } interval

interval

Setting the packet filtering default action

Remarks

The default setting is 0 minutes.

By default, the device does not generate log entries or SNMP notifications for packet filtering.

Step

1. Enter system view.

2. Set the packet filtering default action to deny.

Command system-view packet-filter default deny

Remarks

N/A

By default, the packet filter permits packets that do not match any ACL rule to pass.

Displaying and maintaining ACLs

Execute display commands in any view and reset commands in user view.

Task

Display ACL configuration and match statistics.

Display ACL application information for packet filtering (in standalone mode).

Display ACL application information for packet filtering (in IRF mode).

Display match statistics and default action statistics for packet filtering ACLs.

Display the accumulated statistics for packet filtering ACLs.

Display detailed ACL packet filtering information (in standalone mode).

Display detailed ACL packet filtering information (in IRF mode).

Command display acl [ ipv6 | mac | user-defined ] { acl-number | all | name acl-name } display packet-filter { interface [ interface-type interface-number ] [ inbound | outbound ] | interface vlan-interface vlan-interface-number [ inbound | outbound ]

[ slot slot-number ] } display packet-filter { interface [ interface-type interface-number ] [ inbound | outbound ] | interface vlan-interface vlan-interface-number [ inbound | outbound ]

[ chassis chassis-number slot slot-number ] } display packet-filter statistics interface interface-type interface-number { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ brief ] display packet-filter statistics sum { inbound | outbound }

[ ipv6 | mac | user-defined ] { acl-number | name acl-name }

[ brief ] display packet-filter verbose interface interface-type interface-number { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ slot slot-number ] display packet-filter verbose interface interface-type interface-number { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ chassis chassis-number slot slot-number ]

Display QoS and ACL resource usage (in standalone mode).

Display QoS and ACL resource usage (in

IRF mode).

Clear ACL statistics. display qos-acl resource [ slot slot-number ] display qos-acl resource [ chassis chassis-number slot slot-number ] reset acl [ ipv6 | mac | user-defined ] counter { acl-number | all | name acl-name }

11

Task

Clear match statistics, accumulated match statistics, and default action statistics for packet filtering ACLs.

Command reset packet-filter statistics interface [ interface-type interface-number ] { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ]

ACL configuration examples

Interface-based packet filtering configuration example

Network requirements

A company interconnects its departments through the device. Configure packet filtering to:

•

Permit access from the President's office at any time to the financial database server.

•

Permit access from the Finance department to the financial database server only during working hours (from 8:00 to 18:00) on working days.

•

Deny access from any other department to the financial database server.

Figure 1 Network diagram

Financial database server

192.168.0.100/24

GE1/0/2

Device

GE1/0/1

GE1/0/4

GE1/0/3

President's office

192.168.1.0/24

Configuration procedure

Financial department

192.168.2.0/24

Marketing department

192.168.3.0/24

# Create a periodic time range from 8:00 to 18:00 on working days.

<Device> system-view

[Device] time-range work 08:0 to 18:00 working-day

# Create an IPv4 advanced ACL numbered 3000.

[Device] acl advanced 3000

# Configure a rule to permit access from the President's office to the financial database server.

[Device-acl-ipv4-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination

192.168.0.100 0

# Configure a rule to permit access from the Finance department to the financial database server during working hours.

[Device-acl-ipv4-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination

192.168.0.100 0 time-range work

12

# Configure a rule to deny access to the financial database server.

[Device-acl-ipv4-adv-3000] rule deny ip source any destination 192.168.0.100 0

[Device-acl-ipv4-adv-3000] quit

# Apply IPv4 advanced ACL 3000 to filter outgoing packets on interface GigabitEthernet 1/0/1.

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] packet-filter 3000 outbound

[Device-GigabitEthernet1/0/1] quit

Verifying the configuration

# Verify that a PC in the Finance department can ping the financial database server during working hours. (All PCs in this example use Windows XP).

C:\> ping 192.168.0.100

Pinging 192.168.0.100 with 32 bytes of data:

Reply from 192.168.0.100: bytes=32 time=1ms TTL=255

Reply from 192.168.0.100: bytes=32 time<1ms TTL=255

Reply from 192.168.0.100: bytes=32 time<1ms TTL=255

Reply from 192.168.0.100: bytes=32 time<1ms TTL=255

Ping statistics for 192.168.0.100:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms

# Verify that a PC in the Marketing department cannot ping the financial database server during working hours.

C:\> ping 192.168.0.100

Pinging 192.168.0.100 with 32 bytes of data:

Request timed out.

Request timed out.

Request timed out.

Request timed out.

Ping statistics for 192.168.0.100:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

# Display configuration and match statistics for IPv4 advanced ACL 3000 on the device during working hours.

[Device] display acl 3000

Advanced IPv4 ACL 3000, 3 rules,

ACL's step is 5

rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100 0

rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100 0 time-range work

(Active)

rule 10 deny ip destination 192.168.0.100 0

The output shows that rule 5 is active.

13

QoS overview

In data communications, Quality of Service (QoS) provides differentiated service guarantees for diversified traffic in terms of bandwidth, delay, jitter, and drop rate, all of which can affect QoS.

QoS manages network resources and prioritizes traffic to balance system resources.

The following section describes typical QoS service models and widely used QoS techniques.

QoS service models

This section describes several typical QoS service models.

Best-effort service model

The best-effort model is a single-service model. The best-effort model is not as reliable as other models and does not guarantee delay-free delivery.

The best-effort service model is the default model for the Internet and applies to most network applications. It uses the First In First Out (FIFO) queuing mechanism.

IntServ model

The integrated service (IntServ) model is a multiple-service model that can accommodate diverse

QoS requirements. This service model provides the most granularly differentiated QoS by identifying and guaranteeing definite QoS for each data flow.

In the IntServ model, an application must request service from the network before it sends data.

IntServ signals the service request with the RSVP. All nodes receiving the request reserve resources as requested and maintain state information for the application flow. For more information about

RSVP, see MPLS Configuration Guide .

The IntServ model demands high storage and processing capabilities because it requires all nodes along the transmission path to maintain resource state information for each flow. This model is suitable for small-sized or edge networks. However, it is not suitable for large-sized networks, for example, the core layer of the Internet, where billions of flows are present.

DiffServ model

The differentiated service (DiffServ) model is a multiple-service model that can meet diverse QoS requirements. It is easy to implement and extend. DiffServ does not signal the network to reserve resources before sending data, as IntServ does.

QoS techniques overview

The QoS techniques include the following features:

•

Traffic classification.

•

Traffic policing.

•

Traffic shaping.

•

Rate limit.

•

Congestion management.

14

•

Congestion avoidance.

The following section briefly introduces these QoS techniques.

All QoS techniques in this document are based on the DiffServ model.

Deploying QoS in a network

Figure 2 Position of the QoS techniques in a network

Traffic direction

Traffic classification

Traffic policing

Traffic policing

WAN

Congestion management

Congestion avoidance

Traffic shaping

Traffic policing

Congestion management

Congestion avoidance

Traffic shaping

Traffic policing

As shown in Figure 2 , traffic classification, traffic shaping, traffic policing, congestion management,

and congestion avoidance mainly implement the following functions:

•

Traffic classification —Uses match criteria to assign packets with the same characteristics to a traffic class. Based on traffic classes, you can provide differentiated services.

•

Traffic policing —Polices flows and imposes penalties to prevent aggressive use of network resources. You can apply traffic policing to both incoming and outgoing traffic of a port.

•

Traffic shaping —Adapts the output rate of traffic to the network resources available on the downstream device to eliminate packet drops. Traffic shaping usually applies to the outgoing traffic of a port.

•

Congestion management —Provides a resource scheduling policy to determine the packet forwarding sequence when congestion occurs. Congestion management usually applies to the outgoing traffic of a port.

•

Congestion avoidance —Monitors the network resource usage. It is usually applied to the outgoing traffic of a port. When congestion worsens, congestion avoidance reduces the queue length by dropping packets.

QoS processing flow in a device

Figure 3 briefly describes how the QoS module processes traffic.

1. Traffic classifier identifies and classifies traffic for subsequent QoS actions.

2. The QoS module takes various QoS actions on classified traffic as configured, depending on the traffic processing phase and network status. For example, you can configure the QoS module to perform the following functions:







Traffic policing for incoming traffic.

Traffic shaping for outgoing traffic.

Congestion avoidance before congestion occurs.

15

 Congestion management when congestion occurs.

Figure 3 QoS processing flow

Tokens

Drop

Classify the traffic CAR Remark

Other proce ssing

Packets received on the interface Classification

Token bucket

Traffic policing

Priority marking

Toekn

Drop Drop

Enqueue

Classify the traffic

CAR

GTS

Other proces sing

WRED

Packets to be sent out the interface

Classification

Token bucket

Traffic policing

Traffic shaping

Congestion avoidance

Queuing

Queue 0

Dequeue

Queue 1

Queue 2

Queue N

Queues

Congestion management

Transmit

16

Configuring a QoS policy

You can configure QoS by using the MQC approach or non-MQC approach. Some features support both approaches, but some support only one.

Non-MQC approach

In the non-MQC approach, you configure QoS service parameters without using a QoS policy. For example, you can use the rate limit feature to set a rate limit on an interface without using a QoS policy.

MQC approach

In the modular QoS configuration (MQC) approach, you configure QoS service parameters by using

QoS policies. A QoS policy defines the shaping, policing, or other QoS actions to take on different classes of traffic. It is a set of class-behavior associations.

A traffic class is a set of match criteria for identifying traffic, and it uses the AND or OR operator.

•

If the operator is AND, a packet must match all the criteria to match the traffic class.

•

If the operator is OR, a packet matches the traffic class if it matches any of the criteria in the traffic class.

A traffic behavior defines a set of QoS actions to take on packets, such as priority marking and redirect.

By associating a traffic behavior with a traffic class in a QoS policy, you apply QoS actions in the traffic behavior to the traffic class.

Configuration procedure diagram

Figure 4 shows how to configure a QoS policy.

Figure 4 QoS policy configuration procedure

Define a class

Define a behavior

Define a policy

Apply the policy

To an interface

To a VLAN

Globally

To a control plane

17

Defining a traffic class

Step

1. Enter system view.

2. Create a traffic class and enter traffic class view.

3. (Optional.) Configure a description for the traffic class.

4. Configure match criteria.

Command system-view traffic classifier classifier-name

[ operator { and | or } ]

Remarks

N/A

By default, no traffic class exists. description text

if-match match-criteria

By default, no description is configured for a traffic class.

By default, no match criterion is configured.

Defining a traffic behavior

A traffic behavior is a set of QoS actions (such as traffic filtering, shaping, policing, and priority marking) to take on a traffic class.

To define a traffic behavior:

Step

1. Enter system view.

Command system-view

2. Create a traffic behavior and enter traffic behavior view.

traffic behavior behavior-name

3. Configure actions in the traffic behavior.

See the subsequent chapters, depending on the purpose of the traffic behavior: traffic policing, traffic filtering, priority marking, traffic accounting, and so on.

Remarks

N/A

By default, no traffic behavior exists.

By default, no action is configured for a traffic behavior.

Defining a QoS policy

To perform actions defined in a behavior for a class of packets, associate the class with the behavior in a QoS policy.

When associating a class with a behavior, you can insert the class before an existing class in the

QoS policy.

When an ACL is used by a class for traffic classification, the actions (permit or deny) in ACL rules are ignored, and the actions in the associated traffic behavior are performed.

To associate a traffic class with a traffic behavior in a QoS policy:

Step

1. Enter system view.

2. Create a QoS policy and enter QoS policy view.

Command system-view qos policy policy-name

Remarks

N/A

By default, no QoS policy exists.

18

Step Command

3. Associate a traffic class with a traffic behavior to create a class-behavior association in the QoS policy.

classifier classifier-name

behavior behavior-name

[ insert-before before-classifier-name | mode dcbx ] *

Remarks

By default, a traffic class is not associated with a traffic behavior.

Repeat this step to create more class-behavior associations.

The mode dcbx keyword specifies that a class-behavior association applies only to DCBX.

For more information about

DCBX, see Layer 2—LAN

Switching Configuration Guide .

Applying the QoS policy

You can apply a QoS policy to the following destinations:

•

Interface —The QoS policy takes effect on the traffic sent or received on the interface.

•

VLAN —The QoS policy takes effect on the traffic sent or received on all ports in the VLAN.

•

Globally —The QoS policy takes effect on the traffic sent or received on all ports.

•

Control plane —The QoS policy takes effect on the traffic received on the control plane.

The QoS policies applied to an interface, a VLAN, and globally are in descending priority order.

When an interface transmits or receives a packet, the packet is first checked against the match criteria in the QoS policy applied to the interface. If a match is found, the QoS policies applied to the

VLAN and globally are ignored.

You can modify traffic classes, traffic behaviors, and class-behavior associations in a QoS policy even after it is applied. If a traffic class uses an ACL for traffic classification, you can delete or modify the ACL.

Applying the QoS policy to an interface

A QoS policy can be applied to multiple interfaces. However, only one QoS policy can be applied to one direction (inbound or outbound) of an interface.

The QoS policy applied to the outgoing traffic on an interface does not regulate local packets. Local packets refer to critical protocol packets sent by the local system for operation maintenance. The most common local packets include link maintenance, routing, LDP, RSVP, and SSH packets.

To apply the QoS policy to an interface:

Step

1. Enter system view.

2. Enter interface view.

3. Apply the QoS policy to the interface.

Command system-view interface interface-type interface-number

qos apply policy policy-name

{ inbound | outbound }

Remarks

N/A

Settings in interface view take effect on the current interface.

By default, no QoS policy is applied to an interface.

Applying the QoS policy to a VLAN

You can apply a QoS policy to a VLAN to regulate traffic of the VLAN.

19

Configuration restrictions and guidelines

When you apply a QoS policy to a VLAN, follow these restrictions and guidelines:

•

QoS policies cannot be applied to dynamic VLANs, including VLANs created by GVRP.

•

When you apply a QoS policy to VLANs, the QoS policy is applied to the specified VLANs on all interface cards. If the hardware resources of an interface card are insufficient, applying a QoS policy to VLANs might fail on the interface card. The system does not automatically roll back the

QoS policy configuration already applied to the MPU or other interface cards. To ensure consistency, use the undo qos vlan-policy vlan command to manually remove the QoS policy configuration applied to them.

Configuration procedure

To apply the QoS policy to a VLAN:

Step

1. Enter system view.

2. Apply the QoS policy to

VLANs.

Command system-view qos vlan-policy policy-name vlan vlan-id-list { inbound | outbound }

Remarks

N/A

By default, no QoS policy is applied to a VLAN.

Applying the QoS policy globally

You can apply a QoS policy globally to the inbound or outbound direction of all interfaces.

If the hardware resources of an interface card are insufficient, applying a QoS policy globally might fail on the interface card. The system does not automatically roll back the QoS policy configuration already applied to the MPU or other interface cards. To ensure consistency, you must use the undo qos apply policy global command to manually remove the QoS policy configuration applied to them.

To apply the QoS policy globally:

Step

1. Enter system view.

2. Apply the QoS policy globally.

Command system-view qos apply policy policy-name global { inbound | outbound }

Remarks

N/A

By default, no QoS policy is applied globally.

Applying the QoS policy to a control plane

A switch provides the data plane and the control plane.

•

Data plane —The units at the data plane are responsible for receiving, transmitting, and switching (forwarding) packets, such as various dedicated forwarding chips. They deliver super processing speeds and throughput.

•

Control plane —The units at the control plane are processing units running most routing and switching protocols. They are responsible for protocol packet resolution and calculation, such as CPUs. Compared with data plane units, the control plane units allow for great packet processing flexibility but have lower throughput.

When the data plane receives packets that it cannot recognize or process, it transmits them to the control plane. If the transmission rate exceeds the processing capability of the control plane, the control plane will be busy handling undesired packets. As a result, the control plane will fail to handle legitimate packets correctly or timely. As a result, protocol performance is affected.

20

To address this problem, apply a QoS policy to the control plane to take QoS actions, such as traffic filtering or rate limiting, on inbound traffic. This makes sure the control plane can correctly receive, transmit, and process packets.

The predefined control plane QoS policy uses protocol types or protocol group types to identify packets sent to the control plane. You can use protocol types or protocol group types in if-match commands in traffic class view for traffic classification. Then you can reconfigure traffic behaviors for these traffic classes as required. You can use the display qos policy control-plane pre-defined command to display predefined control plane QoS policies.

If the hardware resources of an interface card are insufficient, applying a QoS policy to the control plane might fail on the interface card. The system does not automatically roll back the QoS policy configuration already applied to the MPU or other interface cards. To ensure consistency, you must use the undo qos apply policy command to manually remove the QoS policy configuration applied to them.

Configuration procedure

To apply the QoS policy to the control plane:

Remarks

N/A

Step

1. Enter system view.

Command system-view

2. Enter control plane view.

In standalone mode: control-plane slot slot-number

In IRF mode: control-plane chassis chassis-number slot slot-number

3. Apply the QoS policy to the control plane.

qos apply policy policy-name inbound

QoS policies cannot be applied to the control planes of MPUs and switching fabric modules.

By default, no QoS policy is applied to a control plane.

Displaying and maintaining QoS policies

Execute display commands in any view and reset commands in user view.

Task

(In standalone mode.) Display traffic class configuration.

(In IRF mode.) Display traffic class configuration.

(In standalone mode.) Display traffic behavior configuration.

(In IRF mode.) Display traffic behavior configuration.

(In standalone mode.) Display QoS and

ACL resource usage.

(In IRF mode.) Display QoS and ACL resource usage.

(In standalone mode.) Display QoS policy configuration.

(In IRF mode.) Display QoS policy configuration.

Command display traffic classifier user-defined [ classifier-name ] [ slot slot-number ] display traffic classifier user-defined [ classifier-name ]

[ chassis chassis-number slot slot-number ] display traffic behavior user-defined [ behavior-name ] [ slot slot-number ] display traffic behavior user-defined [ behavior-name ]

[ chassis chassis-number slot slot-number ] display qos-acl resource [ slot slot-number ] display qos-acl resource [ chassis chassis-number slot slot-number ] display qos policy user-defined [ policy-name [ classifier classifier-name ] ] [ slot slot-number ] display qos policy user-defined [ policy-name [ classifier classifier-name ] ] [ chassis chassis-number slot slot-number ]

21

Task

Display information about QoS policies applied to interfaces.

Command display qos policy interface [ interface-type interface-number ]

[ inbound | outbound ]

(In standalone mode.) Display information about QoS policies applied to VLANs. display qos vlan-policy

[ slot slot-number ] [

{ name inbound | policy-name outbound ]

| vlan vlan-id }

(In IRF mode.) Display information about

QoS policies applied to VLANs. display qos vlan-policy { name policy-name | vlan [ vlan-id ] }

[ chassis chassis-number slot slot-number ] [ inbound | outbound ]

(In standalone mode.) Display information about QoS policies applied globally. display qos policy global outbound ]

[ slot slot-number ] [ inbound |

(In IRF mode.) Display information about

QoS policies applied globally. display qos policy global [ chassis chassis-number slot slot-number ] [ inbound | outbound ]

(In standalone mode.) Display information about QoS policies applied to a control plane. display qos policy control-plane slot slot-number

(In IRF mode.) Display information about

QoS policies applied to a control plane. display qos policy control-plane chassis chassis-number slot slot-number

(In standalone mode.) Display information about the predefined QoS policy applied to the control plane. display qos policy control-plane pre-defined [ slot slot-number ]

(In IRF mode.) Display information about the predefined QoS policy applied to the control plane . display qos policy control-plane pre-defined [ chassis chassis-number slot slot-number ]

Clear statistics for QoS policies applied to VLANs. reset qos vlan-policy [ vlan vlan-id ] [ inbound | outbound ]

Clear statistics for QoS policies applied globally.

(In IRF mode.) Clear statistics for the

QoS policy applied to a control plane. reset qos policy global [ inbound | outbound ]

(In standalone mode.) Clear statistics for the QoS policy applied to a control plane.

reset qos policy control-plane slot slot-number reset qos policy control-plane chassis chassis-number slot

slot-number

22

Configuring priority mapping

Overview

When a packet arrives, the switch assigns a set of QoS priority parameters to the packet based on either of the following:

•

A priority field carried in the packet.

•

The port priority of the incoming port.

This process is called priority mapping. During this process, the device can modify the priority of the packet according to the priority mapping rules. The set of QoS priority parameters decides the scheduling priority and forwarding priority of the packet.

Priority mapping is implemented with priority maps and involves the following priorities:

•

802.1p priority.

•

DSCP.

•

EXP.

•

IP precedence.

•

Local precedence.

•

Drop priority.

Introduction to priorities

Priorities include the following types: priorities carried in packets, and priorities locally assigned for scheduling only.

Packet-carried priorities include 802.1p priority, DSCP precedence, IP precedence, and EXP. These priorities have global significance and affect the forwarding priority of packets across the network.

For more information about these priorities, see " Appendixes ."

Locally assigned priorities only have local significance. They are assigned by the device only for scheduling. These priorities include the local precedence, drop priority, and user priority, as follows:

•

Local precedence —Used for queuing. A local precedence value corresponds to an output queue. A packet with higher local precedence is assigned to a higher priority output queue to be preferentially scheduled.

•

Drop priority —Used for making packet drop decisions. Packets with the highest drop priority are dropped preferentially.

Priority maps

The switch provides the following types of priority maps:

• dot1p-dp —802.1p-drop priority map.

• dot1p-exp —802.1p-EXP priority map.

• dot1p-lp —802.1p-local priority map.

• dscp-dp —DSCP-drop priority map.

• dscp-dscp —DSCP-DSCP priority map.

• exp-dot1p —EXP-802.1p priority map.

23

By looking through a priority map, the switch decides which priority value to assign to a packet for subsequent packet processing.

The default priority maps (as shown in Appendix B Default priority maps ) are available for priority

mapping. They are adequate in most cases. If a default priority map cannot meet your requirements, you can modify the priority map as required.

Priority trust mode

The priority trust mode determines which priority is used for priority map lookup. The switch provides the following priority trust modes:

•

Using the 802.1p priority carried in packets for priority mapping.

Table 2 Priority mapping results (when the default dot1p-lp priority map is used)

5

6

7

1

2

3

4

802.1p priority

0

5

6

7

0

1

3

4

Local precedence

2

5

6

7

0

1

3

4

Queue ID

2

NOTE:

When the 802.1p priority carried in packets is trusted, the port priority is used for priority mapping for packets that do not carry VLAN tags (namely, do not carry 802.1p priorities). The

priority mapping results are the same as those in Table 2 .

•

Using the DSCP carried in packets for priority mapping.

Table 3 Priority mapping results (when the default priority maps are used)

DSCP value

0 to 7

8 to 15

16 to 23

24 to 31

32 to 39

40 to 47

48 to 55

56 to 63

0

4

5

1

3

6

7

Local precedence

2

5

6

7

3

4

0

1

Queue ID

2

Priority mapping process

The switch marks the scheduling priorities for incoming Ethernet packets according to the priority

trust mode of the receiving interface and the 802.1Q tagging status of packets, as shown in Figure 5 .

24

Figure 5 Priority mapping process for an Ethernet packet

Receive a packet on a port

Should the

packet be marked with local precedence or drop

priority?

No

Yes

Which priority is trusted on the port?

DSCP in packets

Mark it with local precedence and drop priority

802.1p in packets

Look up dscp-dp and dscp-dscp priority maps

Use port priority as

802.1p priority for priority mapping

No

Look up dot1p-dp and dot1p-lp priority maps

Is the packet

802.1q tagged?

Yes

Look up dot1p-dp and dot1p-lp priority maps

Mark the packet with local precedence and drop priority

Mark the packet with local precedence and drop priority

Mark the packet with 802.1p priority, drop priority, and new DSCP precedence

Look up dot1p-lp priority map

Mark the packet with local precedence

Schedule the packet according to its local precedence and drop priority

The switch marks a received MPLS packet with a scheduling priority based on the priority trust mode

and the packet EXP value, as shown in Figure 6 .

25

Figure 6 Priority mapping process for an MPLS packet

Receive a packet with MPLS labels

Should the

packet be marked with local precedence and

drop priority?

No

Yes

Look up the exp-dot1p priority map

Mark the packet with 802.1p priority

Mark it with local precedence and drop priority

Look up the dot1p-dp priority map

Mark the packet with drop priority

Look up the dot1p-lp priority map

Mark the packet with local precedence

Schedule the packet based on local precedence and drop priority

Priority mapping configuration task list

Tasks at a glance

(Optional.) Configuring a priority map

(Optional.) Configuring an interface to trust packet priority for priority mapping

(Optional.) Changing the port priority of an interface

Configuring a priority map

This feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this section collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN

Switching Configuration Guide ).

To configure a priority map:

26

Step

1. Enter system view.

2. Enter priority map view.

Command system-view qos map-table { dot1p-dp | dot1p-exp | dot1p-lp | dscp-dp | dscp-dscp | exp-dot1p }

Remarks

N/A

N/A

3. Configure mappings for the priority map.

import import-value-list export export-value

4. (Optional.) Manipulate

802.1p-to-EXP mapping application to outgoing MPLS labels. map export mpls-exp

By default, the default priority maps are used. For more information, see

" Appendixes ."

Newly configured mappings overwrite the old ones.

By default:

•

The 802.1p-to-EXP mappings are applied to the two added

MPLS labels of a packet if the packet comes from a private network and does not have

MPLS labels.

•

The 802.1p-to-EXP mappings are applied to the topmost (first)

MPLS label if the packet comes from the public network and has two MPLS labels.

Configuring an interface to trust packet priority for priority mapping

You can configure the switch to trust a particular priority field carried in packets for priority mapping.

When you configure the trusted packet priority type on an interface, use the following available keywords:

• dot1p —Uses the 802.1p priority of received packets for mapping.

• dscp —Uses the DSCP precedence of received IP packets for mapping.

Transport-facing interfaces and AC interfaces in a VXLAN network do not support the priority trust mode dscp . For information about VXLAN, see VXLAN Configuration Guide .

To configure the trusted packet priority type on an interface:

Step

1. Enter system view.

2. Enter interface view.

Command system-view interface interface-type interface-number

Remarks

N/A

N/A

3. Configure the trusted packet priority type.

qos trust { dot1p | dscp }

The default trusted packet priority type is dot1p .

Changing the port priority of an interface

If an interface does not trust any packet priority, the switch uses its port priority to look for priority parameters for incoming packets. By changing the port priority, you can prioritize traffic received on different interfaces.

27

To change the port priority of an interface:

Step

1. Enter system view.

2. Enter interface view.

3. Set the port priority of the interface.

Command system-view

Remarks

N/A interface interface-type interface-number N/A

qos priority priority-value The default setting is 0.

Displaying and maintaining priority mapping

Execute display commands in any view.

Task

Display priority map configuration.

Command display qos map-table [ dot1p-dp | dot1p-exp | dot1p-lp | dscp-dp

| dscp-dscp | exp-dot1p ]

Display the trusted packet priority type on an interface.

display qos trust interface [ interface-type interface-number ]

Priority mapping configuration examples

Port priority configuration example

Network requirements

As shown in Figure 7 , configure Switch C to preferentially process packets from Switch A to the

server when Ten-GigabitEthernet 1/0/3 of Switch C is congested.

Figure 7 Network diagram

Switch A

Internet

XGE

1/0

/1

XGE

1/0

/2

Switch C

XGE1/0/3

Server

Switch B

Configuration procedure

# Configure a higher port priority for Ten-GigabitEthernet 1/0/1 than Ten-GigabitEthernet 1/0/2.

<SwitchC> system-view

[SwitchC] interface Ten-GigabitEthernet 1/0/1

[SwitchC-Ten-GigabitEthernet1/0/1] qos priority 3

[SwitchC-Ten-GigabitEthernet1/0/1] quit

28

[SwitchC] interface Ten-GigabitEthernet 1/0/2

[SwitchC-Ten-GigabitEthernet1/0/2] qos priority 1

[SwitchC-Ten-GigabitEthernet1/0/2] quit

Priority map and priority marking configuration example

Network requirements

As shown in Figure 8 :

•

The Marketing department connects to Ten-GigabitEthernet 1/0/1 of the switch, which sets the

802.1p priority of traffic from the Marketing department to 3.

•

The R&D department connects to Ten-GigabitEthernet 1/0/2 of the switch, which sets the

802.1p priority of traffic from the R&D department to 4.

•

The Management department connects to Ten-GigabitEthernet 1/0/3 of the switch, which sets the 802.1p priority of traffic from the Management department to 5.

Configure port priority, 802.1p-to-local priority map, and priority marking to implement the plan as

described in Table 4 .

Table 4 Configuration plan

Traffic destination

Public servers

Internet

Traffic priority order

R&D department >

Management department > Marketing department

Management department > Marketing department > R&D department

Queuing plan

Traffic source

R&D department

Management department

4

Marketing department 2

R&D department 2

Output queue

6

Management department

6

Marketing department 4

Queue priority

High

Medium

Low

Low

High

Medium

29

Figure 8 Network diagram

Internet

Host Host

Server Server

Management department

Data server

XGE1/0/3

XGE1/0/2

XGE1/0/4

Switch

XGE1/0/1

R&D department

Host

Mail server Server

Public servers Marketing department

Configuration procedure

1. Configure trusting port priority:

# Set the port priority of Ten-GigabitEthernet 1/0/1 to 3.

<Switch> system-view

[Switch] interface Ten-GigabitEthernet 1/0/1

[Switch-Ten-GigabitEthernet1/0/1] qos priority 3

[Switch-Ten-GigabitEthernet1/0/1] quit

# Set the port priority of Ten-GigabitEthernet 1/0/2 to 4.

[Switch] interface Ten-GigabitEthernet 1/0/2

[Switch-Ten-GigabitEthernet1/0/2] qos priority 4

[Switch-Ten-GigabitEthernet1/0/2] quit

# Set the port priority of Ten-GigabitEthernet 1/0/3 to 5.

[Switch] interface Ten-GigabitEthernet 1/0/3

[Switch-Ten-GigabitEthernet1/0/3] qos priority 5

[Switch-Ten-GigabitEthernet1/0/3] quit

2. Configure the 802.1p-to-local priority map to map 802.1p priority values 3, 4, and 5 to local precedence values 2, 6, and 4, respectively.

This guarantees the R&D department, Management department, and Marketing department decreased priorities to access the public servers.

[Switch] qos map-table dot1p-lp

[Switch-maptbl-dot1p-lp] import 3 export 2

[Switch-maptbl-dot1p-lp] import 4 export 6

[Switch-maptbl-dot1p-lp] import 5 export 4

[Switch-maptbl-dot1p-lp] quit

30

3. Configuring priority marking:

# Create ACL 3000 to match HTTP packets.

[Switch] acl advanced 3000

[Switch-acl-ipv4-adv-3000] rule permit tcp destination-port eq 80

[Switch-acl-ipv4-adv-3000] quit

# Create a class named http , and use ACL 3000 as the match criterion.

[Switch] traffic classifier http

[Switch-classifier-http] if-match acl 3000

[Switch-classifier-http] quit

# Create a QoS policy named admin to mark HTTP packets of the Management department with local precedence 4.

[Switch] traffic behavior admin

[Switch-behavior-admin] remark dot1p 4

[Switch-behavior-admin] quit

[Switch] qos policy admin

[Switch-qospolicy-admin] classifier http behavior admin

[Switch-qospolicy-admin] quit

# Apply QoS policy admin to the inbound direction of Ten-GigabitEthernet 1/0/3.

[Switch] interface Ten-GigabitEthernet 1/0/3

[Switch-Ten-GigabitEthernet1/0/3] qos apply policy admin inbound

# Create a QoS policy named market to mark HTTP packets of the Marketing department with local precedence 5.

[Switch] traffic behavior market

[Switch-behavior-market] remark dot1p 5

[Switch-behavior-market] quit

[Switch] qos policy market

[Switch-qospolicy-market] classifier http behavior market

[Switch-qospolicy-market] quit

# Apply QoS policy market to the inbound direction of Ten-GigabitEthernet 1/0/1.

[Switch] interface Ten-GigabitEthernet 1/0/1

[Switch-Ten-GigabitEthernet1/0/1] qos apply policy market inbound

# Create a QoS policy named rd to mark HTTP packets of the R&D department with local precedence 3.

[Switch] traffic behavior rd

[Switch-behavior-rd] remark dot1p 3

[Switch-behavior-rd] quit

[Switch] qos policy rd

[Switch-qospolicy-rd] classifier http behavior rd

[Switch-qospolicy-rd] quit

# Apply QoS policy rd to the inbound direction of Ten-GigabitEthernet 1/0/2.

[Switch] interface Ten-GigabitEthernet 1/0/2

[Switch-Ten-GigabitEthernet1/0/2] qos apply policy rd inbound

31

Configuring traffic policing, GTS, and rate limit

Overview

Traffic policing helps assign network resources (including bandwidth) and increase network performance. For example, you can configure a flow to use only the resources committed to it in a certain time range. This avoids network congestion caused by burst traffic.

Traffic policing, Generic Traffic Shaping (GTS), and rate limit control the traffic rate and resource usage according to traffic specifications. You can use token buckets for evaluating traffic specifications.

Traffic evaluation and token buckets

Token bucket features

A token bucket is analogous to a container that holds a certain number of tokens. Each token represents a certain forwarding capacity. The system puts tokens into the bucket at a constant rate.

When the token bucket is full, the extra tokens cause the token bucket to overflow.

Evaluating traffic with the token bucket

A token bucket mechanism evaluates traffic by looking at the number of tokens in the bucket. If the number of tokens in the bucket is enough for forwarding the packets:

•

The traffic conforms to the specification (called conforming traffic).

•

The corresponding tokens are taken away from the bucket.

Otherwise, the traffic does not conform to the specification (called excess traffic).

A token bucket has the following configurable parameters:

•

Mean rate at which tokens are put into the bucket, which is the permitted average rate of traffic.

It is usually set to the committed information rate (CIR).

•

Burst size or the capacity of the token bucket. It is the maximum traffic size permitted in each burst. It is usually set to the committed burst size (CBS). The set burst size must be greater than the maximum packet size.

Each arriving packet is evaluated.

Complicated evaluation

You can set two token buckets, bucket C and bucket E, to evaluate traffic in a more complicated environment and achieve more policing flexibility. For example, traffic policing uses the following mechanisms:

•

Single rate two color —Uses one token bucket and the following parameters:





CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.

CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.

When a packet arrives, the following rules apply:



If bucket C has enough tokens to forward the packet, the packet is colored green.



Otherwise, the packet is colored red.

•

Single rate three color —Uses two token buckets and the following parameters:

32







CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.

CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.

EBS —Size of bucket E minus size of bucket C, which specifies the transient burst of traffic that bucket E can forward. The EBS cannot be 0. The size of E bucket is the sum of the CBS and EBS.

When a packet arrives, the following rules apply:

 If bucket C has enough tokens, the packet is colored green.



If bucket C does not have enough tokens but bucket E has enough tokens, the packet is colored yellow.



If neither bucket C nor bucket E has sufficient tokens, the packet is colored red.

•

Two rate three color —Uses two token buckets and the following parameters:







CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.

CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.

PIR —Rate at which tokens are put into bucket E, which specifies the average packet transmission or forwarding rate allowed by bucket E.



EBS —Size of bucket E, which specifies the transient burst of traffic that bucket E can forward.

When a packet arrives, the following rules apply:



If bucket C has enough tokens, the packet is colored green.





If bucket C does not have enough tokens but bucket E has enough tokens, the packet is colored yellow.

If neither bucket C nor bucket E has sufficient tokens, the packet is colored red.

Traffic policing

Traffic policing supports policing the inbound traffic and the outbound traffic.

A typical application of traffic policing is to supervise the specification of traffic entering a network and limit it within a reasonable range. Another application is to "discipline" the extra traffic to prevent aggressive use of network resources by an application. For example, you can limit bandwidth for

HTTP packets to less than 50% of the total. If the traffic of a session exceeds the limit, traffic policing

can drop the packets or reset the IP precedence of the packets. Figure 9 shows an example of

policing outbound traffic on an interface.

33

Figure 9 Traffic policing

Put tokens into the bucket at the set rate

Packets to be sent out this interface

Packets sent

Classify

Token bucket

Drop

Traffic policing is widely used in policing traffic entering the ISP networks. It can classify the policed traffic and take predefined policing actions on each packet depending on the evaluation result:

•

Forwarding the packet if the evaluation result is "conforming."

•

Dropping the packet if the evaluation result is "excess."

•

Forwarding the packet with its precedence re-marked if the evaluation result is "conforming."

GTS

GTS supports shaping the outbound traffic. GTS limits the outbound traffic rate by buffering exceeding traffic. You can use GTS to adapt the traffic output rate on a device to the input traffic rate of its connected device to avoid packet loss.

The differences between traffic policing and GTS are as follows:

•

Packets to be dropped with traffic policing are retained in a buffer or queue with GTS, as shown

in Figure 10 . When enough tokens are in the token bucket, the buffered packets are sent at an

even rate.

•

GTS can result in additional delay and traffic policing does not.

34

Figure 10 GTS

Packets to be sent through this interface

Tokens are put into the bucket at the set rate

Packets sent

Packet classification

Token bucket

Queue

Packets dropped

For example, in Figure 11 , Switch B performs traffic policing on packets from Switch A and drops

packets exceeding the limit. To avoid packet loss, you can perform GTS on the outgoing interface of

Switch A so that packets exceeding the limit are cached in Switch A. Once resources are released,

GTS takes out the cached packets and sends them out.

Figure 11 GTS application

Switch A Switch B

Physical link

Rate limit

The rate limit of an interface specifies the maximum rate for sending packets (including critical packets).

Rate limit also uses token buckets for traffic control. When rate limit is configured on an interface, a token bucket handles all packets to be sent through the interface for rate limiting. If enough tokens are in the token bucket, packets can be forwarded. Otherwise, packets are put into QoS queues for congestion management. In this way, the traffic passing the interface is controlled.

35

Figure 12 Rate limit implementation

Put tokens to the bucket at the set rate

Packets to be sent

Packets sent

Queue

Token bucket

Buffer

The token bucket mechanism limits traffic rate when accommodating bursts. It allows bursty traffic to be transmitted if enough tokens are available. If tokens are scarce, packets cannot be transmitted until efficient tokens are generated in the token bucket. It restricts the traffic rate to the rate for generating tokens.

Rate limit controls the total rate of all packets on an interface. It is easier to use than traffic policing in controlling the total traffic rate.

Configuring traffic policing

Step

1. Enter system view.

2. Create a traffic class and enter traffic class view.

3. Configure match criteria.

Command system-view traffic classifier classifier-name

[ operator { and | or } ]

Remarks

N/A

By default, no traffic class exists.

if-match match-criteria

By default, no match criterion is configured.

N/A 4. Return to system view. quit

5. Create a traffic behavior and enter traffic behavior view.

traffic behavior behavior-name

6. Configure a traffic policing action.

By default, no traffic behavior exists.

car cir committed-information-rate

[ cbs committed-burst-size [ ebs excess-burst-size ] ] [ green action

| red action | yellow action ] *

[ hierarchy-car hierarchy-car-name [ mode { and | or } ] ]

car cir committed-information-rate

[ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] [ green action | red action | yellow action ] *

[ hierarchy-car hierarchy-car-name [ mode { and | or } ] ]

By default, no traffic policing action is configured.

36

Step Command

7. Return to system view. quit

8. Create a QoS policy and enter QoS policy view.

9. Associate the traffic class with the traffic behavior in the QoS policy. qos policy policy-name classifier classifier-name

behavior behavior-name

10. Return to system view. quit

11. Apply the QoS policy.

•

Applying the QoS policy to an interface

•

Applying the QoS policy to a

VLAN

•

Applying the QoS policy globally

•

Applying the QoS policy to a control plane

12. (Optional.) Display traffic policing configuration. display traffic behavior user-defined [ behavior-name ]

Remarks

N/A

By default, no QoS policy exists.

By default, a traffic class is not associated with a traffic behavior.

N/A

Choose one of the application destinations as needed.

By default, no QoS policy is applied.

Available in any view.

Configuring GTS

This feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this section collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN

Switching Configuration Guide ).

The switch supports configuring queue-based GTS. In queue-based GTS, you set GTS parameters for packets of a queue.

To configure GTS:

Step

1. Enter system view.

Remarks

N/A

2. Enter interface view.

3. Configure GTS for a queue.

Command system-view interface interface-type interface-number qos gts queue queue-id cir

committed-information-rate [ cbs committed-burst-size ]

N/A

By default, GTS is not configured on an interface.

The granularity for GTS is 8 kbps.

Configuring the rate limit

This feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this section collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN

Switching Configuration Guide ).

The rate limit for an interface specifies the maximum rate of outgoing packets on the interface.

To configure the rate limit for an interface:

37

Step

1. Enter system view.

2. Enter interface view.

Command system-view interface interface-type interface-number

3. Configure the rate limit for the interface. qos lr outbound cir committed-information-rate [ cbs committed-burst-size ]

Remarks

N/A

N/A

By default, rate limiting is not configured on an interface.

The CIR must be an integral multiple of 8.

Displaying and maintaining traffic policing, GTS, and rate limit

Execute display commands in any view.

Task

(In standalone mode.) Display QoS and

ACL resource usage.

Command display qos-acl resource [ slot slot-number ]

(In IRF mode.) Display QoS and ACL resource usage.

Display traffic policing configuration. display qos-acl resource [ chassis chassis-number slot slot-number ] display traffic behavior user-defined [ behavior-name ]

Display GTS configuration and statistics for interfaces. display qos gts interface [ interface-type interface-number ]

Display rate limit configuration and statistics for interfaces. display qos lr interface [ interface-type interface-number ]

Traffic policing configuration example

Network requirements

As shown in Figure 13 , configure traffic policing on Ten-GigabitEthernet 1/0/1 of Switch A to meet the

following requirements.

•

Police the rate of packets from the server to 102400 kbps. The traffic below 102400 kbps is forwarded. The traffic above 102400 kbps is marked with IP precedence 0 and then forwarded.

•

Police the rate of packets from Host A to 25600 kbps. The traffic below 25600 kbps is forwarded.

The traffic above 25600 kbps is dropped.

Configure traffic policing on Ten-GigabitEthernet 1/0/1 and Ten-GigabitEthernet 1/0/2 of Switch B to meet the following requirements:

•

Limit the incoming traffic rate on Ten-GigabitEthernet 1/0/1 to 204800 kbps, and drop excess packets.

•

Limit the outgoing traffic rate on Ten-GigabitEthernet 1/0/2 to 102400 kbps, and drop excess packets.

38

Figure 13 Network diagram

Server

1.1.1.1/8 Ethernet

Host A

Internet

1.1.1.2/8 XGE1/0/1

Switch B

XGE1/0/2

XGE1/0/1

Switch A

XGE1/0/3

XGE1/0/2

Host B

Configuration procedure

1. Configure Switch A:

# Configure ACL 2001 and ACL 2002 to match the packets from the server and Host A, respectively.

[SwitchA] acl basic 2001

[SwitchA-acl-ipv4-basic-2001] rule permit source 1.1.1.1 0

[SwitchA-acl-ipv4-basic-2001] quit

[SwitchA] acl basic 2002

[SwitchA-acl-ipv4-basic-2002] rule permit source 1.1.1.2 0

[SwitchA-acl-ipv4-basic-2002] quit

# Create traffic classes named server and host , and use ACL 2001 and ACL 2002 as the match criteria, respectively.

[SwitchA] traffic classifier server

[SwitchA-classifier-server] if-match acl 2001

[SwitchA-classifier-server] quit

[SwitchA] traffic classifier host

[SwitchA-classifier-host] if-match acl 2002

[SwitchA-classifier-host] quit

# Create a traffic behavior named server , and configure traffic policing (CIR is 102400 kbps) in the traffic behavior.

[SwitchA] traffic behavior server

[SwitchA-behavior-server] car cir 102400 red remark-dscp-pass 0

[SwitchA-behavior-server] quit

# Create a traffic behavior named host , and configure traffic policing (CIR is 25600 kbps) in the traffic behavior.

[SwitchA] traffic behavior host

[SwitchA-behavior-host] car cir 25600

[SwitchA-behavior-host] quit

# Create a QoS policy named car , and associate traffic classes server and host with traffic behaviors server and host , respectively.

[SwitchA] qos policy car

[SwitchA-qospolicy-car] classifier server behavior server

[SwitchA-qospolicy-car] classifier host behavior host

[SwitchA-qospolicy-car] quit

# Apply QoS policy car to the inbound direction of Ten-GigabitEthernet 1/0/1.

39

[SwitchA] interface Ten-GigabitEthernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] qos apply policy car inbound

2. Configure Switch B:

# Configure ACL 3001 to match HTTP packets.

<SwitchB> system-view

[SwitchB] acl advanced 3001

[SwitchB-acl-ipv4-adv-3001] rule permit tcp destination-port eq 80

[SwitchB-acl-ipv4-adv-3001] quit

# Create a traffic class named http , and use ACL 3001 as the match criterion.

[SwitchB] traffic classifier http

[SwitchB-classifier-http] if-match acl 3001

[SwitchB-classifier-http] quit

# Create a traffic class named class to match all packets.

[SwitchB] traffic classifier class

[SwitchB-classifier-class] if-match any

[SwitchB-classifier-class] quit

# Create a traffic behavior named car_inbound , and configure traffic policing (CIR is 204800 kbps) in the traffic behavior.

[SwitchB] traffic behavior car_inbound

[SwitchB-behavior-car_inbound] car cir 204800

[SwitchB-behavior-car_inbound] quit

# Create a traffic behavior named car_outbound , and configure traffic policing (CIR is 102400 kbps) in the traffic behavior.

[SwitchB] traffic behavior car_outbound

[SwitchB-behavior-car_outbound] car cir 102400

[SwitchB-behavior-car_outbound] quit

# Create a QoS policy named car_inbound , and associate traffic class class with traffic behavior car_inbound .

[SwitchB] qos policy car_inbound

[SwitchB-qospolicy-car_inbound] classifier class behavior car_inbound

[SwitchB-qospolicy-car_inbound] quit

# Create a QoS policy named car_outbound , and associate traffic class http with traffic behavior car_outbound .

[SwitchB] qos policy car_outbound

[SwitchB-qospolicy-car_outbound] classifier http behavior car_outbound

[SwitchB-qospolicy-car_outbound] quit

# Apply QoS policy car_inbound to the inbound direction of Ten-GigabitEthernet 1/0/1.

[SwitchB] interface Ten-GigabitEthernet 1/0/1

[SwitchB-Ten-GigabitEthernet1/0/1] qos apply policy car_inbound inbound

# Apply QoS policy car_outbound to the outbound direction of Ten-GigabitEthernet 1/0/2.

[SwitchB] interface Ten-GigabitEthernet 1/0/2

[SwitchB-Ten-GigabitEthernet1/0/2] qos apply policy car_outbound outbound

40

Configuring congestion management

Overview

Congestion occurs on a link or node when traffic size exceeds the processing capability of the link or node. It is typical of a statistical multiplexing network and can be caused by link failures, insufficient resources, and various other causes.

Figure 14 shows typical congestion scenarios.

Figure 14 Traffic congestion scenarios

100M

100M 10M 100M 10M

100M > 10M

(1)

50M

(100M + 10M + 50M) > 100M

(2)

Congestion produces the following negative results:

•

Increased delay and jitter during packet transmission.

•

Decreased network throughput and resource use efficiency.

•

Network resource (memory, in particular) exhaustion and even system breakdown.

Congestion is unavoidable in switched networks and multiuser application environments. To improve the service performance of your network, take measures to manage and control it.

The key to congestion management is defining a resource dispatching policy to prioritize packets for forwarding when congestion occurs.

Congestion management uses queuing and scheduling algorithms to classify and sort traffic leaving a port.

Queue scheduling prioritizes packets to transmit high-priority packets preferentially. The switch supports Strict Priority (SP) queuing, Weighted Round Robin (WRR) queuing, Weighted Fair

Queuing (WFQ), SP+WRR queuing, and SP+WFQ queuing.

LSU1TGS16SC0 (JC628A) interface modules do not support SP+WRR or SP+WFQ queuing.

SP queuing

SP queuing is designed for mission-critical applications that require preferential service to reduce the response delay when congestion occurs.

41

Figure 15 SP queuing

Queue 7

High priority

Packets to be sent through this port

Queue 6 Sent packets

Interface

……

Queue 1

Packet classification

Queue scheduling

Sending queue

Queue 0

Low priority

In Figure 15 , SP queuing classifies eight queues on a port into eight classes, numbered 7 to 0 in

descending priority order.

SP queuing schedules the eight queues in the descending order of priority. SP queuing sends packets in the queue with the highest priority first. When the queue with the highest priority is empty, it sends packets in the queue with the second highest priority, and so on. You can assign mission-critical packets to a high priority queue to make sure they are always served first. Common service packets can be assigned to low priority queues to be transmitted when high priority queues are empty.

The disadvantage of SP queuing is that packets in the lower priority queues cannot be transmitted if packets exist in the higher priority queues. In the worst case, lower priority traffic might never get serviced.

WRR queuing

WRR queuing schedules all the queues in turn to ensure every queue is served for a certain time, as

shown in Figure 16 .

Figure 16 WRR queuing

Queue 0 Weight 1

Packets to be sent through this port Queue 1 Weight 2 Sent packets

Interface

……

Queue N-2 Weight N-1

Packet classification

Queue N-1 Weight N

Queue scheduling

Sending queue

42

Assume a port provides eight output queues. WRR assigns each queue a weight value (represented by w7, w6, w5, w4, w3, w2, w1, or w0). The weight value of a queue decides the proportion of resources assigned to the queue. On a 10 Gbps port, you can set the weight values to 5, 3, 1, 1, 5, 3,

1, and 1 for w7 through w0. In this way, the queue with the lowest priority can get a minimum of 500

Mbps of bandwidth. WRR solves the problem that SP queuing might fail to serve packets in low-priority queues for a long time.

Another advantage of WRR queuing is that when the queues are scheduled in turn, the service time for each queue is not fixed. If a queue is empty, the next queue will be scheduled immediately. This improves bandwidth resource use efficiency.

Only SF interface modules support group-based WRR queuing. You can assign output queues to

WRR group 1 and WRR group 2. Queues in a WRR group are scheduled based on their assigned weights. The two WRR groups are scheduled at a 1:1 ratio.

WFQ queuing

Figure 17 WFQ queuing

Queue 0 Weight 1

Packets to be sent through this port Queue 1 Weight 2 Sent packets

Interface

……

Queue N-2 Weight N-1

Packet classification

Queue N-1 Weight N

Queue scheduling

Sending queue

WFQ is similar to WRR. The difference is that WFQ enables you to set guaranteed bandwidth that a

WFQ queue can get during congestion.

SP+WRR queuing

You can implement SP+WRR queuing by assigning some queues to the SP group and others to

WRR groups.

•

On SF interface modules, SP+WRR queuing schedules queues in the following order: a. Schedules the queues in the SP group based on their priorities. b. Schedules queues in WRR groups (group 1 and group 2) when all queues in the SP group are empty.

The queues in a WRR group are scheduled based on their weights. The two WRR groups are scheduled in the ratio of 1:1.

•

On interface modules other than SF interface modules, SP+WRR queuing schedules queues in the following order: c. Schedules the queues in the SP group based on their priorities. d. Schedules queues in the WRR group based on their weights when all queues in the SP group are empty.

43

SP+WFQ queuing

You can implement SP+WFQ queuing by assigning some queues to the SP group and others to

WFQ groups.

•

On SF interface modules, SP+WFQ queuing schedules traffic in the following order: a. Schedules the queues in the SP group based on their priorities. b. Schedules the traffic conforming to the minimum guaranteed bandwidth of each queue in

WFQ groups when all queues in the SP group are empty. The two WFQ groups are scheduled in the ratio of 1:1. c. Schedules the traffic in each queue of WFQ groups according to the configured weights.

The two WFQ groups are scheduled in the ratio of 1:1.

•

On interface modules other than SF interface modules, SP+WFQ queuing schedules traffic in the following order: d. Schedules the traffic conforming to the minimum guaranteed bandwidth of each queue in the WFQ group. e. Schedules the queues in the SP group based on their priorities. f. Schedules the traffic of queues in the WFQ group according to the configured weights when all queues in the SP group are empty.

Configuration approaches and task list

The following are approaches to congestion management configuration:

•

Configure queue scheduling on an interface, as described in " Configuring per-queue congestion management ."

•

Configure a queue scheduling profile, as described in " Configuring a queue scheduling profile ."

To achieve congestion management, perform the following tasks:

Tasks at a glance

(Required.) Perform one of the following tasks to configure per-queue congestion management:

•

Configuring SP queuing

•

Configuring WRR queuing

•

Configuring WFQ queuing

•

Configuring SP+WRR queuing

•

Configuring SP+WFQ queuing

(Optional.) Configuring a queue scheduling profile

Configuring per-queue congestion management

This feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this section collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN

Switching Configuration Guide ).

Configuring SP queuing

Configuration procedure

To configure SP queuing:

44

Step

1. Enter system view.

2. Enter interface view.

Command system-view

interface interface-type interface-number

Remarks

N/A

N/A

3. Configure SP queuing.

qos sp

Configuration example

Configure interface Ten-GigabitEthernet 1/0/1 to use SP queuing:

# Enter system view

<Sysname> system-view

# Configure interface Ten-GigabitEthernet1/0/1 to use SP queuing.

[Sysname] interface ten-gigabitethernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos sp

By default, SP queuing is used on an interface.

Configuring WRR queuing

Configuration procedure

To configure WRR queuing:

Step

1. Enter system view.

2. Enter interface view.

Command system-view

interface interface-type interface-number

Remarks

N/A

N/A

3. Enable WRR queuing.

qos wrr { byte-count | weight }

By default, SP queuing is used on an interface.

4. Configure a WRR queue.

qos wrr queue-id group { 1 |

2 } { byte-count | weight }

schedule-value

By default, all queues of a WRR-enabled interface are in WRR group 1, and the weights of queues 0 through 7 are 1, 2, 3, 4,

5, 6, 7, and 8, respectively.

Select byte-count or weight according to the WRR type (byte-count or packet-based) you have enabled.

Only SF interface modules support WRR group 2.

Configuration example for SF interface modules

1. Network requirements



Enable packet-based WRR queuing on interface Ten-GigabitEthernet 1/0/1.



Assign queues 0 through 3 to WRR group 1, with their weights as 1, 2, 4, and 6, respectively.

Assign queues 4 through 7 to WRR group 2, with their weights as 1, 2, 4, and 6, respectively.

2. Configuration procedure

# Enter system view.

<Sysname> system-view

# Configure WRR queuing on Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

45

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr weight

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 0 group 1 weight 1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 1 group 1 weight 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 2 group 1 weight 4

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 3 group 1 weight 6

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 4 group 2 weight 1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 5 group 2 weight 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 6 group 2 weight 4

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 7 group 2 weight 6

Configuration example for other interface modules

1. Network requirements



Enable packet-based WRR queuing on interface Ten-GigabitEthernet 1/0/1.



Assign all queues to WRR group 1, with their weights as 1, 2, 4, 6, 8, 10, 12, and 14, respectively.

2. Configuration procedure

# Enter system view.

<Sysname> system-view

# Configure WRR queuing on interface Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr weight

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 0 group 1 weight 1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 1 group 1 weight 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 2 group 1 weight 4

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 3 group 1 weight 6

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 4 group 1 weight 8

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 5 group 1 weight 10

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 6 group 1 weight 12

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 7 group 1 weight 14

Configuring WFQ queuing

Configuration procedure

To configure WFQ queuing:

Step

1. Enter system view.

2. Enter interface view.

3. Enable WFQ queuing.

Command system-view interface interface-type interface-number qos wfq { byte-count | weight }

Remarks

N/A

N/A

By default, SP queuing is used on an interface.

46

Step

4. Configure a WFQ queue.

Command

qos wfq queue-id group [ 1 |

2 ] { byte-count | weight }

schedule-value

Remarks

By default, all queues of a

WRR-enabled interface are in WFQ group 1 and have a weight of 1.

Select byte-count or weight according to the WFQ type

(byte-count or packet-based) you have enabled.

Only SF interface modules support

WFQ group 2.

5. (Optional.) Configure the minimum guaranteed bandwidth for a WFQ queue. qos bandwidth queue

queue-id min

bandwidth-value

Configuration example for SF interface modules

The default setting is 64 kbps for each queue.

1. Network requirements



Configure byte-count WFQ queuing on interface Ten-GigabitEthernet 1/0/1.







Assign queues 1, 3, 4, 5, and 6 to WFQ group 1, with their weights as 2, 5, 10, 10, and 10, respectively.

Assign queues 0, 2, and 7 to WFQ group 2, with their weights as 1, 2, and 4, respectively.

Configure the minimum guaranteed bandwidth as 100 Mbps for each queue.

2. Configuration procedure

# Enter system view.

<Sysname> system-view

# Configure WFQ queuing on interface Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq byte-count

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 1 group 1 byte-count 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 3 group 1 byte-count 5

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 4 group 1 byte-count 10

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 5 group 1 byte-count 10

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 6 group 1 byte-count 10

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 0 group 2 byte-count 1

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 2 group 2 byte-count 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 7 group 2 byte-count 4

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 0 min 100000

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 1 min 100000

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 2 min 100000

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 3 min 100000

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 4 min 100000

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 5 min 100000

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 6 min 100000

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 7 min 100000

Configuration example for other interface modules

1. Network requirements





Configure packet-based WFQ queuing on interface Ten-GigabitEthernet 1/0/1.

Assign weights 1, 2, 4, 6, and 8 to queues 1, 3, 4, 5, and 6, respectively.

2. Configuration procedure

47

# Enter system view.

<Sysname> system-view

# Configure WFQ queuing on interface Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq weight

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 1 group 1 weight 1

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 3 group 1 weight 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 4 group 1 weight 4

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 5 group 1 weight 6

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 6 group 1 weight 8

Configuring SP+WRR queuing

LSU1TGS16SC0 (JC628A) interface modules do not support SP+WRR queuing.

Configuration procedure

To configure SP+WRR queuing:

Step

1. Enter system view.

2. Enter interface view.

Command system-view

interface interface-type interface-number

Remarks

N/A

N/A

3. Enable byte-count or packet-based WRR queuing. qos wrr { byte-count | weight }

By default, SP queuing is used on an interface.

4. Assign a queue to the SP group.

qos wrr queue-id group sp

By default, all queues of a WRR-enabled interface are in WRR group 1.

Repeat this command to assign more queues to the SP group.

For this command to take effect on an SG interface module, make sure the queue IDs in the SP group are continuous.

5. Configure a WRR group.

qos wrr queue-id group

{ 1 | 2 } { byte-count | weight } schedule-value

By default, all queues of a WRR-enabled interface are in WRR group 1, and the scheduling values of queues 0 through 7 are

1, 2, 3, 4, 5, 6, 7, and 8, respectively.

Select byte-count or weight according to the WRR type (byte-count or packet-based) you have enabled.

Only SF interface modules support WRR group 2.

Configuration example for SF interface modules

1. Network requirements





Configure SP+WRR queuing on interface Ten-GigabitEthernet 1/0/1, and use byte-count

WRR.

Assign queues 0, 1, 2, and 3 on Ten-GigabitEthernet 1/0/1 to the SP group.

 Assign queues 4 and 5 on Ten-GigabitEthernet 1/0/1 to WRR group 1, with their weights as

1 and 2, respectively.



Assign queues 6 and 7 to WRR group 2, with their weights as 1 and 3, respectively.

2. Configuration procedure

48

# Enter system view.

<Sysname> system-view

# Configure SP+WRR queuing on Ten-GigabitEthernet1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr byte-count

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 0 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 1 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 2 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 3 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 4 group 1 byte-count 1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 5 group 1 byte-count 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 6 group 2 byte-count 1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 7 group 2 byte-count 3

Configuration example for other interface modules

1. Network requirements



Configure SP+WRR queuing on interface Ten-GigabitEthernet 1/0/1, and use packet-based

WRR.





Assign queues 0, 1, 2, and 3 on Ten-GigabitEthernet 1/0/1 to the SP group.

Assign queues 4, 5, 6, and 7 on Ten-GigabitEthernet 1/0/1 to WRR group 1, with their weights as 2, 4, 6, and 8, respectively.

2. Configuration procedure

# Enter system view.

<Sysname> system-view

# Configure SP+WRR queuing on Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr weight

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 0 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 1 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 2 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 3 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 4 group 1 weight 2

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 5 group 1 weight 4

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 6 group 1 weight 6

[Sysname-Ten-GigabitEthernet1/0/1] qos wrr 7 group 1 weight 8

Configuring SP+WFQ queuing

LSU1TGS16SC0 (JC628A) interface modules do not support SP+WFQ queuing.

Configuration procedure

To configure SP+WFQ queuing:

Step

1. Enter system view.

2. Enter interface view.

Command system-view

interface interface-type

interface-number

Remarks

N/A

N/A

49

Step

3. Enable byte-count or packet-based WFQ queuing.

Command qos wfq { byte-count | weight }

Remarks

By default, SP queuing is used on an interface.

4. Assign a queue to the SP group.

qos wfq queue-id group sp

By default, all queues of a

WFQ-enabled interface are in WFQ group 1.

Repeat this command to assign more queues to the SP group.

For this command to take effect on an

SG interface module, make sure the queue IDs in the SP group are continuous.

5. Assign a queue to the WFQ group, and configure a scheduling weight for the queue.

qos wfq queue-id group { 1 |

2 } { byte-count | weight }

schedule-value

By default, all queues of a

WFQ-enabled interface are in WFQ group 1 and have a scheduling value of

1.

Select byte-count or weight according to the WFQ type (byte-count or packet-based) you have enabled.

Only SF interface modules support

WFQ group 2.

6. (Optional.) Configure the minimum guaranteed bandwidth for a queue. qos bandwidth queue

queue-id min

bandwidth-value

Configuration example for SF interface modules

The default setting is 64 kbps for each queue.

1. Network requirements



Configure SP+WFQ queuing on interface Ten-GigabitEthernet 1/0/1, and use packet-based

WFQ.









Assign queues 0, 1, 2, and 3 to the SP group.

Assign queues 4 and 5 to WFQ group 1, with their weights as 1 and 2, respectively.

Assign queues 6 and 7 to WFQ group 2, with their weights as 1 and 3, respectively.

Configure the minimum guaranteed bandwidth for each of the four WFQ queues as 128

Mbps.

2. Configuration procedure

# Enter system view.

<Sysname> system-view

# Configure SP+WFQ queuing on Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq weight

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 0 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 1 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 2 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 3 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 4 group 1 weight 1

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 4 min 128000

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 5 group 1 weight 2

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 5 min 128000

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 6 group 2 weight 1

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 6 min 128000

50

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 7 group 2 weight 3

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 7 min 128000

Configuration example for other interface modules

1. Network requirements





Configure SP+WFQ queuing on interface Ten-GigabitEthernet 1/0/1, and use packet-based

WFQ.

Assign queues 0, 1, 2, and 3 to the SP group.





Assign queues 4, 5, 6, and 7 to WFQ group 1, with their weights as 2, 4, 6, and 8, respectively.

Configure the minimum guaranteed bandwidth for each of the four WFQ queues as 128 kbps.

2. Configuration procedure

# Enter system view.

<Sysname> system-view

# Configure SP+WFQ queuing on Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq weight

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 0 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 1 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 2 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 3 group sp

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 4 group 1 weight 2

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 4 min 128

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 5 group 1 weight 4

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 5 min 128

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 6 group 1 weight 6

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 6 min 128

[Sysname-Ten-GigabitEthernet1/0/1] qos wfq 7 group 1 weight 8

[Sysname-Ten-GigabitEthernet1/0/1] qos bandwidth queue 7 min 128

Configuring a queue scheduling profile

In a queue scheduling profile, you can configure scheduling parameters for each queue. By applying the queue scheduling profile to an interface, you can implement congestion management on the interface.

Queue scheduling profiles support three queue scheduling algorithms: SP, WRR, and WFQ. In a queue scheduling profile, you can configure SP+WRR or SP+WFQ. When the three queue scheduling algorithms are configured, SP queues, WRR groups, and WFQ groups are scheduled in descending order of queue ID. In a WRR or WFQ group, queues are scheduled based on their weights.

When SP and WRR groups are configured in a queue scheduling profile, Figure 18 shows the

scheduling order on SF interface modules.

51

Figure 18 Queue scheduling profile configured with both SP and WRR

Q7 Q6 Q5 Q4 Q3 Q2 Q1 Q0

SP Group WRR Group 0 WRR Group 1

•

Queue 7 has the highest priority. Its packets are sent preferentially.

•

Queue 6 has the second highest priority. Packets in queue 6 are sent when queue 7 is empty.

•

Packets in queue 0 are sent when queue 7 and queue 6 are empty.

•

Queue 3, queue 4, and queue 5 in WRR group 1 are scheduled according to their weights.

When all queues in the SP group are empty, WRR group 1 is scheduled.

•

Queue 1 and queue 2 in WRR group 2 are scheduled according to their weights. WRR group 2 is scheduled when all queues in the SP group and in WRR group 1 are empty.

When SP and WRR groups are configured in a queue scheduling profile, Figure 19 shows the

scheduling order on other interface modules.

Figure 19 Queue scheduling profile configured with both SP and WRR

Q7 Q6 Q5 Q4 Q3 Q2 Q1 Q0

SP Group WRR Group 1

•

Queue 7 has the highest priority. Its packets are sent preferentially.

•

Queue 6 has the second highest priority. Packets in queue 6 are sent when queue 7 is empty.

•

Packets in queue 2 are sent when queue 7 and queue 6 are empty.

•

Packets in queue 1 are sent when queue 7, queue 6, and queue 2 are empty.

•

Packets in queue 0 are sent when queue 7, queue 6, queue 2, and queue 1 are empty.

•

Queue 3, queue 4, and queue 5 in WRR group 1 are scheduled according to their weights.

When all queues in the SP group are empty, WRR group 1 is scheduled.

Configuration procedure

When you configure a queue scheduling profile, follow these restrictions and guidelines:

•

Only one queue scheduling profile can be applied to an interface.

•

You can modify the scheduling parameters in a queue scheduling profile already applied to an interface.

To configure a queue scheduling profile:

52

Step

1. Enter system view.

2. Create a queue scheduling profile and enter queue scheduling profile view.

3. Configure queue scheduling parameters.

Command system-view

Remarks

N/A

qos qmprofile profile-name

By default, no queue scheduling profile exists.

•

Configure a queue to use SP:

queue queue-id sp

•

Configure a queue to use

WRR: queue weight queue-id group-id {

} wrr group byte-count | schedule-value group group-id

•

Configure a queue to use

WFQ:

a. queue queue-id wfq

{ byte-count | weight } schedule-value b. bandwidth queue

queue-id min bandwidth-value quit

interface interface-type

interface-number

N/A

qos apply qmprofile profile-name N/A

By default, a queue scheduling profile uses SP queuing for all queues.

You can configure the same queue scheduling algorithm,

SP+WRR, or SP+WFQ for all queues. However, you cannot configure WRR+WFQ.

In a queue scheduling profile, you can configure different queue scheduling algorithms for different queues.

You can configure the minimum guaranteed bandwidth for only WFQ queues.

For SP+WRR or SP+WFQ queuing to work correctly on an SG interface module, make sure the queue IDs in the SP group are continuous.

N/A 4. Return to system view.

5. Enter interface view.

6. Apply the queue scheduling profile to the interface.

Queue scheduling profile configuration example for SF interface modules

Network requirements

Configure a queue scheduling profile on interface Ten-GigabitEthernet 1/0/1 to meet the following requirements:

•

Queue 7 has the highest priority, and its packets are sent preferentially.

•

Queue 4, queue 5, and queue 6 in WRR group 1 are scheduled according to their weights, which are 1, 5, and 10, respectively. When queue 7 is empty, WRR group 1 is scheduled.

•

Queue 1, queue 2, and queue 3 in WRR group 2 are scheduled according to their weights, which are 1, 10, and 15, respectively. When queue 4, queue 5, queue 6, and queue 7 are all empty, WRR group 2 is scheduled.

•

Queue 0 has the lowest priority. Queue 0 is scheduled when all the other queues are empty.

Configuration procedure

# Enter system view.

<Sysname> system-view

# Create a queue scheduling profile named qm1 .

[Sysname] qos qmprofile qm1

53

[Sysname-qmprofile-qm1]

# Configure queue 7 to use SP queuing.

[Sysname-qmprofile-qm1] queue 7 sp

# Assign queue 4, queue 5, and queue 6 to WRR group 1, with their weights as 1, 5, and 10, respectively.

[Sysname-qmprofile-qm1] queue 4 wrr group 1 weight 1

[Sysname-qmprofile-qm1] queue 5 wrr group 1 weight 5

[Sysname-qmprofile-qm1] queue 6 wrr group 1 weight 10

# Assign queue 1, queue 2, and queue 3 to WRR group 2, with their weights as 1, 10, and 15, respectively.

[Sysname-qmprofile-qm1] queue 1 wrr group 2 weight 1

[Sysname-qmprofile-qm1] queue 2 wrr group 2 weight 10

[Sysname-qmprofile-qm1] queue 3 wrr group 2 weight 15

# Configure queue 0 to use SP queuing.

[Sysname-qmprofile-qm1] queue 0 sp

[Sysname-qmprofile-qm1] quit

# Apply queue scheduling profile qm1 to Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos apply qmprofile qm1

Queue scheduling profile configuration example for other interface modules

Network requirements

Configure a queue scheduling profile on interface Ten-GigabitEthernet 1/0/1 to meet the following requirements:

•

Queue 7 has the highest priority, and its packets are sent preferentially.

•

Queue 1 through queue 6 in WRR group 1 are scheduled according to their weights, which are

1, 2, 4, 6, 8, and 10. When queue 7 is empty, WRR group 1 is scheduled.

•

Queue 0 has the lowest priority. Queue 0 is scheduled when all other queues are empty.

Configuration procedure

# Enter system view.

<Sysname> system-view

# Create a queue scheduling profile named qm1 .

[Sysname] qos qmprofile qm1

[Sysname-qmprofile-qm1]

# Configure queue 7 to use SP queuing.

[Sysname-qmprofile-qm1] queue 7 sp

# Assign queue 1 through queue 6 to WRR group 1, with their weights as 1, 2, 4, 6, 8, and 10.

[Sysname-qmprofile-qm1] queue 1 wrr group 1 weight 1

[Sysname-qmprofile-qm1] queue 2 wrr group 1 weight 2

[Sysname-qmprofile-qm1] queue 3 wrr group 1 weight 4

[Sysname-qmprofile-qm1] queue 4 wrr group 1 weight 6

[Sysname-qmprofile-qm1] queue 5 wrr group 1 weight 8

[Sysname-qmprofile-qm1] queue 6 wrr group 1 weight 10

54

# Configure queue 0 to use SP queuing.

[Sysname-qmprofile-qm1] queue 0 sp

[Sysname-qmprofile-qm1] quit

# Apply queue scheduling profile qm1 to Ten-GigabitEthernet 1/0/1.

[Sysname] interface Ten-GigabitEthernet 1/0/1

[Sysname-Ten-GigabitEthernet1/0/1] qos apply qmprofile qm1

Displaying and maintaining queue statistics

LSU1TGS16SC0 (JC628A) interface modules do not support this function.

Execute display commands in any view.

Task

Display outgoing traffic statistics for queues.

Command display qos queue-statistics interface [ interface-type interface-number ] outbound

Displaying and maintaining congestion management

Execute display commands in any view.

Task

Display queuing configuration.

Display SP queuing configuration.

Display WRR queuing configuration.

Display WFQ queuing configuration.

Command display qos queue interface [ interface-type interface-number ] display qos queue sp interface [ interface-type interface-number ] display qos queue wrr interface [ interface-type interface-number ] display qos queue wfq interface [ interface-type interface-number ]

(In standalone mode.) Display the configuration of queue scheduling profiles.

Display the queue scheduling profiles applied to interfaces. display qos qmprofile configuration slot-number ]

[ profile-name ] [ slot

(In IRF mode.) Display the configuration of queue scheduling profiles. display qos qmprofile configuration [ profile-name ] [ chassis chassis-number slot slot-number ] display qos qmprofile interface [ interface-type interface-number ]

55

Configuring congestion avoidance

Overview

Avoiding congestion before it occurs is a proactive approach to improving network performance. As a flow control mechanism, congestion avoidance:

•

Actively monitors network resources (such as queues and memory buffers).

•

Drops packets when congestion is expected to occur or deteriorate.

When dropping packets from a source end, congestion avoidance cooperates with the flow control mechanism at the source end to regulate the network traffic size. The combination of the local packet drop policy and the source-end flow control mechanism implements the following functions:

•

Maximizes throughput and network use efficiency.

•

Minimizes packet loss and delay.

Tail drop

Congestion management techniques drop all packets that are arriving at a full queue. This tail drop mechanism results in global TCP synchronization. If packets from multiple TCP connections are dropped, these TCP connections go into the state of congestion avoidance and slow start to reduce traffic. However, traffic peak occurs later. Consequently, the network traffic jitters all the time.

RED and WRED

You can use Random Early Detection (RED) or Weighted Random Early Detection (WRED) to avoid global TCP synchronization.

Both RED and WRED avoid global TCP synchronization by randomly dropping packets. When the sending rates of some TCP sessions slow down after their packets are dropped, other TCP sessions remain at high sending rates. Link bandwidth is efficiently used, because TCP sessions at high sending rates always exist.

The RED or WRED algorithm sets an upper threshold and lower threshold for each queue, and processes the packets in a queue as follows:

•

When the queue size is shorter than the lower threshold, no packet is dropped.

•

When the queue size is between the lower threshold and the upper threshold, the received packets are dropped at random according to the configured drop probability.

•

When the queue size reaches the upper threshold, all subsequent packets are dropped.

If the current queue size is compared with the upper threshold and lower threshold to determine the drop policy, burst traffic is not fairly treated. To solve this problem, WRED compares the average queue size with the upper threshold and lower threshold to determine the drop probability.

The average queue size reflects the queue size change trend but is not sensitive to burst queue size changes, and burst traffic can be fairly treated.

ECN

By dropping packets, WRED alleviates the influence of congestion on the network. However, the network resources for transmitting packets from the sender to the device which drops the packets are wasted. When congestion occurs, it is a better idea to perform the following actions:

•

Inform the sender of the congestion status.

56

•

Have the sender proactively slow down the packet sending rate or decrease the window size of packets.

This better utilizes the network resources.

RFC 2482 defined an end-to-end congestion notification mechanism named Explicit Congestion

Notification (ECN). ECN uses the DS field in the IP header to mark the congestion status along the packet transmission path. A ECN-capable terminal can determine whether congestion occurs on the transmission path according to the packet contents. Then, it adjusts the packet sending speed to avoid deteriorating congestion. ECN defines the last two bits (ECN field) in the DS field of the IP header as follows:

•

Bit 6 indicates whether the sending terminal device supports ECN, and is called the

ECN-Capable Transport (ECT) bit.

•

Bit 7 indicates whether the packet has experienced congestion along the transmission path, and is called the Congestion Experienced (CE) bit.

For more information about the DS field, see " Appendixes ."

In actual applications, the following packets are considered as packets that an ECN-capable endpoint transmits:

•

Packets with ECT set to 1 and CE set to 0.

•

Packets with ECT set to 0 and CE set to 1.

After you enable ECN on a device, congestion management processes packets as follows:

•

When the average queue size is below the lower threshold, no packet is dropped, and the ECN fields of packets are not identified or marked.

•

When the average queue size is between the lower threshold and the upper threshold, the device picks out packets to be dropped according to the drop probability. Then, the device examines the ECN fields of these packets and determines whether to drop these packets.



If the ECN field shows that the packet is sent out of ECN-capable terminal, the device performs the following actions:

−

Sets both the ECT bit and the CE bit to 1.

−

Forwards the packet.

 If both the ECT bit and the CE bit are 1 in the packet, the device forwards the packet without modifying the ECN field. The combination of ECT bit 1 and CE bit 1 indicates that the packet has experienced congestion along the transmission path

 If both the ECT bit and the CE bit is 0 in the packet, the device drops the packet.

•

When the average queue size exceeds the upper threshold, the device drops the packet, regardless of whether the packet is sent from an ECN-capable terminal.

The switch supports enabling ECN on a per-queue basis.

Configuration restrictions and guidelines

WRED and ECN take effect only on TCP known unicast packets.

Configuring and applying a queue-based WRED table

The switch supports queue-based WRED tables. You can configure separate drop parameters for different queues. When congestion occurs, packets of a queue are randomly dropped based on drop parameters of the queue.

Determine the following parameters before configuring WRED:

57

•

Upper threshold and lower threshold —When the average queue size is smaller than the lower threshold, packets are not dropped. When the average queue size is between the lower threshold and the upper threshold, the packets are dropped at random. The longer the queue, the higher the drop probability. When the average queue size exceeds the upper threshold, subsequent packets are dropped.

•

Drop precedence —A parameter used for packet drop. The value 0 corresponds to green packets, the value 1 corresponds to yellow packets, and the value 2 corresponds to red packets.

Red packets are dropped preferentially.

•

Exponent for average queue size calculation —The greater the exponent, the less sensitive the average queue size is to real-time queue size changes. The formula for calculating the average queue size is:

Average queue size = ( previous average queue size x (1 – 2

–n

) ) + (current queue size x 2

–n

), where n is the exponent.

•

Drop probability in percentage —The greater the value, the larger the drop probability.

To configure and apply a queue-based WRED table:

Step

1. Enter system view.

2. Create a WRED table and enter its view.

3. (Optional.) Set the

WRED exponent for average queue size calculation.

4. (Optional.) Configure the other WRED parameters.

Command system-view

qos wred queue table table-name queue queue-id weighting-constant

exponent queue queue-id [ drop-level drop-level low-limit low-limit high-limit high-limit

[ discard-probability discard-prob ]

]

Remarks

N/A

N/A

The default setting is 9.

By default, the lower limit is

100, the upper limit is 1000, and the drop probability is 10.

5. (Optional.) Enable

ECN for a queue. queue queue-id ecn

By default, ECN is not enabled on a queue.

6. Return to system view. quit

7. Enter interface view. interface interface-type interface-number

N/A

N/A

8. Apply the WRED table to the interface.

qos wred apply [ table-name ]

By default, no WRED table is applied to an interface, and tail drop is used on an interface.

A WRED table can be applied to multiple interfaces. For a

WRED table already applied to an interface, you can modify the values of the WRED table, but you cannot remove the

WRED table.

Displaying and maintaining WRED

Execute display commands in any view.

Task

Display WRED configuration and statistics for an interface.

Command display qos wred interface [ interface-type interface-number ]

58

Task

(In standalone mode.) Display the configuration of WRED tables.

(In IRF mode.) Display the configuration of

WRED tables.

Command display qos wred table [ name table-name ] [ slot slot-number ] display qos wred table [ name table-name ] [ chassis chassis-number slot slot-number ]

WRED configuration example

Network requirements

Configure WRED on interface Ten-GigabitEthernet 1/0/2, so that the packets are dropped as follows when congestion occurs:

•

For the interface to preferentially forward higher-priority traffic, configure a lower drop probability for a queue with a greater queue ID. Set different drop parameters for queue 0, queue 3, and queue 7.

•

Drop packets according to their colors:





In queue 0, set the drop probability to 25%, 50%, and 75% for green, yellow, and red packets, respectively.

In queue 3, set the drop probability to 5%, 10%, and 25% for green, yellow, and red packets, respectively.



In queue 7, set the drop probability to 1%, 5%, and 10% for green, yellow, and red packets, respectively.

•

Enable ECN for queue 7.

Configuration procedure

# Configure a queue-based WRED table, and set different drop parameters for packets with different drop levels in different queues.

<Sysname> system-view

[Sysname] qos wred queue table queue-table1

[Sysname-wred-table-queue-table1] queue 0 drop-level 0 low-limit 128 high-limit 512 discard-probability 25

[Sysname-wred-table-queue-table1] queue 0 drop-level 1 low-limit 128 high-limit 512 discard-probability 50

[Sysname-wred-table-queue-table1] queue 0 drop-level 2 low-limit 128 high-limit 512 discard-probability 75

[Sysname-wred-table-queue-table1] queue 3 drop-level 0 low-limit 256 high-limit 640 discard-probability 5

[Sysname-wred-table-queue-table1] queue 3 drop-level 1 low-limit 256 high-limit 640 discard-probability 10

[Sysname-wred-table-queue-table1] queue 3 drop-level 2 low-limit 256 high-limit 640 discard-probability 25

[Sysname-wred-table-queue-table1] queue 7 drop-level 0 low-limit 512 high-limit 1024 discard-probability 1

[Sysname-wred-table-queue-table1] queue 7 drop-level 1 low-limit 512 high-limit 1024 discard-probability 5

[Sysname-wred-table-queue-table1] queue 7 drop-level 2 low-limit 512 high-limit 1024 discard-probability 10

59

[Sysname-wred-table-queue-table1] queue 7 ecn

[Sysname-wred-table-queue-table1] quit

# Apply the queue-based WRED table to interface Ten-GigabitEthernet 1/0/2.

[Sysname] interface Ten-GigabitEthernet 1/0/2

[Sysname-Ten-GigabitEthernet1/0/2] qos wred apply queue-table1

[Sysname-Ten-GigabitEthernet1/0/2] quit

60

Configuring traffic filtering

You can filter in or filter out traffic of a class by associating the class with a traffic filtering action. For example, you can filter packets sourced from an IP address according to network status.

Configuration procedure

To configure traffic filtering:

Step

1. Enter system view.

2. Create a traffic class and enter traffic class view.

Command system-view traffic classifier classifier-name

[ operator { and | or } ]

3. Configure match criteria. if-match match-criteria

Remarks

N/A

By default, no traffic class exists.

By default, no match criterion is configured.

N/A 4. Return to system view.

5. Create a traffic behavior and enter traffic behavior view. quit

traffic behavior behavior-name

By default, no traffic behavior exists.

6. Configure the traffic filtering action. filter { deny | permit }

7. Return to system view.

8. Create a QoS policy and enter QoS policy view. quit qos policy policy-name

9. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior

behavior-name

10. Return to system view.

11. Apply the QoS policy. quit

•

Applying the QoS policy to an interface

•

Applying the QoS policy to a VLAN

•

Applying the QoS policy globally

12. (Optional.) Display the traffic filtering configuration. display traffic behavior user-defined

[ behavior-name ]

By default, no traffic filtering action is configured.

If a traffic behavior has the filter deny action, all other actions except class-based accounting in the traffic behavior do not take effect.

N/A

By default, no QoS policy exists.

By default, a traffic class is not associated with a traffic behavior.

N/A

Choose one of the application destinations as needed.

By default, no QoS policy is applied.

Available in any view.

Traffic filtering configuration example

Network requirements

As shown in Figure 20 , configure traffic filtering on GigabitEthernet 1/0/1 to deny the incoming

packets with a source port number other than 21.

61

Figure 20 Network diagram

Host

Switch

GE1/0/1

Configuration procedure

# Create advanced ACL 3000, and configure a rule to match packets whose source port number is not 21.

<Switch> system-view

[Switch] acl advanced 3000

[Switch-acl-ipv4-adv-3000] rule 0 permit tcp source-port neq 21

[Switch-acl-ipv4-adv-3000] quit

# Create a traffic class named classifier_1 , and use ACL 3000 as the match criterion in the traffic class.

[Switch] traffic classifier classifier_1

[Switch-classifier-classifier_1] if-match acl 3000

[Switch-classifier-classifier_1] quit

# Create a traffic behavior named behavior_1 , and configure the traffic filtering action to drop packets.

[Switch] traffic behavior behavior_1

[Switch-behavior-behavior_1] filter deny

[Switch-behavior-behavior_1] quit

# Create a QoS policy named policy , and associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.

[Switch] qos policy policy

[Switch-qospolicy-policy] classifier classifier_1 behavior behavior_1

[Switch-qospolicy-policy] quit

# Apply QoS policy named policy to the incoming traffic of GigabitEthernet 1/0/1.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] qos apply policy policy inbound

62

Configuring priority marking

Priority marking sets the priority fields or flag bits of packets to modify the priority of packets. For example, you can use priority marking to set IP precedence or DSCP for a class of IP packets to control the forwarding of these packets.

To configure priority marking to set the priority fields or flag bits for a class of packets, perform the following tasks:

1. Configure a traffic behavior with a priority marking action.

2. Associate the traffic class with the traffic behavior.

Priority marking can be used together with priority mapping. For more information, see " Configuring priority mapping ."

Color-based priority marking

Packet coloring methods

The color of a packet indicates the switch's evaluation for the packet transmission priority. The switch can color a packet by using either of the following methods:

•

Traffic policing

•

Mapping drop precedence

Traffic policing

Traffic policing is a common traffic control technology. Traffic policing uses the token bucket mechanism to evaluate the incoming or outgoing packets and colors the packets according to the evaluation result. By configuring different traffic control polices for packets in different colors, you can provide differentiated services for different traffic flows and ensure that the network resources are effectively used.

The switch supports evaluating traffic by using two token buckets (bucket C and bucket E), and it colors a packet according to the number of tokens in the token buckets.

•

If bucket C has sufficient tokens, the packet is colored green.

•

If bucket C does not have sufficient tokens but bucket E has sufficient tokens, the packet is colored yellow.

•

If neither bucket C nor bucket E has sufficient tokens, the packet is colored red.

The switch supports coloring packets by using either of the following traffic policing features: common CAR and aggregate CAR. For more information about configuring common CAR and

aggregate CAR, see " Configuring priority mapping

" and " Configuring global CAR ," respectively.

Mapping drop precedence

Without traffic policing configured, the switch assigns a drop precedence value to a packet according to the 802.1p-to-drop priority map and colors the packet according to the drop precedence value.

Drop precedence value 0 corresponds to green packets, 1 corresponds to yellow packets, and 2

corresponds to red packets. For more information about priority maps, see " Configuring priority mapping ."

Configuring color-based priority marking

This section describes how to configure color-based priority marking.

63

Configuring priority marking based on colors obtained through traffic policing

After traffic policing evaluates and colors packets, the switch can mark traffic with various priority values (including DSCP values, 802.1p priority values, and local precedence values) by color.

Configure priority marking by using either of the following methods:

•

Configuring the priority marking actions by color in the traffic policing action.

•

Configuring the priority marking actions by color in the behavior where the traffic policing action is configured.

In a traffic behavior, you can use the two methods at the same time to mark multiple priority values for packets in the same color. However, do not use the two methods to mark different values of the same priority type for packets. Otherwise, the traffic behavior cannot be applied correctly.

In a traffic behavior, an aggregate CAR action cannot be configured together with a priority marking action. Otherwise, the traffic behavior cannot be applied correctly.

The switch implements both common CAR and aggregate CAR by using a QoS policy. For more

information about configuring classes and behaviors in a QoS policy, see " Configuring priority mapping

" and " Configuring global CAR ."

Configuring priority marking based on colors obtained through mapping drop precedence

When packets are colored based on drop precedence values, you can create priority marking actions for packets in different colors in a traffic behavior and mark DSCP values, 802.1p priority values, and local precedence values for packets.

Configuration procedure

To configure priority marking:

Step

1. Enter system view.

2. Create a traffic class and enter traffic class view.

Command system-view traffic classifier classifier-name

[ operator { and | or } ]

3. Configure match criteria. if-match match-criteria

4. Return to system view.

5. Create a traffic behavior and enter traffic behavior view. quit

traffic behavior behavior-name

Remarks

N/A

By default, no traffic class exists.

By default, no match criterion is configured.

N/A

By default, no traffic behavior exists.

64

Step

6. Configure a priority marking action.

Command

•

Set the DSCP value for packets: remark [ green | red | yellow ] dscp dscp-value

•

Set the 802.1p priority for packets or configure the inner-to-outer tag priority copying feature: remark [ green | red | yellow ] dot1p dot1p-value remark dot1p customer-dot1p-trust

•

Set the drop priority for packets: remark drop-precedence

drop-precedence-value

•

Set the IP precedence for packets: remark ip-precedence ip-precedence-value

•

Set the local precedence for packets: remark [ green | red | yellow ] local-precedence

local-precedence-value

•

Set the local QoS ID for packets: remark qos-local-id local-id-value

•

Set the CVLAN for packets: remark customer-vlan-id vlan-id

•

Set the SVLAN for packets: remark service-vlan-id vlan-id

Remarks

Use one of the commands.

By default, no priority marking action is configured.

The remark drop-precedence command applies only to incoming traffic.

If a traffic behavior contains only a CVLAN or SVLAN marking action, the match criteria of the associated traffic class cannot contain only if-match customer-vlan-id or if-match service-vlan-id . Otherwise, a

QoS policy containing the class-behavior association cannot be correctly applied. To meet the requirements above, use VLAN mapping. For more information about VLAN mapping, see Layer 2—LAN

Switching Configuration Guide .

7. Return to system view.

8. Create a QoS policy and enter QoS policy view.

9. Associate the traffic class with the traffic behavior in the QoS policy. quit qos policy policy-name classifier classifier-name behavior

behavior-name

N/A

By default, no QoS policy exists.

By default, a traffic class is not associated with a traffic behavior.

10. Return to system view.

11. Apply the QoS policy. quit

•

Applying the QoS policy to an interface

•

Applying the QoS policy to a

VLAN

•

Applying the QoS policy globally

N/A

Choose one of the application destinations as needed.

By default, no QoS policy is applied.

12. (Optional.) Display the priority marking configuration. display traffic behavior user-defined [ behavior-name ]

Available in any view.

For a QoS policy applied to an interface, VLAN, or globally, Table 5 shows the support for priority

marking actions in the inbound and outbound directions.

Table 5 Support for priority marking actions

Action

802.1p priority marking

Drop precedence marking

Inbound

Yes

Yes

Outbound

Yes

No

65

Action

DSCP marking

IP precedence marking

Local precedence marking

Local QoS ID marking

CVLAN marking

Inbound

Yes

Yes

Yes

No

Yes except on EA, EB, and

LSU1TGS16SC0 (JC628A) interface modules

Yes

Outbound

Yes

Yes

No

No

Yes

Yes SVLAN marking

Priority marking configuration example

Network requirements

As shown in Figure 21 , configure priority marking on the switch to meet the following requirements:

Traffic source

Host A, B

Host A, B

Destination

Data server

Mail server

Host A, B

Figure 21 Network diagram

File server

Processing priority

High

Medium

Low

Internet

Host A Data server

192.168.0.1/24

GE1/0/1 GE1/0/2 Mail server

192.168.0.2/24

Host B

Switch

File server

192.168.0.3/24

Configuration procedure

# Create advanced ACL 3000, and configure a rule to match packets with destination IP address

192.168.0.1.

<Switch> system-view

[Switch] acl advanced 3000

[Switch-acl-ipv4-adv-3000] rule permit ip destination 192.168.0.1 0

[Switch-acl-ipv4-adv-3000] quit

# Create advanced ACL 3001, and configure a rule to match packets with destination IP address

192.168.0.2.

66

[Switch] acl advanced 3001

[Switch-acl-ipv4-adv-3001] rule permit ip destination 192.168.0.2 0

[Switch-acl-ipv4-adv-3001] quit

# Create advanced ACL 3002, and configure a rule to match packets with destination IP address

192.168.0.3.

[Switch] acl advanced 3002

[Switch-acl-ipv4-adv-3002] rule permit ip destination 192.168.0.3 0

[Switch-acl-ipv4-adv-3002] quit

# Create a traffic class named classifier_dbserver , and use ACL 3000 as the match criterion in the traffic class.

[Switch] traffic classifier classifier_dbserver

[Switch-classifier-classifier_dbserver] if-match acl 3000

[Switch-classifier-classifier_dbserver] quit

# Create a traffic class named classifier_mserver , and use ACL 3001 as the match criterion in the traffic class.

[Switch] traffic classifier classifier_mserver

[Switch-classifier-classifier_mserver] if-match acl 3001

[Switch-classifier-classifier_mserver] quit

# Create a traffic class named classifier_fserver , and use ACL 3002 as the match criterion in the traffic class.

[Switch] traffic classifier classifier_fserver

[Switch-classifier-classifier_fserver] if-match acl 3002

[Switch-classifier-classifier_fserver] quit

# Create a traffic behavior named behavior_dbserver , and configure the action of setting the local precedence value to 4.

[Switch] traffic behavior behavior_dbserver

[Switch-behavior-behavior_dbserver] remark local-precedence 4

[Switch-behavior-behavior_dbserver] quit

# Create a traffic behavior named behavior_mserver , and configure the action of setting the local precedence value to 3.

[Switch] traffic behavior behavior_mserver

[Switch-behavior-behavior_mserver] remark local-precedence 3

[Switch-behavior-behavior_mserver] quit

# Create a traffic behavior named behavior_fserver , and configure the action of setting the local precedence value to 2.

[Switch] traffic behavior behavior_fserver

[Switch-behavior-behavior_fserver] remark local-precedence 2

[Switch-behavior-behavior_fserver] quit

# Create a QoS policy named policy_server , and associate traffic classes with traffic behaviors in the QoS policy.

[Switch] qos policy policy_server

[Switch-qospolicy-policy_server] classifier classifier_dbserver behavior behavior_dbserver

[Switch-qospolicy-policy_server] classifier classifier_mserver behavior behavior_mserver

[Switch-qospolicy-policy_server] classifier classifier_fserver behavior behavior_fserver

[Switch-qospolicy-policy_server] quit

67

# Apply QoS policy policy_server to the incoming traffic of GigabitEthernet 1/0/1.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] qos apply policy policy_server inbound

[Switch-GigabitEthernet1/0/1] quit

68

Configuring nesting

Nesting adds a VLAN tag to the matching packets to allow the VLAN-tagged packets to pass through the corresponding VLAN. For example, you can add an outer VLAN tag to packets from a customer network to a service provider network. This allows the packets to pass through the service provider network by carrying a VLAN tag assigned by the service provider.

Configuration procedure

To configure nesting:

Step

1. Enter system view.

2. Create a traffic class and enter traffic class view.

Command system-view traffic classifier classifier-name

[ operator { and | or } ]

3. Configure match criteria. if-match match-criteria

4. Return to system view.

5. Create a traffic behavior and enter traffic behavior view. quit

traffic behavior behavior-name

6. Configure a VLAN tag adding action.

nest top-most vlan vlan-id

7. Return to system view.

8. Create a QoS policy and enter QoS policy view.

9. Associate the traffic class with the traffic behavior in the QoS policy.

10. Return to system view. quit qos policy policy-name classifier classifier-name behavior

behavior-name quit

11. Apply the QoS policy.

•

Applying the QoS policy to an interface

•

Applying the QoS policy to a VLAN

•

Applying the QoS policy globally

12. (Optional.) Display the nesting configuration. display traffic behavior user-defined

[ behavior-name ]

Remarks

N/A

By default, no traffic class exists.

By default, no match criterion is configured for a traffic class.

N/A

By default, no traffic behavior exists.

By default, no VLAN tag adding action is configured for a traffic behavior.

N/A

By default, no QoS policy exists.

By default, no class-behavior association is configured for a QoS policy.

N/A

Choose one of the application destinations as needed.

By default, no QoS policy is applied.

Available in any view.

Nesting configuration example

Network requirements

As shown in Figure 22 :

•

Site 1 and Site 2 in VPN A are two branches of a company. They use VLAN 5 to transmit traffic.

69

•

Because Site 1 and Site 2 are located in different areas, the two sites use the VPN access service of a service provider. The service provider assigns VLAN 100 to the two sites.

Configure nesting, so that the two branches can communicate through the service provider network.

Figure 22 Network diagram

PE 1

GE1/0/1

Public network

GE1/0/2

VLAN 100 VLAN 5 Data

IP network

GE1/0/2

VLAN 100 VLAN 5 Data

PE 2

GE1/0/1

VLAN 5 Data VLAN 5 Data

CE 1

VLAN 5

VPN A

Site 1

VPN A

Site 2

CE 2

Configuration procedure

Configuring PE 1

# Create a class named test to match traffic with VLAN ID 5.

<PE1> system-view

[PE1] traffic classifier test

[PE1-classifier-test] if-match service-vlan-id 5

[PE1-classifier-test] quit

# Configure an action to add outer VLAN tag 100 in traffic behavior test .

[PE1] traffic behavior test

[PE1-behavior-test] nest top-most vlan 100

[PE1-behavior-test] quit

# Create a QoS policy named test , and associate class test with behavior test in the QoS policy.

[PE1] qos policy test

[PE1-qospolicy-test] classifier test behavior test

[PE1-qospolicy-test] quit

# Configure the downlink port (GigabitEthernet 1/0/1) as a hybrid port, and assign the port to VLAN

100 as an untagged member.

[PE1] interface gigabitethernet 1/0/1

[PE1-GigabitEthernet1/0/1] port link-type hybrid

[PE1-GigabitEthernet1/0/1] port hybrid vlan 100 untagged

# Apply QoS policy test to the incoming traffic of GigabitEthernet 1/0/1.

[PE1-GigabitEthernet1/0/1] qos apply policy test inbound

[PE1-GigabitEthernet1/0/1] quit

# Configure the uplink port (GigabitEthernet 1/0/2) as a trunk port, and assign it to VLAN 100.

[PE1] interface gigabitethernet 1/0/2

[PE1-GigabitEthernet1/0/2] port link-type trunk

70

[PE1-GigabitEthernet1/0/2] port trunk permit vlan 100

[PE1-GigabitEthernet1/0/2] quit

Configuring PE 2

Configure PE 2 in the same way PE 1 is configured.

71

Configuring traffic redirecting

Traffic redirecting redirects packets matching the specified match criteria to a location for processing.

You can redirect packets to the following destinations:

•

CPU.

•

Interface.

•

Next hop.

Configuration procedure

To configure traffic redirecting:

Step

1. Enter system view.

Command system-view

Remarks

N/A

2.

3.

Create a traffic class and enter traffic class view.

Configure match criteria. traffic classifier

[ operator { and classifier-name

| or } ]

if-match match-criteria

By default, no traffic class exists.

By default, no match criterion is configured for a traffic class.

N/A 4. Return to system view.

5. Create a traffic behavior and enter traffic behavior view. quit

traffic behavior behavior-name

By default, no traffic behavior exists.

6. Configure a traffic redirecting action.

7. Return to system view.

8. Create a QoS policy and enter QoS policy view.

9. Associate the traffic class with the traffic behavior in the QoS policy.

10. Return to system view. redirect { cpu | interface interface-type interface-number [ track-oap ] | next-hop

{ ipv4-add1 [ track track-entry-number ]

[ ipv4-add2 [ track track-entry-number ] ] | ipv6-add1 [ track track-entry-number ]

[ ipv6-add2 [ track track-entry-number ] ] }

By default, no traffic redirecting action is configured for a traffic behavior.

If you configure this command multiple times, the most recent configuration takes effect.

The next-hop keyword takes effect only on Layer 3 packets. You can use the if-match forwarding-layer route command in the traffic class to match Layer 3 packets. quit qos policy policy-name

N/A

By default, no QoS policy exists. classifier classifier-name behavior

behavior-name quit

By default, no class-behavior association is configured for a QoS policy.

N/A

72

Step

11. Apply the QoS policy.

Command

•

Applying the QoS policy to an interface

•

Applying the QoS policy to a VLAN

•

Applying the QoS policy globally

12. (Optional.) Display traffic redirecting configuration. display traffic behavior user-defined

[ behavior-name ]

Remarks

Choose one of the application destinations as needed.

By default, no QoS policy is applied.

The switch supports redirecting traffic to only a

Layer 2 Ethernet interface for interface QoS policies.

Available in any view.

Traffic redirecting configuration example

Network requirements

As shown in Figure 23 :

•

Switch A is connected to Switch B through two links. Switch A and Switch B are each connected to other devices.

•

GigabitEthernet 1/0/2 of Switch A and GigabitEthernet 1/0/2 of Switch B belong to VLAN 200.

•

GigabitEthernet 1/0/3 of Switch A and GigabitEthernet 1/0/3 of Switch B belong to VLAN 201.

•

On Switch A, the IP address of VLAN-interface 200 is 200.1.1.1/24, and that of VLAN-interface

201 is 201.1.1.1/24.

•

On Switch B, the IP address of VLAN-interface 200 is 200.1.1.2/24, and that of VLAN-interface

201 is 201.1.1.2/24.

Configure the actions of redirecting traffic to an interface to meet the following requirements:

•

Packets with source IP address 2.1.1.1 received on GigabitEthernet 1/0/1 of Switch A are forwarded to GigabitEthernet 1/0/2.

•

Packets with source IP address 2.1.1.2 received on GigabitEthernet 1/0/1 of Switch A are forwarded to GigabitEthernet 1/0/3.

•

Other packets received on GigabitEthernet 1/0/1 of Switch A are forwarded according to the routing table.

Figure 23 Network diagram

GE1/0/1

Switch A

GE1/0/2

VLAN 200

Vlan-int200

200.1.1.1/24

GE1/0/2

VLAN 200

Vlan-int200

200.1.1.2/24

Switch B

GE1/0/1

GE1/0/3

VLAN 201

Vlan-int201

201.1.1.1/24

GE1/0/3

VLAN 201

Vlan-int201

201.1.1.2/24

Configuration procedure

# Create basic ACL 2000, and configure a rule to match packets with source IP address 2.1.1.1.

<SwitchA> system-view

[SwitchA] acl basic 2000

73

[SwitchA-acl-ipv4-basic-2000] rule permit source 2.1.1.1 0

[SwitchA-acl-ipv4-basic-2000] quit

# Create basic ACL 2001, and configure a rule to match packets with source IP address 2.1.1.2.

[SwitchA] acl basic 2001

[SwitchA-acl-ipv4-basic-2001] rule permit source 2.1.1.2 0

[SwitchA-acl-ipv4-basic-2001] quit

# Create a traffic class named classifier_1 , and use ACL 2000 as the match criterion in the traffic class.

[SwitchA] traffic classifier classifier_1

[SwitchA-classifier-classifier_1] if-match acl 2000

[SwitchA-classifier-classifier_1] quit

# Create a traffic class named classifier_2 , and use ACL 2001 as the match criterion in the traffic class.

[SwitchA] traffic classifier classifier_2

[SwitchA-classifier-classifier_2] if-match acl 2001

[SwitchA-classifier-classifier_2] quit

# Create a traffic behavior named behavior_1 , and configure the action of redirecting traffic to

GigabitEthernet 1/0/2.

[SwitchA] traffic behavior behavior_1

[SwitchA-behavior-behavior_1] redirect interface gigabitethernet 1/0/2

[SwitchA-behavior-behavior_1] quit

# Create a traffic behavior named behavior_2 , and configure the action of redirecting traffic to

GigabitEthernet 1/0/3.

[SwitchA] traffic behavior behavior_2

[SwitchA-behavior-behavior_2] redirect interface gigabitethernet 1/0/3

[SwitchA-behavior-behavior_2] quit

# Create a QoS policy named policy .

[SwitchA] qos policy policy

# Associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.

[SwitchA-qospolicy-policy] classifier classifier_1 behavior behavior_1

# Associate traffic class classifier_2 with traffic behavior behavior_2 in the QoS policy.

[SwitchA-qospolicy-policy] classifier classifier_2 behavior behavior_2

[SwitchA-qospolicy-policy] quit

# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.

[SwitchA] interface gigabitethernet 1/0/1

[SwitchA-GigabitEthernet1/0/1] qos apply policy policy inbound

74

Configuring global CAR

Overview

Global committed access rate (CAR) is an approach to policing traffic flows globally. It adds flexibility to common CAR where traffic policing is performed only on a per-traffic class or per-interface basis.

In this approach, CAR actions are created in system view and each can be used to police multiple traffic flows as a whole.

Global CAR provides the following CAR actions: aggregate CAR and hierarchical CAR.

SC, SF, and SG interface modules support only aggregate CAR.

Aggregate CAR

An aggregate CAR action is created globally. It can be directly applied to interfaces or used in the traffic behaviors associated with different traffic classes to police multiple traffic flows as a whole.

The total rate of the traffic flows must conform to the traffic policing specifications set in the aggregate CAR action.

Hierarchical CAR

A hierarchical CAR action is created globally. It must be used in conjunction with a common CAR or aggregate CAR action. With a hierarchical CAR action, you can limit the total traffic of multiple traffic classes.

A hierarchical CAR action can be used in the common or aggregate CAR action for a traffic class in either AND mode or OR mode.

•

In AND mode, the rate of the traffic class is strictly limited under the common or aggregate CAR.

This mode applies to flows that must be strictly rate limited.

•

In OR mode, the traffic class can use idle bandwidth of other traffic classes associated with the hierarchical CAR. This mode applies to high priority, bursty traffic like video.

By using the two modes appropriately, you can improve bandwidth efficiency.

For example, suppose two flows exist: a low priority data flow and a high priority, bursty video flow.

Their total traffic rate cannot exceed 4096 kbps and the video flow must be assured of at least 2048 kbps bandwidth. You can perform the following tasks:

•

Configure common CAR actions to set the traffic rate to 2048 kbps for the two flows.

•

Configure a hierarchical CAR action to limit their total traffic rate to 4096 kbps.

•

Use the action in AND mode in the common CAR action for the data flow.

•

Use the action in OR mode in the common CAR action for the video flow.

The video flow is assured of 2048 kbps bandwidth and can use idle bandwidth of the data flow.

In a bandwidth oversubscription scenario, the uplink port bandwidth is lower than the total downlink port traffic rate. You can use hierarchical CAR to meet the following requirements:

•

Limit the total rate of downlink port traffic.

•

Allow each downlink port to forward traffic at the maximum rate when the other ports are idle.

For example, you can perform the following tasks:

•

Use common CAR actions to limit the rates of Internet access flow 1 and flow 2 to both 128 kbps.

•

Use a hierarchical CAR action to limit their total traffic rate to 192 kbps.

75

•

Use the hierarchical CAR action for both flow 1 and flow 2 in AND mode.

When flow 1 is not present, flow 2 is transmitted at the maximum rate, 128 kbps. When both flows are present, the traffic rate of flow 2 might drop below this rate, because the total rate of the two flows cannot exceed 192 kbps.

Configuring aggregate CAR

Step

1. Enter system view.

Command system-view

2. Configure an aggregate

CAR action.

qos car car-name aggregative cir

committed-information-rate [ cbs committed-burst-size [ ebs excess-burst-size ] ] [ green action | red action | yellow action ] *

qos car car-name aggregative cir committed-information-rate [ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] [ green action | red action | yellow action ] *

3. Enter traffic behavior view. traffic behavior behavior-name

4. Use the aggregate CAR action in the traffic behavior.

car name car-name

Configuring hierarchical CAR

Remarks

N/A

By default, no aggregate

CAR action is configured.

An aggregate CAR action is supported only in the inbound direction.

N/A

By default, no aggregate

CAR action is used in a traffic behavior.

Step

1. Enter system view.

2. Configure a hierarchical

CAR action.

Command system-view

Remarks

N/A

qos car car-name hierarchy cir

committed-information-rate [ cbs committed-burst-size ] ] [ green action |

red action | yellow action ] *

By default, no hierarchical CAR action is configured.

3. Enter traffic behavior view. traffic behavior behavior-name N/A

76

Step

4. Use the hierarchical

CAR action in the traffic behavior to cooperate with aggregate CAR or common CAR.

Command

•

Aggregate CAR:

car name car-name hierarchy-car hierarchy-car-name

[ mode { and | or } ]

•

Common CAR:

car cir committed-information-rate

[ cbs committed-burst-size [ ebs excess-burst-size ] ] [ green action

| red action | yellow action ] *

[ hierarchy-car hierarchy-car-name [ mode { and | or } ] ]

car cir committed-information-rate

[ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] [ green action | red action | yellow action ] *

[ hierarchy-car hierarchy-car-name [ mode { and | or } ] ]

Remarks

By default, no hierarchical CAR action is used in a traffic behavior.

For more information about

common CAR, see " Configuring traffic policing, GTS, and rate limit ."

Displaying and maintaining global CAR

Execute display commands in any view and reset commands in user view.

Task

Display statistics for global CAR actions.

Clear statistics for global CAR actions.

Command display qos car name [ car-name ] reset qos car name [ car-name ]

Aggregate CAR configuration example

Network requirements

As shown in Figure 24 , configure aggregate CAR to rate limit the traffic of VLAN 10 and VLAN 100

received on Ten-GigabitEthernet 1/0/1 by using the following parameters:

•

The CIR is 2560 kbps.

•

The CBS is 20480 bytes.

•

The action for red packets is discard .

77

Figure 24 Network diagram

Internet

XGE1/0/1

Switch

VLAN10 VLAN100

Configuration procedure

# Configure aggregate CAR according to the rate limit requirements.

<Switch> system-view

[Switch] qos car aggcar-1 aggregative cir 2560 cbs 20480 red discard

# Create class 1 to match traffic of VLAN 10. Create behavior 1 and use the aggregate CAR in the behavior.

[Switch] traffic classifier 1

[Switch-classifier-1] if-match service-vlan-id 10

[Switch-classifier-1] quit

[Switch] traffic behavior 1

[Switch-behavior-1] car name aggcar-1

[Switch-behavior-1] quit

# Create class 2 to match traffic of VLAN 100. Create behavior 2 and use the aggregate CAR in the behavior.

[Switch] traffic classifier 2

[Switch-classifier-2] if-match service-vlan-id 100

[Switch-classifier-2] quit

[Switch] traffic behavior 2

[Switch-behavior-2] car name aggcar-1

[Switch-behavior-2] quit

# Create a QoS policy named car , associate class 1 with behavior 1, and associate class 2 with behavior 2.

[Switch] qos policy car

[Switch-qospolicy-car] classifier 1 behavior 1

[Switch-qospolicy-car] classifier 2 behavior 2

[Switch-qospolicy-car] quit

# Apply QoS policy car to the inbound direction of Ten-GigabitEthernet 1/0/1.

78

[Switch] interface Ten-GigabitEthernet 1/0/1

[Switch-Ten-GigabitEthernet1/0/1]qos apply policy car inbound

79

Configuring class-based accounting

Class-based accounting collects statistics (in packets or bytes) on a per-traffic class basis. For example, you can define the action to collect statistics for traffic sourced from a certain IP address.

By analyzing the statistics, you can determine whether anomalies have occurred and what action to take.

Configuration procedure

To configure class-based accounting:

Step

1. Enter system view.

2. Create a traffic class and enter traffic class view.

3. Configure match criteria.

Command system-view traffic classifier classifier-name

[ operator { and | or } ]

if-match match-criteria

Remarks

N/A

By default, no traffic class exists.

By default, no match criterion is configured.

N/A 4. Return to system view.

5. Create a traffic behavior and enter traffic behavior view. quit

traffic behavior behavior-name

By default, no traffic behavior exists.

6. Configure the accounting action. accounting [ byte | packet ]

By default, no traffic accounting action is configured.

7.

10.

11.

Return to system view.

8. Create a QoS policy and enter QoS policy view.

9. Associate the traffic class with the traffic behavior in the QoS policy.

Return to system view.

Apply the QoS policy. quit qos policy classifier

policy-name

classifier-name behavior

behavior-name

N/A

By default, no QoS policy exists.

By default, a traffic class is not associated with a traffic behavior. quit

•

Applying the QoS policy to an interface

•

Applying the QoS policy to a VLAN

•

Applying the QoS policy globally

•

Applying the QoS policy to a control plane

N/A

Choose one of the application destinations as needed.

By default, no QoS policy is applied.

80

Step

12. (Optional.) Display traffic accounting configuration.

Command Remarks

In standalone mode:

• display qos policy control-plane

slot slot-number

• display qos policy global [ slot slot-number ] [ inbound | outbound ]

• display qos policy interface

[ interface-type interface-number ]

[ inbound | outbound ]

• display qos vlan-policy { name policy-name | vlan [ vlan-id ] } [ slot slot-number ] [ inbound | outbound ]

In IRF mode:

• display qos policy control-plane chassis chassis-number slot slot-number

• display qos policy global

[ chassis chassis-number slot slot-number ] [ inbound | outbound ]

• display qos policy interface

[ interface-type interface-number ]

[ chassis chassis-number slot slot-number ] [ inbound | outbound ]

• display qos vlan-policy { name policy-name | vlan [ vlan-id ] }

[ chassis chassis-number slot slot-number ] [ inbound | outbound ]

Available in any view.

Class-based accounting configuration example

Network requirements

As shown in Figure 25 , configure class-based accounting on GigabitEthernet 1/0/1 to collect

statistics for incoming traffic from 1.1.1.1/24.

Figure 25 Network diagram

Host

1.1.1.1/24

Switch

GE1/0/1

Configuration procedure

# Create basic ACL 2000, and configure a rule to match packets with source IP address 1.1.1.1.

<Switch> system-view

[Switch] acl basic 2000

[Switch-acl-ipv4-basic-2000] rule permit source 1.1.1.1 0

[Switch-acl-ipv4-basic-2000] quit

81

# Create a traffic class named classifier_1 , and use ACL 2000 as the match criterion in the traffic class.

[Switch] traffic classifier classifier_1

[Switch-classifier-classifier_1] if-match acl 2000

[Switch-classifier-classifier_1] quit

# Create a traffic behavior named behavior_1 , and configure the class-based accounting action.

[Switch] traffic behavior behavior_1

[Switch-behavior-behavior_1] accounting

[Switch-behavior-behavior_1] quit

# Create a QoS policy named policy , and associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.

[Switch] qos policy policy

[Switch-qospolicy-policy] classifier classifier_1 behavior behavior_1

[Switch-qospolicy-policy] quit

# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] qos apply policy policy inbound

[Switch-GigabitEthernet1/0/1] quit

# Display traffic statistics to verify the configuration.

[Switch] display qos policy interface gigabitethernet 1/0/1

Interface: GigabitEthernet1/0/1

Direction: Inbound

Policy: policy

Classifier: classifier_1

Operator: AND

Rule(s) :

If-match acl 2000

Behavior: behavior_1

Accounting enable:

28529 (Packets)

82

Appendixes

Appendix A Acronym

Table 6 Appendix A Acronym

Acronym

AF

BE

CAR

CBS

CIR

DCBX

DiffServ

DSCP

EBS

ECN

EF

GTS

IntServ

ISP

PIR

QoS

RED

RSVP

SP

ToS

VPN

WFQ

WRED

WRR

Full spelling

Assured Forwarding

Best Effort

Committed Access Rate

Committed Burst Size

Committed Information Rate

Data Center Bridging Exchange Protocol

Differentiated Service

Differentiated Services Code Point

Excess Burst Size

Explicit Congestion Notification

Expedited Forwarding

Generic Traffic Shaping

Integrated Service

Internet Service Provider

Peak Information Rate

Quality of Service

Random Early Detection

Resource Reservation Protocol

Strict Priority

Type of Service

Virtual Private Network

Weighted Fair Queuing

Weighted Random Early Detection

Weighted Round Robin

Appendix B Default priority maps

For the default dot1p-exp , dscp-dscp , and exp-dot1p priority maps, an input value yields a target value equal to it.

83

Table 7 Default dot1p-lp and dot1p-dp priority maps

4

5

6

2

3

Input priority value dot1p

0

1

4

5

6

1

3 dot1p-lp map lp

2

0

7 7

Table 8 Default dscp-dp priority map

Input priority value dscp

0 to 7

8 to 15

16 to 23

24 to 31

32 to 39

40 to 47

48 to 55

56 to 63

0

0

0

0

0

0

0 dscp-dp map dp

0

0

0

0

0

0

0 dot1p-dp map dp

0

0

Appendix C Introduction to packet precedence

IP precedence and DSCP values

Figure 26 ToS and DS fields

Bits:

IPv4 ToS

byte

0 1

Preced ence

2 3 4 5

Type of

Service

6 7

M

B

Z

Bits: 0 1 2 3 4 5 6 7

RFC 1122

RFC 1349

Must

Be

Zero

DS-Field

(for IPv4,ToS octet,and for

IPv6,Traffic

Class octet )

DSCP

Class Selector codepoints

CU

Currently

Unused

IP Type of Service (ToS)

RFC 791

Differentiated Services

Codepoint (DSCP)

RFC 2474

As shown in Figure 26 , the ToS field in the IP header contains 8 bits. The first 3 bits (0 to 2) represent

IP precedence from 0 to 7. According to RFC 2474, the ToS field is redefined as the differentiated

84

services (DS) field. A DSCP value is represented by the first 6 bits (0 to 5) of the DS field and is in the range 0 to 63. The remaining 2 bits (6 and 7) are reserved.

Table 9 IP precedence

4

5

6

2

3

IP precedence (decimal)

0

1

7

Table 10 DSCP values

IP precedence (binary)

000

001

010

011

100

101

110

111

Description

Routine priority immediate flash flash-override critical internet network

DSCP value (decimal)

46

48

56

0

36

38

8

16

24

32

40

26

28

30

34

10

12

14

18

20

22

DSCP value (binary)

101110

100100

100110

001000

010000

011000

100000

101000

110000

111000

000000

001010

001100

001110

010010

010100

010110

011010

011100

011110

100010

Description ef af42 af43 cs1 cs2 cs3 cs4 cs5 cs6 cs7 be (default) af11 af12 af13 af21 af22 af23 af31 af32 af33 af41

85

802.1p priority

802.1p priority lies in the Layer 2 header. It applies to occasions where Layer 3 header analysis is not needed and QoS must be assured at Layer 2.

Figure 27 An Ethernet frame with an 802.1Q tag header

Destination

Address

Source

Address

802.1Q header

TPID TCI

Length

/Type

Data

FCS(CRC-

32)

6 bytes 6 bytes 4 bytes 2 bytes 46~1500 bytes 4 bytes

As shown in Figure 27 , the 4-byte 802.1Q tag header consists of the 2-byte tag protocol identifier

(TPID) and the 2-byte tag control information (TCI). The value of the TPID is 0x8100. Figure 28

shows the format of the 802.1Q tag header. The Priority field in the 802.1Q tag header is called

802.1p priority, because its use is defined in IEEE 802.1p. Table 11 shows the values for 802.1p

priority.

Figure 28 802.1Q tag header

Byte 1 Byte 2 Byte 3 Byte 4

TPID(Tag protocol identifier) TCI(Tag control information)

1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 Priority

C

F

I

VLAN ID

7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0

Table 11 Description on 802.1p priority

6

7

2

3

4

5

802.1p priority (decimal)

0

1

802.1p priority (binary)

000

001

010

011

100

101

110

111

Description best-effort background spare excellent-effort controlled-load video voice network-management

EXP values

The EXP field is in MPLS labels for MPLS QoS purposes.

Figure 29 MPLS label structure

86

As shown in Figure 29 , the EXP field is 3-bit long and is in the range of 0 to 7.

87

Configuring time ranges

You can implement a service based on the time of the day by applying a time range to it. A time-based service takes effect only in time periods specified by the time range. For example, you can implement time-based ACL rules by applying a time range to them. If a time range does not exist, the service based on the time range does not take effect.

The following basic types of time ranges are available:

•

Periodic time range —Recurs periodically on a day or days of the week.

•

Absolute time range —Represents only a period of time and does not recur.

A time range is uniquely identified by the time range name. You can create a maximum of 1024 time ranges, each with a maximum of 32 periodic statements and 12 absolute statements. The active period of a time range is calculated as follows:

1. Combining all periodic statements.

2. Combining all absolute statements.

3. Taking the intersection of the two statement sets as the active period of the time range.

Configuration procedure

Step

1. Enter system view.

2. Create or edit a time range.

Command system-view time-range time-range-name

{ start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] | from time1 date1 [ to time2 date2 ] | to time2 date2 }

Remarks

N/A

By default, no time ranges exist.

Displaying and maintaining time ranges

Execute the display command in any view.

Task

Display time range configuration and status.

Command display time-range { time-range-name | all }

Time range configuration example

Network requirements

As shown in Figure 30 , configure an ACL on Device A to allow only Host A to access the server from

8:00 to 18:00 on working days from June 2015 to the end of the year.

88

Figure 30 Network diagram

Server

Host A

192.168.1.2/24

GE1/0/1

Device A

GE1/0/2

192.168.0.100/24

Host B

192.168.1.3/24

Configuration procedure

# Create a time range for the period from 8:00 to 18:00 on working days from June 2015 to the end of the year.

<DeviceA> system-view

[DeviceA] time-range work 08:00 to 18:00 working-day from 00:00 6/1/2015 to 24:00

12/31/2015

# Create an IPv4 basic ACL numbered 2001, and configure a rule in the ACL to permit packets only from 192.168.1.2/32 during the time range work .

[DeviceA] acl basic 2001

[DeviceA-acl-ipv4-basic-2001] rule permit source 192.168.1.2 0 time-range work

[DeviceA-acl-ipv4-basic-2001] rule deny source any time-range work

[DeviceA-acl-ipv4-basic-2001] quit

# Apply IPv4 basic ACL 2001 to filter outgoing packets on GigabitEthernet 1/0/2.

[DeviceA] interface gigabitethernet 1/0/2

[DeviceA-GigabitEthernet1/0/2] packet-filter 2001 outbound

[DeviceA-GigabitEthernet1/0/2] quit

Verifying the configuration

# Verify that the time range work is active on Device A.

[DeviceA] display time-range all

Current time is 13:58:35 6/29/2015 Friday

Time-range : work (Active)

08:00 to 18:00 working-day

from 00:00 6/1/2015 to 00:00 1/1/2016

89

Document conventions and icons

Conventions

This section describes the conventions used in the documentation.

Command conventions

Convention

Boldface

Italic

[ ]

{ x | y | ... }

[ x | y | ... ]

{ x | y | ... } *

[ x | y | ... ] *

Description

Bold text represents commands and keywords that you enter literally as shown.

Italic text represents arguments that you replace with actual values.

Square brackets enclose syntax choices (keywords or arguments) that are optional.

Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.

Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none.

Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.

Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none.

The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.

A line that starts with a pound (#) sign is comments.

&<1-n>

#

GUI conventions

Convention

Boldface

Description

Window names, button names, field names, and menu items are in Boldface. For example, the New User window opens; click OK .

Multi-level menus are separated by angle brackets. For example, File > Create >

Folder .

Symbols

>

Convention

WARNING!

CAUTION:

IMPORTANT:

NOTE:

TIP:

Description

An alert that calls attention to important information that if not understood or followed can result in personal injury.

An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software.

An alert that calls attention to essential information.

An alert that contains additional or supplementary information.

An alert that provides helpful information.

90

Network topology icons

Convention Description

Represents a generic network device, such as a router, switch, or firewall.

Represents a routing-capable device, such as a router or Layer 3 switch.

Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.

Represents an access controller, a unified wired-WLAN module, or the access controller engine on a unified wired-WLAN switch.

Represents an access point.

Represents a wireless terminator unit.

Represents a wireless terminator.

Represents a mesh access point.

Represents omnidirectional signals.

Represents directional signals.

Represents a security product, such as a firewall, UTM, multiservice security gateway, or load balancing device.

Represents a security module, such as a firewall, load balancing, NetStream, SSL

VPN, IPS, or ACG module.

Examples provided in this document

Examples in this document might use devices that differ from your device in hardware model, configuration, or software version. It is normal that the port numbers, sample output, screenshots, and other information in the examples differ from what you have on your device.

91

Support and other resources

Accessing Hewlett Packard Enterprise Support

•

For live assistance, go to the Contact Hewlett Packard Enterprise Worldwide website: www.hpe.com/assistance

•

To access documentation and support services, go to the Hewlett Packard Enterprise Support

Center website: www.hpe.com/support/hpesc

Information to collect

•

Technical support registration number (if applicable)

•

Product name, model or version, and serial number

•

Operating system name and version

•

Firmware version

•

Error messages

•

Product-specific reports and logs

•

Add-on products or components

•

Third-party products or components

Accessing updates

•

Some software products provide a mechanism for accessing software updates through the product interface. Review your product documentation to identify the recommended software update method.

•

To download product updates, go to either of the following:

 Hewlett Packard Enterprise Support Center Get connected with updates page: www.hpe.com/support/e-updates



Software Depot website: www.hpe.com/support/softwaredepot

•

To view and update your entitlements, and to link your contracts, Care Packs, and warranties with your profile, go to the Hewlett Packard Enterprise Support Center More Information on

Access to Support Materials page: www.hpe.com/support/AccessToSupportMaterials

IMPORTANT:

Access to some updates might require product entitlement when accessed through the Hewlett

Packard Enterprise Support Center. You must have an HP Passport set up with relevant entitlements.

92

Websites

Website

Networking websites

Hewlett Packard Enterprise Information Library for

Networking

Hewlett Packard Enterprise Networking website

Hewlett Packard Enterprise My Networking website

Hewlett Packard Enterprise My Networking Portal

Hewlett Packard Enterprise Networking Warranty

General websites

Hewlett Packard Enterprise Information Library

Hewlett Packard Enterprise Support Center

Hewlett Packard Enterprise Support Services Central

Contact Hewlett Packard Enterprise Worldwide

Subscription Service/Support Alerts

Software Depot

Customer Self Repair (not applicable to all devices)

Insight Remote Support (not applicable to all devices)

Link www.hpe.com/networking/resourcefinder www.hpe.com/info/networking www.hpe.com/networking/support www.hpe.com/networking/mynetworking www.hpe.com/networking/warranty www.hpe.com/info/enterprise/docs www.hpe.com/support/hpesc ssc.hpe.com/portal/site/ssc/ www.hpe.com/assistance www.hpe.com/support/e-updates www.hpe.com/support/softwaredepot www.hpe.com/support/selfrepair www.hpe.com/info/insightremotesupport/docs

Customer self repair

Hewlett Packard Enterprise customer self repair (CSR) programs allow you to repair your product. If a CSR part needs to be replaced, it will be shipped directly to you so that you can install it at your convenience. Some parts do not qualify for CSR. Your Hewlett Packard Enterprise authorized service provider will determine whether a repair can be accomplished by CSR.

For more information about CSR, contact your local service provider or go to the CSR website: www.hpe.com/support/selfrepair

Remote support

Remote support is available with supported devices as part of your warranty, Care Pack Service, or contractual support agreement. It provides intelligent event diagnosis, and automatic, secure submission of hardware event notifications to Hewlett Packard Enterprise, which will initiate a fast and accurate resolution based on your product’s service level. Hewlett Packard Enterprise strongly recommends that you register your device for remote support.

For more information and device support details, go to the following website: www.hpe.com/info/insightremotesupport/docs

Documentation feedback

Hewlett Packard Enterprise is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation

Feedback ( [email protected]

). When submitting your feedback, include the document title,

93

part number, edition, and publication date located on the front cover of the document. For online help content, include the product name, product version, help edition, and publication date located on the legal notices page.

94

Index

Numerics

802

QoS packet 802.1p priority, 86

802.1p

priority marking configuration, 64

802.1p priority

drop precedence, 63

A

absolute time range (ACL), 88, 88

access control list.

Use ACL

ACL

advanced configuration, 5

basics configuration, 3

configuration,

1, 3, 12

copying, 9

display, 11

IPv4 advanced configuration, 5

IPv4 basic configuration, 3

IPv6 advanced configuration, 6

IPv6 basic configuration, 4

Layer 2 configuration, 7

maintain, 11

match order, 1 naming, 1 numbering, 1

packet filtering applicable scope (VLAN

interface), 10 packet filtering application (interface), 10

packet filtering configuration, 9

packet filtering configuration (interface-based),

12

packet filtering default action, 11

packet filtering logging+SNMP notifications,

10

packet fragment filtering, 3

rule numbering, 2

time range configuration, 88, 88 time range display, 88

types, 1

user-defined configuration, 8

action

ACL packet filtering default action, 11

advanced ACL

type, 1

aggregate CAR

configuration,

76, 77

priority marking configuration, 64

QoS global CAR, 75

Appendix A (Acronyms), 83

Appendix B (Default priority maps), 83

Appendix C (Packet precedence), 84

applying

ACL packet filtering (interface), 10

QoS congestion avoidance queue-based WRED

table, 57

QoS policy, 19

QoS policy (control plane), 20

QoS policy (global), 20

QoS policy (interface), 19

QoS policy (VLAN), 19

auto

ACL auto match order sort, 1

ACL automatic rule numbering, 3

B bandwidth

QoS overview, 14

QoS policy configuration, 17

basic ACL

type, 1

behavior

QoS traffic behavior definition, 18

best-effort QoS service model, 14

C

CAR

aggregate CAR, 75

aggregate CAR configuration, 76

global CAR configuration, 75

global CAR display, 77 global CAR maintain, 77

hierarchical CAR, 75

hierarchical CAR configuration, 76

QoS aggregate CAR configuration, 77

changing

QoS priority mapping interface port priority, 27

classifying

QoS class-based accounting,

80, 81

QoS traffic class definition, 18

committed access rate.

Use CAR

common CAR

priority marking configuration, 64

configuring

95

ACL,

1, 3, 12

ACL (advanced), 5

ACL (basic), 3

ACL (Layer 2), 7

ACL (user-defined), 8

ACL packet filtering, 9

ACL packet filtering (interface-based), 12

ACL packet filtering applicable scope (VLAN

interface), 10

ACL packet filtering logging+SNMP

notifications, 10

color-based priority marking, 63

IPv4 ACL (advanced), 5

IPv4 ACL (basic), 3

IPv6 ACL (advanced), 6

IPv6 ACL (basic), 4

priority marking based on colors obtained

through mapping drop precedence, 64

priority marking based on colors obtained

through traffic policing, 64

QoS aggregate CAR,

76, 77

QoS class-based accounting,

80, 81

QoS congestion avoidance, 56

QoS congestion avoidance queue-based

WRED table, 57

QoS congestion avoidance WRED, 59

QoS congestion management (CM), 41

QoS congestion management (per-queue), 44

QoS congestion management SP+WFQ

queuing, 49

QoS congestion management SP+WRR

queuing, 48

QoS global CAR, 75

QoS GTS,

32, 37

QoS hardware congestion management, 44

QoS hardware congestion management

queue scheduling profile, 51

QoS hardware congestion management SP

queuing, 44

QoS hierarchical CAR, 76

QoS nesting, 69, 69

QoS policy, 17

QoS priority map+priority marking, 29

QoS priority mapping,

23, 26, 28

QoS priority mapping map, 26

QoS priority mapping port priority, 28

QoS priority mapping trusted port packet

priority, 27

QoS priority marking,

63, 66

QoS rate limit,

32, 37, 37

QoS traffic filtering, 61, 61

QoS traffic policing,

32, 36, 38

QoS traffic redirection,

72, 73

time range, 88, 88

congestion avoidance

configuration, 56

ECN, 56

queue-based WRED table, 57

RED, 56 tail drop, 56

WRED, 56

WRED configuration, 59

congestion management

displaying QoS congestion management, 55

per-queue configuration, 44

SP+WFQ queuing, 44

SP+WFQ queuing configuration, 49

SP+WRR queuing, 43

SP+WRR queuing configuration, 48

congestion management (CM)

QoS configuration, 41

control plane

QoS policy application, 19

QoS policy application (control plane), 20

copying

ACL, 9

D default

ACL packet filtering default action, 11

defining

QoS policy, 18

QoS traffic behavior, 18

QoS traffic class, 18

deploying

QoS network deployment, 15

detecting

QoS congestion avoidance RED, 56

QoS congestion avoidance WRED, 56

device

ACL packet filtering applicable scope (VLAN

interface), 10

ACL packet filtering application (interface), 10

ACL packet filtering configuration, 9

ACL packet filtering default action, 11

ACL packet filtering logging+SNMP notifications,

10

QoS congestion management (per-queue), 44

QoS hardware congestion management

configuration, 44

QoS policy application (control plane), 20

QoS policy application (global), 20

QoS policy application (interface), 19

96

QoS policy application (VLAN), 19

DiffServ QoS service model, 14

displaying

ACL, 11

QoS congestion avoidance WRED, 58

QoS congestion management, 55

QoS global CAR, 77

QoS GTS, 38

QoS hardware congestion management, 55

QoS policies, 21

QoS priority mapping, 28

QoS rate limit, 38

QoS traffic policing, 38

time range, 88

drop precedence

priority marking configuration, 64

drop priority (QoS priority mapping), 23

DSCP

QoS packet IP precedence and DSCP values,

84

E

ECN

QoS congestion avoidance, 56

evaluating

QoS traffic, 32

QoS traffic with token bucket, 32, 32, 32

EXP values, 86

Explicit Congestion Notification.

Use ECN

F filtering

ACL default action, 11

ACL packet filtering logging+SNMP

notifications, 10

ACL packet fragments, 3

QoS traffic filtering configuration, 61, 61

forwarding

ACL configuration,

1, 3, 12

ACL configuration (advanced), 5

ACL configuration (basic), 3

ACL configuration (Layer 2), 7

ACL configuration (user-defined), 8

QoS token bucket, 32

fragment

ACL fragment filtering, 3

G

General Traffic Shaping.

Use GTS

global

QoS policy application (global), 20

global CAR

aggregate CAR, 75

aggregate CAR configuration, 76

configuration, 75 hierarchical CAR, 75

hierarchical CAR configuration, 76

green packet

drop precedence, 63

GTS

QoS ACL-based configuration, 37

QoS all-traffic configuration, 37

QoS display, 38

QoS GTS configuration, 32

QoS MQC GTS configuration, 37

QoS non-MQC GTS configuration, 37

QoS queue-based configuration, 37

QoS traffic shaping, 34

H hardware congestion management

configuration, 44

display, 55

queue scheduling profile, 51

SP queuing,

41, 44

WFQ queuing,

43, 46

WRR queuing,

42, 45

hierarchical CAR

configuration, 76

global CAR, 75

I interface

ACL packet filtering configuration

(interface-based), 12

IntServ QoS service model, 14

IP addressing

ACL configuration,

1, 3, 12

ACL configuration (advanced), 5

ACL configuration (Layer 2), 7

ACL configuration (user-defined), 8

QoS class-based accounting configuration,

80, 81

QoS traffic filtering configuration, 61, 61

IPv4

ACL configuration (IPv4 advanced), 5

IPv6

ACL configuration (IPv4 basic), 3

ACL packet filtering configuration, 9

ACL configuration (IPv6 advanced), 6

ACL configuration (IPv6 basic), 4

ACL packet filtering configuration, 9

L

Layer 2

97

ACL configuration, 7

ACL type, 1

limiting

QoS rate limit configuration, 37

QoS rate limit display, 38

QoS rate limiting, 35

local

QoS priority mapping local precedence, 23

local precedence

priority marking configuration, 64

logging

ACL packet filtering logging, 10

M maintaining

ACL, 11

QoS global CAR, 77

QoS policies, 21

matching

ACL match order auto, 1

ACL match order config, 1

modular QoS.

Use MQC

MPLS QoS

EXP value, 86

MQC

QoS GTS configuration, 37

MQC QoS

traffic policing configuration, 36

N naming

ACL, 1

ACL copy, 9

nesting

QoS configuration, 69, 69

network

ACL configuration (advanced), 5

ACL configuration (basic), 3

ACL configuration (Layer 2), 7

ACL configuration (user-defined), 8

ACL copy, 9

ACL packet filtering applicable scope (VLAN

interface), 10

ACL packet filtering application (interface), 10

ACL packet filtering configuration, 9

ACL packet filtering configuration

(interface-based), 12

ACL packet filtering default action, 11

ACL packet filtering logging+SNMP

notifications, 10

ACL packet fragment filtering, 3

QoS aggregate CAR, 75

QoS aggregate CAR configuration,

76, 77

QoS class-based accounting configuration,

80, 81

QoS CM configuration, 41

QoS congestion avoidance configuration, 56

QoS congestion avoidance WRED queue-based

table, 57

QoS congestion avoidance+ECN, 56

QoS congestion management (per-queue), 44

QoS congestion management SP+WFQ queuing

configuration, 49

QoS congestion management SP+WRR queuing

configuration, 48

QoS deployment, 15

QoS global CAR configuration, 75

QoS GTS, 34

QoS GTS configuration,

32, 37

QoS hardware congestion management queue

scheduling profile, 51

QoS hardware congestion management SP

queuing, 44

QoS hardware congestion management WFQ

queuing, 46

QoS hardware congestion management WRR

queuing, 45

QoS hierarchical CAR, 75

QoS hierarchical CAR configuration, 76

QoS MQC, 17

QoS nesting configuration, 69, 69

QoS non-MQC, 17

QoS policy application, 19

QoS policy configuration, 17

QoS policy definition, 18

QoS priority mapping configuration,

23, 26

QoS priority mapping drop priority, 23

QoS priority mapping interface port priority, 27

QoS priority mapping map, 26

QoS priority mapping trusted port packet priority,

27

QoS priority marking configuration, 63

QoS rate limit, 35

QoS rate limit configuration,

32, 37

QoS traffic behavior definition, 18

QoS traffic class definition, 18

QoS traffic evaluation, 32

QoS traffic filtering configuration, 61, 61

QoS traffic policing, 33

QoS traffic policing configuration,

32, 36

QoS traffic redirection configuration,

72, 73

network management

ACL configuration,

1, 3, 12

QoS congestion avoidance WRED configuration,

59

98

QoS overview, 14

QoS priority map+priority marking, 29

QoS priority mapping configuration, 28

QoS priority mapping port priority, 28

QoS priority marking configuration, 66

QoS service models, 14

QoS techniques, 14

QoS traffic policing, 38

time range configuration, 88, 88

non-modular QoS.

Use non-MQC

non-MQC

QoS GTS configuration, 37

QoS traffic policing configuration, 36

notifying

ACL packet filtering logging+SNMP

notifications, 10

QoS congestion avoidance+ECN, 56

numbering

ACL, 1

ACL automatic rule numbering, 3

ACL copy, 9

ACL rule, 2

ACL rule numbering step, 2

P packet

QoS aggregate CAR, 75

QoS aggregate CAR configuration,

76, 77

QoS class-based accounting configuration, 80,

81

QoS congestion avoidance configuration, 56

QoS congestion avoidance+ECN, 56

QoS global CAR configuration, 75

QoS GTS, 34

QoS hierarchical CAR, 75

QoS hierarchical CAR configuration, 76

QoS nesting configuration, 69, 69

QoS overview, 14

QoS policy configuration, 17

QoS priority map+priority marking, 29

QoS priority mapping configuration,

23, 26, 28

QoS priority mapping port priority, 28

QoS priority marking configuration,

63, 66

QoS rate limit, 35

QoS traffic evaluation, 32

QoS traffic filtering configuration, 61, 61

QoS traffic policing, 33

QoS traffic redirection configuration,

72, 73

QoS trusted port packet priority, 27

packet coloring

drop precedence, 63 traffic policing, 63

packet filtering

ACL applicable scope (VLAN interface), 10

ACL configuration,

1, 3, 9, 12

ACL configuration (advanced), 5

ACL configuration (Layer 2), 7

ACL configuration (user-defined), 8

ACL default action, 11

ACL filtering application (interface), 10

ACL logging+SNMP notifications, 10

ACL packet filtering (interface-based), 12

ACL packet fragment filtering, 3

parameter

QoS MQC, 17

QoS non-MQC, 17

periodic time range (ACL), 88, 88

per-queue congestion management, 44

policy

QoS application, 19

QoS application (control plane), 20

QoS application (global), 20

QoS application (interface), 19

QoS application (VLAN), 19

QoS definition, 18

QoS MQC, 17

QoS non-MQC, 17

QoS policy configuration, 17

port

QoS priority mapping interface port priority, 27

QoS trusted port packet priority, 27

precedence

QoS priority map+priority marking, 29

QoS priority mapping configuration,

23, 26, 28

QoS priority mapping local precedence, 23

QoS priority mapping port priority, 28

priority mapping.

See priority mapping

marking.

See priority marking

QoS MPLS EXP value, 86

QoS packet 802.1p priority, 86

QoS packet IP precedence and DSCP values, 84

priority map

drop precedence, 63

priority mapping

configuration,

23, 26, 28

drop priority, 23

interface port priority, 27

local precedence, 23 map, 23

map configuration, 26

99

port priority, 28

priority map +priority marking, 29

priority trust mode, 24 process, 24

trusted port packet priority, 27

user priority, 23

priority marking

configuration,

63, 66

procedure

applying ACL packet filtering (interface), 10

applying QoS congestion avoidance

queue-based WRED table, 57

applying QoS policy, 19

applying QoS policy (control plane), 20 applying QoS policy (global), 20

applying QoS policy (interface), 19 applying QoS policy (VLAN), 19

changing QoS priority mapping interface port

priority, 27

configuring ACL, 3

configuring ACL (advanced), 5

configuring ACL (basic), 3

configuring ACL (IPv4 advanced), 5

configuring ACL (IPv4 basic), 3

configuring ACL (IPv6 advanced), 6

configuring ACL (IPv6 basic), 4

configuring ACL (Layer 2), 7

configuring ACL (user-defined), 8

configuring ACL packet filtering, 9

configuring ACL packet filtering

(interface-based), 12

configuring ACL packet filtering applicable

scope (VLAN interface), 10

configuring ACL packet filtering

logging+SNMP notifications, 10

configuring color-based priority marking, 63

configuring priority marking based on colors obtained through mapping drop precedence,

64

configuring priority marking based on colors

obtained through traffic policing, 64

configuring QoS aggregate CAR,

76, 77

configuring QoS class-based accounting, 80,

81

configuring QoS congestion avoidance

queue-based WRED table, 57

configuring QoS congestion avoidance WRED,

59

configuring QoS congestion management

(per-queue), 44

configuring QoS congestion management

SP+WFQ queuing, 49

configuring QoS congestion management

SP+WRR queuing, 48

configuring QoS global CAR, 75

configuring QoS GTS, 37

configuring QoS hardware congestion

management, 44

configuring QoS hardware congestion

management queue scheduling profile, 51

configuring QoS hardware congestion

management SP queuing, 44

configuring QoS hierarchical CAR, 76

configuring QoS nesting, 69, 69

configuring QoS priority map+priority marking, 29

configuring QoS priority mapping, 26 configuring QoS priority mapping map, 26

configuring QoS priority mapping port priority, 28

configuring QoS priority mapping trusted port

packet priority, 27

configuring QoS priority marking,

63, 66

configuring QoS rate limit, 37

configuring QoS traffic filtering, 61, 61

configuring QoS traffic policing,

36, 38

configuring QoS traffic redirection,

72, 72, 73

configuring time range, 88, 88

copying ACL, 9

defining QoS policy, 18 defining QoS traffic behavior, 18 defining QoS traffic class, 18

displaying ACL, 11

displaying QoS congestion avoidance WRED, 58

displaying QoS congestion management, 55

displaying QoS global CAR, 77

displaying QoS GTS, 38

displaying QoS hardware congestion

management, 55

displaying QoS policies, 21

displaying QoS priority mapping, 28

displaying QoS rate limit, 38 displaying QoS traffic policing, 38

displaying time range, 88

DSCP, 64

maintaining ACL, 11

maintaining QoS global CAR, 77

maintaining QoS policies, 21

setting ACL packet filtering default action, 11

profile

QoS hardware congestion management queue

scheduling profile, 51

Q

QoS

ACL configuration,

1, 3, 12

100

aggregate CAR, 75

aggregate CAR configuration,

76, 77

Appendix A, Acronyms, 83

Appendix B, Default priority maps, 83

Appendix C, Packet precedence, 84

best-effort service model, 14

class-based accounting configuration,

80, 81

complicated traffic evaluation with token

bucket, 32

congestion avoidance, 15

congestion avoidance configuration, 56 congestion avoidance RED, 56 congestion avoidance tail drop, 56 congestion avoidance WRED, 56

congestion avoidance WRED configuration,

59

congestion avoidance WRED display, 58

congestion avoidance WRED queue-based

table, 57

congestion avoidance+ECN, 56

congestion management, 15

congestion management (CM) configuration,

41

congestion management (per-queue), 44

congestion management SP+WFQ queuing

configuration, 49

congestion management SP+WRR queuing

configuration, 48

device process flow, 15

DiffServ service model, 14

displaying congestion management, 55

global CAR configuration, 75

global CAR display, 77 global CAR maintain, 77

GTS, 34

GTS configuration,

32, 37

GTS display, 38

hardware congestion management

configuration, 44

hardware congestion management display, 55

hardware congestion management queue

scheduling profile, 51

hardware congestion management SP

queuing,

41, 44

hardware congestion management WFQ

queuing,

43, 46

hardware congestion management WRR

queuing,

42, 45

hierarchical CAR, 75

hierarchical CAR configuration, 76

IntServ service model, 14

MPLS EXP value, 86

MQC configuration, 17

nesting configuration, 69, 69

network deployment, 15

non-MQC, 17

overview, 14

packet 802.1p priority, 86

packet IP precedence and DSCP values, 84

policy application, 19

policy application (control plane), 20 policy application (global), 20

policy application (interface), 19 policy application (VLAN), 19

policy application restrictions (VLAN), 20

policy configuration, 17

policy definition, 18

policy display, 21 policy maintain, 21

priority map+priority marking, 29

priority mapping configuration,

23, 26, 28 priority mapping display, 28

priority mapping drop priority, 23

priority mapping interface port priority, 27

priority mapping local precedence, 23 priority mapping map,

23, 26

priority mapping port priority, 28

priority mapping process, 24

priority mapping trusted port packet priority, 27

priority mapping user priority, 23

priority marking configuration,

63, 66

priority trust mode, 24

rate limit, 35

rate limit configuration,

32, 37

rate limit display, 38

service models, 14

SP+WFQ queuing, 44

SP+WRR queuing, 43

techniques, 14

token bucket, 32

traffic behavior definition, 18 traffic class definition, 18

traffic classification, 15

traffic evaluation, 32 traffic evaluation with token bucket, 32, 32

traffic filtering configuration, 61, 61

traffic policing,

15, 33, 38

traffic policing configuration,

32, 36

traffic policing display, 38

traffic redirection configuration,

72, 73

traffic shaping, 15

QoS policy

101

priority marking configuration, 64

Quality of Service.

Use QoS

queuing

QoS congestion avoidance RED, 56

QoS congestion avoidance WRED, 56

QoS congestion avoidance WRED

configuration, 59

QoS congestion management SP+WFQ

queuing configuration, 49

QoS congestion management SP+WRR

queuing configuration, 48

QoS hardware congestion management

scheduling profile, 51

QoS hardware congestion management SP

queuing,

41, 44

QoS hardware congestion management WFQ

queuing,

43, 46

QoS hardware congestion management WRR

queuing,

42, 45

SP+WFQ queuing, 44

SP+WRR queuing, 43

R random early detection.

Use RED rate

QoS rate limit configuration, 37

QoS rate limit display, 38

QoS rate limiting, 35

rate limiting

QoS rate limiting configuration, 32

redirecting

QoS traffic redirection, 73

QoS traffic redirection to CPU, 72

QoS traffic redirection to interface, 72

restrictions

QoS policy application (VLAN), 20

WRED configuration, 57

routing

ACL configuration,

1, 3, 12

ACL configuration (advanced), 5

ACL configuration (basic), 3

ACL configuration (Layer 2), 7

ACL configuration (user-defined), 8

QoS congestion management (per-queue), 44

QoS GTS configuration, 32

QoS hardware congestion management

configuration, 44

QoS priority map+priority marking, 29

QoS priority mapping configuration,

23, 26, 28

QoS priority mapping port priority, 28

QoS rate limit configuration, 32

QoS traffic policing, 38

rule

QoS traffic policing configuration, 32

ACL auto match order sort, 1

ACL automatic rule numbering, 3

ACL config match order sort, 1

ACL numbering, 2

ACL numbering step, 2

S scheduling

QoS hardware congestion management queue

scheduling profile, 51

security

ACL configuration,

1, 3, 12

ACL configuration (advanced), 5

ACL configuration (basic), 3

ACL configuration (IPv4 advanced), 5

ACL configuration (IPv4 basic), 3

ACL configuration (IPv6 advanced), 6

ACL configuration (IPv6 basic), 4

ACL configuration (Layer 2), 7

ACL configuration (user-defined), 8

service

QoS best-effort service model, 14

QoS CM configuration, 41

QoS congestion avoidance configuration, 56

QoS DiffServ service model, 14

QoS global CAR configuration, 75

QoS IntServ service model, 14

QoS models, 14

QoS nesting configuration, 69, 69

QoS overview, 14

QoS policy configuration, 17

QoS priority marking configuration,

63, 66

QoS techniques, 14

QoS traffic filtering configuration, 61, 61

setting

ACL packet filtering default action, 11

SNMP

ACL packet filtering SNMP notifications, 10

sorting

ACL auto match order sort, 1

ACL config match order sort, 1

SP queuing

classifications, 41

configuration, 44

SP+WFQ queuing

configuration, 49

SP+WRR queuing

configuration, 48

statistics

102

QoS class-based accounting configuration, 80,

81

switching

QoS CM configuration, 41

T table

QoS congestion avoidance WRED

queue-based table, 57

tail drop (QoS), 56

TCP

QoS congestion avoidance RED, 56

QoS congestion avoidance tail drop, 56

time range

configuration, 88, 88 display, 88

token bucket

QoS complicated traffic evaluation, 32

QoS traffic evaluation, 32, 32

QoS traffic forwarding, 32

traffic

ACL configuration,

1, 3, 12

ACL configuration (advanced), 5

ACL configuration (Layer 2), 7

ACL configuration (user-defined), 8

ACL packet filtering configuration

(interface-based), 12

QoS aggregate CAR, 75

QoS aggregate CAR configuration,

76, 77

QoS class-based accounting configuration, 80,

81

QoS CM, 41,

See also under congestion management (CM)

QoS CM configuration, 41

QoS congestion avoidance, 15

QoS congestion avoidance configuration, 56

QoS congestion avoidance WRED

configuration, 59

QoS congestion avoidance WRED

queue-based table, 57

QoS congestion avoidance+ECN, 56

QoS congestion management, 15

QoS congestion management (per-queue), 44

QoS congestion management SP+WFQ

queuing configuration, 49

QoS congestion management SP+WRR

queuing configuration, 48

QoS device process flow, 15

QoS global CAR configuration, 75

QoS GTS, 34

QoS GTS configuration,

32, 37

QoS hardware congestion management

configuration, 44

QoS hardware congestion management queue

scheduling profile, 51

QoS hardware congestion management SP

queuing, 44

QoS hardware congestion management WFQ

queuing, 46

QoS hardware congestion management WRR

queuing, 45

QoS hierarchical CAR, 75

QoS hierarchical CAR configuration, 76

QoS MQC, 17

QoS nesting configuration, 69, 69

QoS network deployment, 15

QoS non-MQC, 17

QoS overview, 14

QoS policy application, 19

QoS policy application (control plane), 20

QoS policy application (global), 20

QoS policy application (interface), 19

QoS policy application (VLAN), 19

QoS policy configuration, 17

QoS policy definition, 18

QoS priority map, 23

QoS priority map+priority marking, 29

QoS priority mapping configuration, 28

QoS priority mapping interface port priority, 27

QoS priority mapping map, 26

QoS priority mapping port priority, 28

QoS priority mapping process, 24

QoS priority mapping trusted port packet priority,

27

QoS priority marking configuration,

63, 66

QoS priority trust mode, 24

QoS rate limit, 35

QoS rate limit configuration,

32, 37

QoS token bucket, 32

QoS traffic behavior definition, 18

QoS traffic class definition, 18

QoS traffic classification, 15

QoS traffic evaluation, 32

QoS traffic filtering configuration, 61, 61

QoS traffic policing,

15, 33, 38, 38

QoS traffic policing configuration,

32, 36

QoS traffic redirection configuration,

72, 73

QoS traffic shaping, 15

traffic behavior

priority marking configuration, 64

traffic policing

drop precedence, 63

103

drop precedence mapping, 63

priority marking configuration, 64

QoS display, 38

trapping

ACL packet filtering logging+SNMP

notifications, 10

trusted port packet priority (QoS), 27

type

ACL advanced, 1

ACL auto match order sort, 1

ACL basic, 1

ACL config match order sort, 1

ACL Layer 2, 1

ACL user-defined, 1

U user

QoS priority mapping user priority, 23

user-defined ACL

type, 1

V

VLAN

ACL packet filtering applicable scope (VLAN

interface), 10

QoS nesting configuration, 69, 69

QoS policy application, 19

QoS policy application (VLAN), 19

W weighted random early detection.

Use WRED

WFQ queuing

bandwidth, 43

configuration, 46

WRED

configuration, 59

configuration restrictions, 57

congestion avoidance+ECN, 56

display, 58

queue-based WRED table, 57

WRR queuing

basic queuing, 42

configuration, 45

group-based queuing, 42

Y yellow packet

drop precedence, 63

104