Aruba JH147A HPE FlexNetwork Switch Installation Guide
광고
광고
HPE FlexNetwork 5510 HI Switch Series
ACL and QoS Configuration Guide
Part number: 5200-0064b
Software version: Release 11xx
Document version: 6W102-20171020
© Copyright 2015, 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.
Contents
Configuring ACLs ············································································· 1
QoS overview ················································································ 13
Configuring a QoS policy ································································· 15
Configuring priority mapping ····························································· 22
i
Configuring traffic policing, GTS, and rate limit ····································· 33
Configuring congestion management ················································· 42
Configuring congestion avoidance ····················································· 53
Configuring traffic filtering ································································ 57
ii
Configuring priority marking ······························································ 59
Configuring nesting ········································································· 67
Configuring traffic redirecting ···························································· 70
Configuring global CAR ··································································· 73
Configuring class-based accounting ··················································· 80
Appendixes ··················································································· 83
Configuring time ranges ··································································· 87
Configuring data buffers ·································································· 89
iii
Document conventions and icons ······················································ 93
Support and other resources ···························································· 95
Index ··························································································· 98
iv
Configuring ACLs
Overview
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based on criteria such as source IP address, destination IP address, and port number.
ACLs are primarily used for packet filtering. " Configuring packet filtering with ACLs " provides an
example. You can use ACLs in QoS, security, routing, and other feature modules for identifying traffic. The packet drop or forwarding decisions depend on the modules that use ACLs.
Applications on the switch
An ACL is implemented in hardware or software, depending on the module that uses it.
•
If the module is implemented in hardware (for example, the packet filter or QoS module), the
ACL is applied to hardware to process traffic.
•
If the module is implemented in software (for example, the routing module or the login management module), the ACL is applied to software to process traffic.
The Telnet and SNMP features in the login management module denies packets that do not match any ACL. Some modules (QoS for example) ignore the permit or deny action in ACL rules and do not base their drop or forwarding decisions on the action set in ACL rules. See the specified module for information about ACL application.
ACL categories
Category
Basic ACLs
ACL number
2000 to 2999
Advanced ACLs 3000 to 3999
IP version
IPv4
IPv6
IPv4
IPv6
Match criteria
Source IPv4 address.
Source IPv6 address.
Source IPv4 address, destination IPv4 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields.
Source IPv6 address, destination IPv6 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields.
Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority, and link layer protocol type.
Ethernet frame header ACLs
4000 to 4999 IPv4 and IPv6
Numbering and naming ACLs
Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a number. In addition, you can assign the ACL a name for ease of identification. After creating an
ACL with a name, you cannot rename it or delete its name.
For an IPv4 basic or advanced ACLs, its ACL number and name must be unique in IPv4. For an IPv6 basic or advanced ACL, its ACL number and name must be unique in IPv6.
1
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the matching result and action to take depend on the rule order.
The following ACL match orders are available:
• config —Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule with a higher ID. If you use this method, check the rules and their order carefully.
• auto —Sorts ACL rules in depth-first order. Depth-first ordering makes sure any subset of a rule
is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first
ordering uses to sort rules for each type of ACL.
Table 1 Sort ACL rules in depth-first order
ACL category
IPv4 basic ACL
IPv4 advanced ACL
IPv6 basic ACL
IPv6 advanced ACL
Ethernet frame header ACL
Sequence of tie breakers
1. VPN instance.
2. More 0s in the source IPv4 address wildcard (more 0s means a narrower
IPv4 address range).
3. Rule configured earlier.
1. VPN instance.
2. Specific protocol number.
3. More 0s in the source IPv4 address wildcard mask.
4. More 0s in the destination IPv4 address wildcard.
5. Narrower TCP/UDP service port number range.
6. Rule configured earlier.
1. VPN instance.
2. Longer prefix for the source IPv6 address (a longer prefix means a narrower IPv6 address range).
3. Rule configured earlier.
1. VPN instance.
2. Specific protocol number.
3. Longer prefix for the source IPv6 address.
4. Longer prefix for the destination IPv6 address.
5. Narrower TCP/UDP service port number range.
6. Rule configured earlier.
1. More 1s in the source MAC address mask (more 1s means a smaller
MAC address).
2. More 1s in the destination MAC address mask.
3. Rule configured earlier.
A wildcard mask, also called an inverse mask, is a 32-bit binary number represented in dotted decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent "do care" bits, and the 1 bits represent "don't care" bits. If the "do care" bits in an IP address are identical to the "do care" bits in an IP address criterion, the IP address matches the criterion. All
"don't care" bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask.
Rule numbering
ACL rules can be manually numbered or automatically numbered. This section describes how automatic ACL rule numbering works.
2
Rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID.
The rule numbering step sets the increment by which the system automatically numbers rules. For example, the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of inserting rules in an ACL. This feature is important for a config-order ACL, where ACL rules are matched in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the current highest rule ID, starting with 0.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9,
10, and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule is numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4, 6, and 8.
Fragment filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid the risks, the HPE ACL implementation does the following:
•
Filters all fragments by default, including non-first fragments.
•
Allows for matching criteria modification for efficiency. For example, you can configure the ACL to filter only non-first fragments.
Configuration task list
Tasks at a glance
(Required.) Perform at least one of the following tasks:
•
•
Configuring an IPv4 advanced ACL
Configuring an IPv6 advanced ACL
•
Configuring an Ethernet frame header ACL
(Optional.) Configuring packet filtering with ACLs
Configuring a basic ACL
This section describes procedures for configuring IPv4 and IPv6 basic ACLs.
3
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based only on source IP addresses.
To configure an IPv4 basic ACL:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create an IPv4 basic ACL and enter its view. acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
By default, no ACL exists.
IPv4 basic ACLs are numbered in the range of 2000 to 2999.
You can use the acl name acl-name command to enter the view of a named ACL.
3. (Optional.) Configure a description for the IPv4 basic
ACL.
4. (Optional.) Set the rule numbering step. description step text step-value
By default, an IPv4 basic ACL has no ACL description.
The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ counting | fragment | logging |
source { source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
By default, an IPv4 basic ACL does not contain any rule.
The logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.
If an ACL is for outbound QoS traffic classification or outbound packet filtering, do not specify the vpn-instance keyword.
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comments are configured.
Configuring an IPv6 basic ACL
IPv6 basic ACLs match packets based only on source IP addresses.
To configure an IPv6 basic ACL:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create an IPv6 basic ACL view and enter its view.
acl ipv6 number acl-number
[ name acl-name ] [ match-order
{ auto | config } ]
By default, no ACL exists.
IPv6 basic ACLs are numbered in the range of 2000 to 2999.
You can use the acl ipv6 name acl-name command to enter the view of a named ACL.
3. (Optional.) Configure a description for the IPv6 basic
ACL.
4. (Optional.) Set the rule numbering step.
5. Create or edit a rule.
description step rule text step-value
[ rule-id ] { deny | permit
By default, an IPv6 basic ACL has no ACL description.
The default setting is 5.
} By default, an IPv6 basic ACL
4
Step Command
[ counting | fragment | logging | routing [ type routing-type ] | source { source-address source-prefix | source-address / source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
Remarks does not contain any rule.
The logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.
If an ACL is for QoS traffic classification or packet filtering:
•
Do not specify the fragment keyword.
•
Do not specify the vpn-instance or routing keyword if the ACL is for outbound application.
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comments are configured.
Configuring an advanced ACL
This section describes procedures for configuring IPv4 and IPv6 advanced ACLs.
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on the following criteria:
•
Source IP addresses.
•
Destination IP addresses.
•
Packet priorities.
•
Protocol numbers.
•
Other protocol header information, such as TCP/UDP source and destination port numbers,
TCP flags, ICMP message types, and ICMP message codes.
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv4 advanced ACL:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create an IPv4 advanced
ACL and enter its view.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
By default, no ACL exists.
IPv4 advanced ACLs are numbered in the range of 3000 to
3999.
You can use the acl name acl-name command to enter the view of a named ACL.
3. (Optional.) Configure a description for the IPv4 advanced ACL.
4. (Optional.) Set the rule numbering step. description step text step-value
By default, an IPv4 advanced ACL has no ACL description.
The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin
By default, an IPv4 advanced ACL does not contain any rule.
5
Step Command Remarks fin-value | psh psh-value | rst
The logging keyword takes effect rst-value | syn syn-value | urg only when the module (for urg-value } * | established } | example, packet filtering) that counting | destination uses the ACL supports logging.
{ dest-address dest-wildcard | any } | destination-port operator
If an ACL is for QoS traffic port1 [ port2 ] | { dscp dscp | classification or packet filtering:
{ precedence precedence | tos
•
Do not specify the tos } * } | fragment | icmp-type vpn-instance keyword if the
{ icmp-type [ icmp-code ] |
ACL is for outbound icmp-message } | logging | application. source { source-address source-wildcard | any } |
•
Do not specify neq for the operator argument.
source-port operator port1
[ port2 ] | time-range time-range-name | vpn-instance vpn-instance-name ] *
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comments are configured.
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the following criteria:
•
Source IPv6 addresses.
•
Destination IPv6 addresses.
•
Packet priorities.
•
Protocol numbers.
•
Other protocol header fields such as the TCP/UDP source port number, TCP/UDP destination port number, ICMPv6 message type, and ICMPv6 message code.
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv6 advanced ACL:
Step Command
1. Enter system view.
system-view
Remarks
N/A
2. Create an IPv6 acl ipv6 number acl-number advanced ACL [ name acl-name ] and enter its [ match-order { auto | view.
config } ]
By default, no ACL exists.
IPv6 advanced ACLs are numbered in the range of
3000 to 3999.
You can use the acl ipv6 name acl-name command to enter the view of a named ACL.
3. (Optional.)
Configure a description for the IPv6 advanced ACL.
4. (Optional.) Set the rule numbering step. description text step step-value
By default, an IPv6 advanced ACL has no ACL description.
The default setting is 5.
5. Create or edit a rule. rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn
By default, IPv6 advanced ACL does not contain any rule.
The logging keyword takes effect only when the
6
Step Command syn-value | urg urg-value } * | established } | counting | destination { dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port operator port1 [ port2 ] | dscp dscp | flow-label flow-label-value | fragment | icmp6-type { icmp6-type icmp6-code | icmp6-message } | logging | routing [ type routing-type ] | hop-by-hop [ type hop-type ]
| source { source-address source-prefix | source-address/source-prefix
| any } | source-port operator port1 [ port2 ] | time-range time-range-name vpn-instance
| vpn-instance-name ] *
Remarks module (for example, packet filtering) that uses the
ACL supports logging.
If an ACL is for QoS traffic classification or packet filtering:
•
Do not specify the fragment keyword.
•
Do not specify neq for the operator argument.
•
Do not specify the vpn-instance , routing , hop-by-hop , or flow-label keyword if the ACL is for outbound application.
•
Do not specify ipv6-ah for the protocol argument, nor set its value to 0, 43, 44, 51, or
60, if the ACL is for outbound application.
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text By default, no rule comments are configured.
NOTE:
If an ACL is to match information in the IPv6 packet payload, it can only match packets with one extension header. It cannot match packets with two or more extension headers or with the
Encapsulating Security Payload Header.
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol header fields, such as:
•
Source MAC address.
•
Destination MAC address.
•
802.1p priority (VLAN priority).
•
Link layer protocol type.
To configure an Ethernet frame header ACL:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create an Ethernet frame header ACL and enter its view.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
By default, no ACL exists.
Ethernet frame header ACLs are numbered in the range of 4000 to
4999.
You can use the acl name acl-name command to enter the view of a named ACL.
3. (Optional.) Configure a description for the Ethernet description text
By default, an Ethernet frame header ACL has no ACL
7
Step frame header ACL.
Command Remarks description.
4. (Optional.) Set the rule numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
By default , an Ethernet frame rule [ rule-id ] { deny | permit } header ACL does not contain any
[ cos vlan-pri | counting | rule. dest-mac dest-address dest-mask | { lsap lsap-type
If an Ethernet frame header ACL lsap-type-mask is used for packet filtering or QoS protocol-type protocol-type-mask source-mac source-address traffic classification and the lsap
} | lsap-type argument value must be AAAA, source-mask |
| type time-range and the lsap-type-mask argument time-range-name ] * value must be FFFF.
Otherwise, the ACL does not take effect.
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comments are configured.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL) has the same properties and content as the source ACL, but not the same ACL number and name.
To successfully copy an ACL, make sure:
•
The destination ACL number is from the same category as the source ACL number.
•
The source ACL already exists, but the destination ACL does not.
To copy an ACL:
Step
1. Enter system view.
2. Copy an existing ACL to create a new ACL.
Command system-view acl [ ipv6 ] copy { source-acl-number | name source-acl-name } to { dest-acl-number | name dest-acl-name }
Configuring packet filtering with ACLs
This section describes procedures for applying an ACL to filter incoming or outgoing IPv4 or IPv6 packets on the specified interface.
NOTE:
The ACL-based packet filter feature is available on Layer 2 and Layer 3 Ethernet interfaces, and
VLAN interfaces. The term "interface" in this section collectively refers to these types of interfaces.
You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN Switching Configuration Guide ).
8
Applying an ACL to an interface for packet filtering
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view.
interface interface-number interface-type
N/A
3. Apply an ACL to the interface to filter packets. packet-filter [ ipv6 ] { acl-number
| name acl-name } { inbound | outbound } [ hardware-count ]
By default, an interface does not filter packets.
You can apply only one ACL to the same direction of an interface.
Configuring the applicable scope of packet filtering on a
VLAN interface
You can configure the packet filtering on a VLAN interface to filter the following packets:
•
Packets forwarded at Layer 3 by the VLAN interface.
•
All packets, including packets forwarded at Layer 3 by the VLAN interface and packets forwarded at Layer 2 by the physical ports associated with the VLAN interface.
To configure the applicable scope of packet filtering on a VLAN interface:
Step Command
1. Enter system view.
system-view
Remarks
N/A
2. Create a VLAN interface and enter its view. interface
vlan-interface-id vlan-interface
If the VLAN interface already exists, you directly enter its view.
By default, no VLAN interface exists.
3. Specify the applicable scope of packet filtering on packet-filter filter [ route | all ] the VLAN interface.
By default, the packet filtering filters packets forwarded at Layer 3.
Setting the interval for generating and outputting packet filtering logs
After you set the interval, the device periodically generates and outputs the packet filtering logs to the information center, including the number of matching packets and the matched ACL rules. For more information about information center, see Network Management and Monitoring Configuration
Guide.
To set the interval for generating and outputting packet filtering logs:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Set the interval for generating and outputting acl [ ipv6 ] logging interval packet filtering logs. interval
The default setting is 0 minutes, which mean that no packet filtering logs are generated.
9
Setting the packet filtering default action
Step
1. Enter system view.
Command system-view
2. Set the packet filtering default action to deny. packet-filter default deny
Remarks
N/A
By default, the packet filter permits packets that do not match any ACL rule to pass.
Displaying and maintaining ACLs
Execute display commands in any view and reset commands in user view.
Task
Display ACL configuration and match statistics.
Command display acl [ ipv6 ] { acl-number | all | name acl-name }
Display whether an ACL has been successfully applied to an interface for packet filtering. display packet-filter { interface [ interface-type interface-number ] [ inbound | outbound ] | interface vlan-interface vlan-interface-number
[ inbound | outbound ] [ slot slot-number ] }
Display match statistics for packet filtering ACLs. display packet-filter statistics interface interface-type interface-number { inbound | outbound } [ [ ipv6 ] { acl-number | name acl-name } ] [ brief ]
Display the accumulated statistics for packet filtering
ACLs. display packet-filter statistics sum { inbound | outbound } [ ipv6 ] { acl-number | name acl-name }
[ brief ]
Display detailed ACL packet filtering information. display packet-filter verbose interface interface-type interface-number { inbound | outbound } [ [ ipv6 ] { acl-number | name acl-name } ] [ slot slot-number ]
Display QoS and ACL resource usage.
Clear ACL statistics. display qos-acl resource [ slot slot-number ] reset acl [ ipv6 ] counter { acl-number | all | name acl-name }
Clear match statistics (including the accumulated statistics) for packet filtering ACLs. reset packet-filter statistics interface
[ interface-type interface-number ] { inbound | outbound } [ [ ipv6 ] { acl-number | name acl-name } ]
ACL configuration example
Network requirements
A company interconnects its departments through Device A. Configure an ACL to:
•
Permit access from the President's office at any time to the financial database server.
•
Permit access from the Financial department to the database server only during working hours
(from 8:00 to 18:00) on working days.
•
Deny access from any other department to the database server.
10
Figure 1 Network diagram
Financial database server
192.168.0.100/24
GE1/0/2
GE1/0/1
GE1/0/4
Device A
GE1/0/3
President
' s office
192.168.1.0/24
Financial department
192.168.2.0/24
Marketing department
192.168.3.0/24
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<DeviceA> system-view
[DeviceA] time-range work 08:0 to 18:00 working-day
# Create an IPv4 advanced ACL numbered 3000 and configure three rules in the ACL. One rule permits access from the President's office to the financial database server, one rule permits access from the Financial department to the database server during working hours, and one rule denies access from any other department to the database server.
[DeviceA] acl number 3000
[DeviceA-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination
192.168.0.100 0
[DeviceA-acl-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination
192.168.0.100 0 time-range work
[DeviceA-acl-adv-3000] rule deny ip source any destination 192.168.0.100 0
[DeviceA-acl-adv-3000] quit
# Apply IPv4 advanced ACL 3000 to filter outgoing packets on interface GigabitEthernet 1/0/1.
[DeviceA] interface gigabitethernet 1/0/1
[DeviceA-GigabitEthernet1/0/1] packet-filter 3000 outbound
[DeviceA-GigabitEthernet1/0/1] quit
Verifying the configuration
# Ping the database server from a PC in the Financial department during the working hours. (All PCs in this example use Windows XP).
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Reply from 192.168.0.100: bytes=32 time=1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
11
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
The output shows that the database server can be pinged.
# Ping the database server from a PC in the Marketing department during the working hours.
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
The output shows the database server cannot be pinged.
# Display configuration and match statistics for IPv4 advanced ACL 3000 on Device A during the working hours.
[DeviceA] display acl 3000
Advanced ACL 3000, named -none-, 3 rules,
ACL's step is 5
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100 0
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100 0 time-range work
(Active)
rule 10 deny ip destination 192.168.0.100 0
The output shows that rule 5 is active.
12
QoS overview
In data communications, Quality of Service (QoS) provides differentiated service guarantees for diversified traffic in terms of bandwidth, delay, jitter, and drop rate, all of which can affect QoS.
Network resources are limited. When configuring a QoS scheme, you must consider the characteristics of different applications. For example, when bandwidth is fixed, more bandwidth used by one user leaves less bandwidth for others. QoS prioritizes traffic to balance the interests of users and manages network resources.
The following section describes typical QoS service models and widely used QoS techniques.
QoS service models
This section describes several typical QoS service models.
Best-effort service model
The best-effort model is a single-service model. As the simplest service model, the best-effort model is not as reliable as other models and does not guarantee delay-free delivery.
The best-effort service model is the default model for the Internet and applies to most network applications. It uses the First In First Out (FIFO) queuing mechanism.
IntServ model
The integrated service (IntServ) model is a multiple-service model that can accommodate diverse
QoS requirements. This service model provides the most granularly differentiated QoS by identifying and guaranteeing definite QoS for each data flow.
In the IntServ model, an application must request service from the network before it sends data.
IntServ signals the service request with the RSVP. All nodes receiving the request reserve resources as requested and maintain state information for the application flow.
The IntServ model demands high storage and processing capabilities because it requires all nodes along the transmission path to maintain resource state information for each flow. This model is suitable for small-sized or edge networks, but not large-sized networks, for example, the core layer of the Internet, where billions of flows are present.
DiffServ model
The differentiated service (DiffServ) model is a multiple-service model that can meet diverse QoS requirements. It is easy to implement and extend. DiffServ does not signal the network to reserve resources before sending data, as IntServ does.
QoS techniques overview
The QoS techniques include the following features:
•
Traffic classification.
•
Traffic policing.
•
Traffic shaping.
•
Rate limit.
13
•
Congestion management.
•
Congestion avoidance.
The following section briefly introduces these QoS techniques.
All QoS techniques in this document are based on the DiffServ model.
Deploying QoS in a network
Figure 2 Position of the QoS techniques in a network
Traffic direction
Traffic classification
Traffic policing
Traffic policing
WAN
Congestion management
Congestion avoidance
Traffic shaping
Traffic policing
Congestion management
Congestion avoidance
Traffic shaping
Traffic policing
and congestion avoidance mainly implement the following features:
•
Traffic classification —Uses match criteria to assign packets with the same characteristics to a traffic class. Based on traffic classes, you can provide differentiated services.
•
Traffic policing —Polices flows and imposes penalties to prevent aggressive use of network resources. You can apply traffic policing to both incoming and outgoing traffic of a port.
•
Traffic shaping —Adapts the output rate of traffic to the network resources available on the downstream device to eliminate packet drops. Traffic shaping usually applies to the outgoing traffic of a port.
•
Congestion management —Provides a resource scheduling policy to determine the packet forwarding sequence when congestion occurs. Congestion management usually applies to the outgoing traffic of a port.
•
Congestion avoidance —Monitors the network resource usage. It is usually applied to the outgoing traffic of a port. When congestion worsens, congestion avoidance reduces the queue length by dropping packets.
14
Configuring a QoS policy
You can configure QoS by using the MQC approach or non-MQC approach. Some features support both approaches, but some support only one.
Non-MQC approach
In the non-MQC approach, you configure QoS service parameters without using a QoS policy. For example, you can use the rate limit feature to set a rate limit on an interface without using a QoS policy.
MQC approach
In the modular QoS configuration (MQC) approach, you configure QoS service parameters by using
QoS policies. A QoS policy defines the shaping, policing, or other QoS actions to take on different classes of traffic. It is a set of class-behavior associations.
A traffic class is a set of match criteria for identifying traffic, and it uses the AND or OR operator.
•
If the operator is AND, a packet must match all the criteria to match the traffic class.
•
If the operator is OR, a packet matches the traffic class if it matches any of the criteria in the traffic class.
A traffic behavior defines a set of QoS actions to take on packets, such as priority marking and redirect.
By associating a traffic behavior with a traffic class in a QoS policy, you apply QoS actions in the traffic behavior to the traffic class.
Configuration procedure diagram
Figure 3 shows how to configure a QoS policy.
Figure 3 QoS policy configuration procedure
Define a class
Define a behavior
Define a policy
Apply the policy
To an interface
To a VLAN
Globally
To the control plane
To a user profile
15
Defining a traffic class
Configuration guidelines
When you configure a traffic class, follow these restrictions and guidelines:
•
If a traffic class includes the customer-vlan-id match criterion, a QoS policy that contains the traffic class can be applied only to interfaces.
•
If a traffic class includes both the control-plane protocol or control-plane protocol-group criterion and other criteria, the QoS policy that contains the traffic class cannot be applied correctly.
•
If a traffic class includes the control-plane protocol or control-plane protocol-group match criterion, the QoS policy that contains the traffic class can be applied only to a control plane.
•
To configure multiple values for a match criterion, perform the following tasks: a. Set the logical operator to OR. b. Configure multiple if-match commands for the match criterion.
For the customer-vlan-id and service-vlan-id match criteria, you can configure multiple values in one if-match command when the logical operator is OR or AND.
•
If the configured logical operator is AND for the traffic class, the actual logical operator for the rules in an ACL match criterion is OR.
Configuration procedure
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create a traffic class and enter traffic class view.
traffic classifier classifier-name
[ operator { and | or } ]
By default, no traffic class exists.
3. Configure match criteria.
if-match match-criteria
By default, no match criterion is configured.
For more information, see the if-match command in ACL and
QoS Command Reference .
Table 2 Available match criteria
Option Description acl [ ipv6 ] { acl-numbe r |
name acl-name }
Matches an ACL.
The acl-number argument has the following value ranges:
•
2000 to 3999 for IPv4 ACLs.
•
2000 to 3999 for IPv6 ACLs.
•
4000 to 4999 for Ethernet frame header ACLs.
The acl-name argument is a case-insensitive string of 1 to 63 characters, which must start with an English letter. To avoid confusion, make sure the argument is not all . any Matches all packets.
Matches control plane protocols. control-plane protocol protocol-name &<1-8>
The protocol-name &<1-8> argument specifies a space-separated list of up to eight system-defined control plane protocols.
16
Option control-plane protocol-group
protocol-group-name customer-dot1p dot1p-value &<1-8>
customer-vlan-id vlan-id-list
Description
Matches a control plane protocol group.
The protocol-group-name argument can be critical , important , management , monitor , normal , or redirect .
Matches 802.1p priority values in inner VLAN tags of double-tagged packets.
The dot1p-value &<1-8> argument specifies a space-separated list of up to eight 802.1p priority values. The value range for the dot1p-value argument is 0 to 7.
Matches VLAN IDs in inner VLAN tags of double-tagged packets.
The vlan-id-list argument specifies a space-separated list of up to 10 VLAN items. Each item specifies a VLAN or a range of VLANs in the form of vlan-id1 to vlan-id2 . The value for vlan-id2 must be equal to or greater than the value for vlan-id1 .
The value range for the vlan-id argument is 1 to
4094. destination-mac
mac-address dscp dscp-value &<1-8> ip-precedence ip-precedence-value &<1-8> protocol protocol-name qos-local-id local-id-value service-dot1p dot1p-value &<1-8> service-vlan-id vlan-id-list source-mac mac-address
Matches a destination MAC address.
Matches DSCP values.
The dscp-value &<1-8> argument specifies a space-separated list of up to eight DSCP values. The value range for the dscp-value argument is 0 to 63
or keywords shown in Table 11 .
Matches IP precedence values.
The ip-precedence-value &<1-8> argument specifies a space-separated list of up to eight IP precedence values. The value range for the ip-precedence-value argument is 0 to 7.
Matches a protocol.
The protocol-name argument can be ARP, IP, or IPv6.
Matches a local QoS ID in the range of 1 to 4095. The switch supports local
QoS IDs in the range of 1 to 3999.
Matches 802.1p priority values in outer VLAN tags.
The dot1p-value &<1-8> argument specifies a space-separated list of up to eight 802.1p priority values. The value range for the dot1p-value argument is 0 to 7.
Matches VLAN IDs in outer VLAN tags.
The vlan-id-list argument specifies a space-separated list of up to 10 VLAN items. Each item specifies a VLAN or a range of VLANs in the form of vlan-id1 to vlan-id2 . The value for vlan-id2 must be equal to or greater than the value for vlan-id1 .
The value range for the vlan-id argument is 1 to
4094.
Matches a source MAC address.
Defining a traffic behavior
A traffic behavior is a set of QoS actions (such as traffic filtering, shaping, policing, and priority marking) to perform on a traffic class.
To define a traffic behavior:
Step
1. Enter system view.
Command system-view
Remarks
N/A
17
Step
2. Create a traffic behavior and enter traffic behavior view.
Command
traffic behavior behavior-name
Remarks
By default, no traffic behavior exists.
See the subsequent chapters,
3. Configure actions in the depending on the purpose of the traffic behavior.
traffic behavior: traffic policing, traffic filtering, priority marking, traffic accounting, and so on.
By default, no action is configured for a traffic behavior.
Defining a QoS policy
You associate a traffic behavior with a traffic class in a QoS policy to perform the actions defined in the traffic behavior for the traffic class of packets.
When an ACL is used by a QoS policy for traffic classification, the action (permit or deny) in the ACL is ignored, and the actions in the associated traffic behavior are performed.
To associate a traffic class with a traffic behavior in a QoS policy:
Step
1. Enter system view.
Command system-view
2. Create a QoS policy and enter QoS policy view.
qos policy policy-name
Remarks
N/A
By default, no QoS policy exists.
3. Associate a traffic class with a traffic behavior to create a class-behavior association in the QoS policy.
classifier behavior classifier-name behavior-name
[ insert-before
before-classifier-name ]
By default, a traffic class is not associated with a traffic behavior.
Repeat this step to create more class-behavior associations.
Applying the QoS policy
You can apply a QoS policy to the following destinations:
•
Interface —The QoS policy takes effect on the traffic sent or received on the interface.
•
VLAN —The QoS policy takes effect on the traffic sent or received on all ports in the VLAN.
•
Globally —The QoS policy takes effect on the traffic sent or received on all ports.
•
Control plane —The QoS policy takes effect on the traffic received on the control plane.
•
User profile —The QoS policy takes effect on the traffic sent or received by the online users of the user profile.
You can modify traffic classes, traffic behaviors, and class-behavior associations in a QoS policy even after it is applied. If a traffic class uses an ACL for traffic classification, you can delete or modify the ACL (such as add rules to, delete rules from, and modify rules of the ACL).
QoS policies applied to an interface, a VLAN, and globally are in descending order of priority. The switch first matches the criteria in the QoS policy applied to an interface. If there is a match, the switch executes the QoS policy applied to the interface and ignores the QoS policies applied to the
VLAN and globally.
Applying the QoS policy to an interface
You can apply QoS policies to both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this section collectively refers to these two types of interfaces. You can use the port link-mode
18
command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN
Switching Configuration Guide ).
A QoS policy can be applied to multiple interfaces, but only one QoS policy can be applied in one direction (inbound or outbound) of an interface.
The QoS policy applied to the outgoing traffic on an interface does not regulate local packets, which are critical protocol packets sent by the local system for operation maintenance. The most common local packets include link maintenance, routing, LDP, RSVP, and SSH packets.
To apply the QoS policy to an interface:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view. interface interface-type interface-number
3. Apply the QoS policy to the interface.
qos apply policy policy-name { inbound | outbound }
N/A
By default, no QoS policy is applied to an interface.
NOTE:
If both packet filtering with the permit statement and QoS policies are configured on an interface, the car and filter actions in the QoS policies do not take effect. For information about packet
filtering, see " Configuring ACLs ."
Applying the QoS policy to a VLAN
You can apply a QoS policy to a VLAN to regulate traffic of the VLAN.
QoS policies cannot be applied to dynamic VLANs.
To apply the QoS policy to a VLAN:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Apply the QoS policy to
VLANs.
qos vlan-policy policy-name vlan vlan-id-list { inbound | outbound }
By default, no QoS policy is applied to a VLAN.
Applying the QoS policy globally
You can apply a QoS policy globally to the inbound or outbound direction of all ports.
To apply the QoS policy globally:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Apply the QoS policy globally.
qos apply policy policy-name global { inbound | outbound }
By default, no QoS policy is applied globally.
Applying the QoS policy to a control plane
A switch provides the data plane and the control plane.
19
•
Data plane —The units (such as various dedicated forwarding chips) at the data plane are responsible for receiving, transmitting, and switching (forwarding) packets. They deliver super processing speeds and throughput.
•
Control plane —The units (such as CPUs) at the control plane are processing units running most routing and switching protocols. They are responsible for protocol packet resolution and calculation. Compared with data plane units, the control plane units allow for great packet processing flexibility but have lower throughput.
When the data plane receives packets that it cannot recognize or process, it transmits them to the control plane. If the transmission rate exceeds the processing capability of the control plane, the control plane will be busy handling undesired packets and fail to handle legitimate packets correctly or timely. As a result, protocol performance is affected.
To address this problem, apply a QoS policy to the control plane to take QoS actions, such as traffic filtering or rate limiting, on inbound traffic. This ensures that the control plane can correctly receive, transmit, and process packets.
By default, the switch is configured with predefined control plane QoS policies, which take effect on the control planes by default. A predefined control plane QoS policy uses the protocol type or protocol group type to identify the type of packets sent to the control plane. You can use protocol types or protocol group types in if-match commands in traffic class view for traffic classification.
Then you can reconfigure traffic behaviors for these traffic classes as required. You can use the display qos policy control-plane pre-defined command to display predefined control plane QoS policies.
Configuration guidelines
If a QoS policy applied to the control plane uses if-match control-plane protocol-group or if-match control-plane protocol for traffic classification in a class, the action in the associated traffic behavior can only be car or the combination of car and accounting packet , and only the cir keyword in the car action can be applied normally.
Configuration procedure
To apply the QoS policy to a control plane:
Step
1. Enter system view.
Command system-view
2. Enter control plane view.
control-plane slot slot-number
Remarks
N/A
N/A
3. Apply the QoS policy to the control plane.
qos apply policy policy-name inbound
By default, no QoS policy is applied to a control plane.
Applying the QoS policy to a user profile
You can apply a QoS policy to multiple user profiles. In one direction of each user profile, only one policy can be applied. To modify a QoS policy already applied to a user profile, first remove the applied QoS policy.
When you apply a QoS policy to a user profile, follow these restrictions and guidelines:
•
The QoS policy supports only the car and accounting actions in its behaviors.
•
The QoS policy cannot be empty, because a user profile configured with an empty QoS policy cannot be activated.
•
The switch supports two authentication methods (802.1X and MAC) for online users.
To apply a QoS policy to a user profile:
20
Step
1. Enter system view.
Command system-view
Remarks
N/A
2.
3.
Enter user profile view.
Apply the QoS policy.
user-profile profile-name
The configuration made in user profile view takes effect only after it is successfully issued to the driver.
qos apply policy policy-name { inbound | outbound }
By default, no QoS policy is applied to a user profile.
Use the inbound keyword to apply the QoS policy to the incoming traffic of the device
(traffic sent by the online users). Use the outbound keyword to apply the QoS policy to the outgoing traffic of the device (traffic received by the online users).
Displaying and maintaining QoS policies
Execute display commands in any view and reset commands in user view.
Task
Display traffic class configuration.
Command display traffic classifier user-defined [ classifier-name ] [ slot slot-number ]
Display traffic behavior configuration. display traffic behavior user-defined [ behavior-name ] [ slot slot-number ]
Display QoS and ACL resource usage. display qos-acl resource [ slot slot-number ]
Display QoS policy configuration.
display qos policy user-defined [ policy-name [ classifier classifier-name ] ] [ slot slot-number ]
Display QoS policy configuration on the specified or all interfaces. display qos policy interface [ interface-type interface-number ]
[ inbound | outbound ]
Display information about QoS policies applied to VLANs. display qos vlan-policy { name policy-name | vlan vlan-id }
[ slot slot-number ] [ inbound | outbound ]
Display information about QoS policies applied globally. display qos policy global [ slot slot-number ] [ inbound | outbound ]
Display information about QoS policies applied to a control plane. display qos policy control-plane slot slot-number
Display information about the predefined
QoS policy applied to the control plane. display qos policy control-plane pre-defined [ slot slot-number ]
Clear the statistics of the QoS policy applied in a certain direction of a VLAN. reset qos vlan-policy [ vlan vlan-id ] [ inbound | outbound ]
Clear the statistics for a QoS policy applied globally. reset qos policy global [ inbound | outbound ]
Clear the statistics for the QoS policy applied to a control plane.
reset qos policy control-plane slot slot-number
21
Configuring priority mapping
Overview
When a packet arrives, a device assigns a set of QoS priority parameters to the packet based on either a priority field carried in the packet or the port priority of the incoming port. This process is called priority mapping. During this process, the device can modify the priority of the packet according to the priority mapping rules. The set of QoS priority parameters decides the scheduling priority and forwarding priority of the packet.
Priority mapping is implemented with priority maps and involves the following priorities:
•
802.1p priority.
•
DSCP.
•
EXP.
•
IP precedence.
•
Local precedence.
•
Drop priority.
Introduction to priorities
Priorities include the following types: priorities carried in packets, and priorities locally assigned for scheduling only.
Packet-carried priorities include 802.1p priority, DSCP precedence, IP precedence, and EXP. These priorities have global significance and affect the forwarding priority of packets across the network.
For more information about these priorities, see " Appendixes ."
Locally assigned priorities only have local significance. They are assigned by the switch only for scheduling. These priorities include the local precedence and drop priority, as follows:
•
Local precedence —Used for queuing. A local precedence value corresponds to an output queue. A packet with higher local precedence is assigned to a higher priority output queue to be preferentially scheduled.
•
Drop priority —Used for making packet drop decisions. Packets with the highest drop priority are dropped preferentially.
Priority maps
The switch provides various types of priority maps. By looking through a priority map, the switch decides which priority value to assign to a packet for subsequent packet processing. The switch provides the following priority mapping tables:
• dot1p-dp —802.1p-to-drop priority mapping table.
• dot1p-exp —802.1p-to-EXP priority mapping table.
• dot1p-lp —802.1p-to-local priority mapping table.
• dscp-dot1p —DSCP-to-802.1p priority mapping table, which is applicable only to IP packets.
• dscp-dp —DSCP-to-drop priority mapping table, which is applicable only to IP packets.
• dscp-dscp —DSCP-to-DSCP priority mapping table, which is applicable only to IP packets.
• exp-dot1p —EXP-to-802.1p priority mapping table.
• exp-dp —EXP-to-drop priority mapping table.
22
mapping. They are adequate in most cases. If a default priority map cannot meet your requirements, you can modify the priority map as required.
Priority trust mode on a port
The priority trust mode on a port determines which priority is used for priority mapping table lookup.
Port priority was introduced to use for priority mapping in addition to the priority fields carried in packets. The Switch Series provides the following priority trust modes:
•
Using the 802.1p priority carried in packets for priority mapping.
Table 3 Priority mapping results of trusting the 802.1p priority (when the default dot1p-lp priority mapping table is used)
5
6
7
1
2
3
4
802.1p priority carried in packets
Local precedence
0 2
5
6
7
0
1
3
4
Queue ID
1
3
4
2
0
5
6
7
NOTE:
When the 802.1p priority carried in packets is trusted, the port priority is used for priority mapping for packets which do not carry VLAN tags (namely, do not carry 802.1p priorities.) The priority mapping
results are the same as not trusting packet priority, as shown in Table 5 .
•
Using the DSCP carried in packets for priority mapping.
Table 4 Priority mapping results of trusting the DSCP (when the default dscp-dot1p and dot1p-lp priority mapping tables are used)
DSCP value carried in
Local precedence packets
0 to 7 2
Queue ID
2
8 to 15
16 to 23
24 to 31
32 to 39
40 to 47
48 to 55
0
4
5
1
3
6
0
1
3
4
5
6
56 to 63 7 7
•
Using the port priority as the 802.1p priority for priority mapping. The port priority is user configurable.
23
Table 5 Priority mapping results of not trusting packet priority (when the default dot1p-lp priority mapping table is used)
4
5
6
2
3
Port priority
0 (default)
1
Local precedence
2
0
4
5
6
1
3
Queue ID
2
0
4
5
6
1
3
7 7 7
The priority mapping process varies with priority trust mode. For more information, see the subsequent section.
Priority mapping process
On receiving an Ethernet packet on a port, the switch marks the scheduling priorities (local precedence and drop precedence) for the Ethernet packet. This procedure is done according to the priority trust mode of the receiving port and the 802.1Q tagging status of the packet, as shown in
24
Figure 4 Priority mapping process for an Ethernet packet
Receive a packet on a port
Should the packet be marked with local precedence or drop priority?
Yes
No
Mark it with local precedence or drop priority
802.1p in packets
Which priority is trusted on the port?
Port priority
Use port priority as
802.1q priority for priority mapping
No Is the packet
802.1q tagged?
Yes
DSCP in packets
Use port priority as
802.1p priority for priority mapping
Look up dot1p-dp and dot1p-lp mapping tables
Mark the packet with local precedence or drop priority
Look up dot1p-dp and dot1p-lp mapping tables
Mark the packet with local precedence or drop priority
Look up dscp-dp, dscp-dot1p, and dscp-dscp mapping tables
Mark the packet with 802.1p priority, drop precedence, and new DSCP precedence
Look up dot1p-dp and dot1p-lp mapping tables
Mark the packet with local precedence or drop priority
Look up dot1p-lp mapping table
Mark the packet with local precedence
Schedule the packet based on its local precedence or drop priority
A switch marks a received MPLS packet with a scheduling priority based on the priority trust mode
and the packet EXP value, as shown in Figure 5 .
25
Figure 5 Priority mapping process for an MPLS packet
Receive a packet with MPLS labels
802.1p or DSCP
Should the
packet be marked with local precedence or drop
Yes
priority?
No
Which priority
is trusted on the port?
Port priority
Mark the packet with local precedence or drop priority
Look up exp-dot1p mapping table
Look up expdot1p mapping table
Use port priority as EXP priority for priority mapping
Mark the packet with 802.1p priority
Mark the packet with 802.1p priority
Look up exp-dot1p mapping table
Look up exp-dp mapping table
Mark the packet with 802.1p priority
Look up dot1p-dp mapping table
Look up dot1p-lp mapping table
Mark the packet with drop priority
Look up dot1p-lp mapping table
Mark the packet with drop priority
Mark the packet with local precedence
Mark the packet with local precedence
Schedule the packet based on its local precedence or drop priority
For information about priority marking, see " Configuring priority marking ."
Priority mapping configuration tasks
The priority mapping feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term
"interface" in this chapter collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer
2—LAN Switching Configuration Guide ).
You can modify priority mappings by modifying priority mapping tables, priority trust mode on a port, and port priority.
To configure priority mapping, perform the following tasks:
26
Tasks at a glance
(Optional.) Configuring a priority map
(Required.) Perform one of the following tasks:
•
Configuring an interface to trust packet priority for priority mapping
•
Changing the port priority of an interface
Configuring a priority map
Step Command
1. Enter system view. system-view
Remarks
N/A
2. Enter priority map view.
qos map-table { dot1p-dp | dot1p-exp | dot1p-lp | dscp-dot1p | dscp-dp | dscp-dscp | exp-dot1p | exp-dp }
N/A
3. Configure mappings for the priority map.
import import-value-list export export-value
By default, the default priority maps are used.
For more information,
Newly configured mappings overwrite the old ones.
Configuring an interface to trust packet priority for priority mapping
You can configure the switch to trust a particular priority field carried in packets for priority mapping on interfaces.
When you configure the following trusted packet priority type on an interface, use the following available keywords:
• dot1p —Uses the 802.1p priority of received packets for mapping.
• dscp —Uses the DSCP precedence of received IP packets for mapping.
• none —Uses the port priority as the 802.1p priority for mapping.
To configure the trusted packet priority type on an interface:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view. interface interface-number interface-type
N/A
3. Configure the trusted packet priority type.
•
Configure the interface to trust the DSCP precedence. qos trust dscp
•
Configure the interface to trust the 802.1p priority of received packets. qos trust dot1p
•
Configure the interface not to trust any packet priority.
Use one of these commands.
By default, an interface does not trust any packet priority.
27
Step Command undo qos trust
Remarks
Changing the port priority of an interface
If an interface does not trust any packet priority, the switch uses its port priority to look for the set of priority parameters for the incoming packets. By changing port priority, you can prioritize traffic received on different interfaces.
To change the port priority of an interface:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view. interface interface-type interface-number
3. Set the port priority of the interface.
qos priority priority-value
N/A
The default setting is 0.
Displaying and maintaining priority mapping
Execute display commands in any view.
Task Command
Display priority map { dot1p-dp | dot1p-exp | dot1p-lp | dscp-dot1p | configuration.
dscp-dp | dscp-dscp | exp-dot1p | exp-dp }
Display the trusted packet priority type on a port.
display qos trust interface [ interface-type interface-number ]
Priority mapping configuration examples
Priority trust mode configuration example
Network requirements
As shown in Figure 6 , the packets from Switch A and Switch B to Switch C are not VLAN tagged.
Configure Switch C to preferentially process packets from Switch A to the server when
GigabitEthernet 1/0/3 of Switch C is congested.
28
Figure 6 Network diagram
Switch A
Internet
GE
1/0
/1
GE
1/0
/2
Switch C
GE1/0/3
Server
Switch B
Configuration procedure
# Assign port priority to GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2. Make sure the priority of
GigabitEthernet 1/0/1 is higher than that of GigabitEthernet 1/0/2, and no trusted packet priority type is configured on GigabitEthernet 1/0/1 or GigabitEthernet 1/0/2.
<SwitchC> system-view
[SwitchC] interface GigabitEthernet 1/0/1
[SwitchC-GigabitEthernet1/0/1] qos priority 3
[SwitchC-GigabitEthernet1/0/1] quit
[SwitchC] interface GigabitEthernet 1/0/2
[SwitchC-GigabitEthernet1/0/2] qos priority 1
[SwitchC-GigabitEthernet1/0/2] quit
Priority mapping table and priority marking configuration example
Network requirements
•
The Marketing department connects to GigabitEthernet 1/0/1 of the switch, which sets the
802.1p priority of traffic from the Marketing department to 3.
•
The R&D department connects to GigabitEthernet 1/0/2 of the switch, which sets the 802.1p priority of traffic from the R&D department to 4.
•
The Management department connects to GigabitEthernet 1/0/3 of the switch, which sets the
802.1p priority of traffic from the Management department to 5.
Configure port priority, 802.1p-to-local mapping table, and priority marking to implement the plan as
Table 6 Configuration plan
Traffic destination
Queuing plan
Traffic priority order
Traffic source
Public servers
R&D department >
R&D department
Management
Management department > Marketing department
Output queue
6
4
Queue priority
High
Medium
29
Traffic destination
Traffic priority order department
Queuing plan
Traffic source
Output queue
Marketing department 2
Internet
R&D department
Management department > Marketing Management department > R&D department department
2
6
Marketing department 4
Figure 7 Network diagram
Internet
Host Host
Queue priority
Low
Low
High
Medium
Server
Management department
Data server
GE
1/0
/3
GE
1/
0/
2
GE
1/
0/
4
Switch
GE
1/0
/1
Server
R&D department
Host
Mail server Server
Public servers
Configuration procedure
Marketing department
1. Enable trusting port priority:
# Set the port priority of GigabitEthernet 1/0/1 to 3.
<Switch> system-view
[Switch] interface GigabitEthernet 1/0/1
[Switch-GigabitEthernet1/0/1] qos priority 3
[Switch-GigabitEthernet1/0/1] quit
# Set the port priority of GigabitEthernet 1/0/2 to 4.
[Switch] interface GigabitEthernet 1/0/2
[Switch-GigabitEthernet1/0/2] qos priority 4
[Switch-GigabitEthernet1/0/2] quit
# Set the port priority of GigabitEthernet 1/0/3 to 5.
[Switch] interface GigabitEthernet 1/0/3
[Switch-GigabitEthernet1/0/3] qos priority 5
30
[Switch-GigabitEthernet1/0/3] quit
2. Configure the 802.1p-to-local mapping table to map 802.1p priority values 3, 4, and 5 to local precedence values 2, 6, and 4. This guarantees the R&D department, management department, and marketing department decreased priorities to access the public server.
[Switch] qos map-table dot1p-lp
[Switch-maptbl-dot1p-lp] import 3 export 2
[Switch-maptbl-dot1p-lp] import 4 export 6
[Switch-maptbl-dot1p-lp] import 5 export 4
[Switch-maptbl-dot1p-lp] quit
3. Configure priority marking:
# Mark the HTTP traffic of the management department, marketing department, and R&D department to the Internet with 802.1p priorities 4, 5, and 3, respectively. Use the priority mapping table you have configured to map the 802.1p priorities to local precedence values 6, 4, and 2, respectively, for differentiated traffic treatment.
# Create ACL 3000 to match HTTP traffic.
[Switch] acl number 3000
[Switch-acl-adv-3000] rule permit tcp destination-port eq 80
[Switch-acl-adv-3000] quit
# Create a class named http and use ACL 3000 in the class.
[Switch] traffic classifier http
[Switch-classifier-http] if-match acl 3000
[Switch-classifier-http] quit
# Configure a priority marking policy for the management department, and apply the policy to the incoming traffic of GigabitEthernet 1/0/3.
[Switch] traffic behavior admin
[Switch-behavior-admin] remark dot1p 4
[Switch-behavior-admin] quit
[Switch] qos policy admin
[Switch-qospolicy-admin] classifier http behavior admin
[Switch-qospolicy-admin] quit
[Switch] interface GigabitEthernet 1/0/3
[Switch-GigabitEthernet1/0/3] qos apply policy admin inbound
# Configure a priority marking policy for the marketing department, and apply the policy to the incoming traffic of GigabitEthernet 1/0/1.
[Switch] traffic behavior market
[Switch-behavior-market] remark dot1p 5
[Switch-behavior-market] quit
[Switch] qos policy market
[Switch-qospolicy-market] classifier http behavior market
[Switch-qospolicy-market] quit
[Switch] interface GigabitEthernet 1/0/1
[Switch-GigabitEthernet1/0/1] qos apply policy market inbound
# Configure a priority marking policy for the R&D department, and apply the policy to the incoming traffic of GigabitEthernet 1/0/2.
[Switch] traffic behavior rd
[Switch-behavior-rd] remark dot1p 3
[Switch-behavior-rd] quit
[Switch] qos policy rd
[Switch-qospolicy-rd] classifier http behavior rd
31
[Switch-qospolicy-rd] quit
[Switch] interface GigabitEthernet 1/0/2
[Switch-GigabitEthernet1/0/2] qos apply policy rd inbound
32
Configuring traffic policing, GTS, and rate limit
Overview
Traffic policing helps assign network resources (including bandwidth) and increase network performance. For example, you can configure a flow to use only the resources committed to it in a certain time range. This avoids network congestion caused by burst traffic.
Traffic policing, Generic Traffic Shaping (GTS), and rate limit control the traffic rate and resource usage according to traffic specifications. You can use token buckets for evaluating traffic specifications.
Traffic evaluation and token buckets
Token bucket features
A token bucket is analogous to a container that holds a certain number of tokens. Each token represents a certain forwarding capacity. The system puts tokens into the bucket at a constant rate.
When the token bucket is full, the extra tokens cause the token bucket to overflow.
Evaluating traffic with the token bucket
A token bucket mechanism evaluates traffic by looking at the number of tokens in the bucket. If the number of tokens in the bucket is enough for forwarding the packets, the following events occur:
•
The traffic conforms to the specification (called conforming traffic).
•
The corresponding tokens are taken away from the bucket.
Otherwise, the traffic does not conform to the specification (called excess traffic).
A token bucket has the following configurable parameters:
•
Mean rate at which tokens are put into the bucket, which is the permitted average rate of traffic.
It is usually set to the committed information rate (CIR).
•
Burst size or the capacity of the token bucket. It is the maximum traffic size permitted in each burst. It is usually set to the committed burst size (CBS). The set burst size must be greater than the maximum packet size.
Each arriving packet is evaluated.
Complicated evaluation
You can set two token buckets, bucket C and bucket E, to evaluate traffic in a more complicated environment and achieve more policing flexibility. For example, traffic policing can use the following mechanisms:
•
Single rate two color —Uses one token bucket and the following parameters:
CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.
CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.
When a packet arrives, the following rules apply:
If bucket C has enough tokens to forward the packet, the packet is colored green.
Otherwise, the packet is colored red.
•
Single rate three color —Uses two token buckets and the following parameters:
33
CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.
CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.
EBS —Size of bucket E minus size of bucket C. The EBS specifies the transient burst of traffic that bucket E can forward. The EBS cannot be 0. The size of E bucket is the sum of the CBS and EBS.
When a packet arrives, the following rules apply:
If bucket C has enough tokens, the packet is colored green.
If bucket C does not have enough tokens but bucket E has enough tokens, the packet is colored yellow.
If neither bucket C nor bucket E has enough tokens, the packet is colored red.
•
Two rate three color —Uses two token buckets and the following parameters:
CIR —Rate at which tokens are put into bucket C. It sets the average packet transmission or forwarding rate allowed by bucket C.
CBS —Size of bucket C, which specifies the transient burst of traffic that bucket C can forward.
PIR —Rate at which tokens are put into bucket E, which specifies the average packet transmission or forwarding rate allowed by bucket E.
EBS —Size of bucket E, which specifies the transient burst of traffic that bucket E can forward.
When a packet arrives, the following rules apply:
If bucket C has enough tokens, the packet is colored green.
If bucket C does not have enough tokens but bucket E has enough tokens, the packet is colored yellow.
If neither bucket C nor bucket E has enough tokens, the packet is colored red.
Traffic policing
Traffic policing supports policing the inbound traffic and the outbound traffic.
A typical application of traffic policing is to supervise the specification of traffic entering a network and limit it within a reasonable range. Another application is to "discipline" the extra traffic to prevent aggressive use of network resources by an application. For example, you can limit bandwidth for
HTTP packets to less than 50% of the total. If the traffic of a session exceeds the limit, traffic policing
can drop the packets or reset the IP precedence of the packets. Figure 8 shows an example of
policing outbound traffic on an interface.
34
Figure 8 Traffic policing
Put tokens into the bucket at the set rate
Packets to be sent out this interface
Packets sent
Classify
Token bucket
Drop
Traffic policing is widely used in policing traffic entering the ISP networks. It can classify the policed traffic and take predefined policing actions on each packet depending on the evaluation result as follows:
•
Forwarding the packet if the evaluation result is "conforming."
•
Dropping the packet if the evaluation result is "excess."
•
Forwarding the packet with its precedence re-marked if the evaluation result is "conforming."
Priorities that can be re-marked include 802.1p priority, DSCP precedence, and local precedence.
GTS
GTS supports shaping the outbound traffic. GTS limits the outbound traffic rate by buffering exceeding traffic. You can use GTS to adapt the traffic output rate on a device to the input traffic rate of its connected device to avoid packet loss.
The differences between traffic policing and GTS are as follows:
•
Packets to be dropped with traffic policing are retained in a buffer or queue with GTS, as shown
in Figure 9 . When enough tokens are in the token bucket, the buffered packets are sent at an
even rate.
•
GTS can result in additional delay and traffic policing does not.
35
Figure 9 GTS
Packets to be sent through this interface
Tokens are put into the bucket at the set rate
Packets sent
Packet classification
Token bucket
Queue
Packets dropped
For example, in Figure 10 , Switch B performs traffic policing on packets from Switch A and drops
packets exceeding the limit. To avoid packet loss, you can perform GTS on the outgoing interface of
Switch A so that packets exceeding the limit are cached in Switch A. Once resources are released,
GTS takes out the cached packets and sends them out.
Figure 10 GTS application
Device A Device B
Physical link
Rate limit
Rate limit controls the rate of inbound and outbound traffic. The outbound traffic is taken for example.
The rate limit of a physical interface specifies the maximum rate for sending or receiving packets
(including critical packets).
Rate limit also uses token buckets for traffic control. When rate limit is configured on an interface, a token bucket handles all packets to be sent through the interface for rate limiting. If enough tokens are in the token bucket, packets can be forwarded. Otherwise, packets are put into QoS queues for congestion management. In this way, the traffic passing the physical interface is controlled.
36
Figure 11 Rate limit implementation
Put tokens into the bucket at the set rate
Packets to be sent out this interface
Packets sent
Token bucket
Queue
Buffer
The token bucket mechanism limits traffic rate when accommodating bursts. It allows bursty traffic to be transmitted if enough tokens are available. If tokens are scarce, packets cannot be transmitted until efficient tokens are generated in the token bucket. It restricts the traffic rate to the rate for generating tokens.
Rate limit controls the total rate of all packets on a physical interface. It is easier to use than traffic policing in controlling the total traffic rate on a physical interface.
Configuring traffic policing
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create a traffic class and enter traffic class view. traffic classifier classifier-name
[ operator { and | or } ]
By default, no traffic class exists.
3. Configure match criteria.
if-match match-criteria
By default, no match criterion is configured.
For more information about the if-match command, see ACL and
QoS Command Reference .
4. Return to system view. quit
5. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name
N/A
By default, no traffic behavior exists.
car cir committed-information-rate
[ cbs committed-burst-size [ ebs excess-burst-size ] ] [ green action | red action | yellow action ] *
[ hierarchy-car hierarchy-car-name
6. Configure a traffic [ mode { and | or } ] ] policing action.
car cir committed-information-rate
[ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] [ green action | red action | yellow action ] *
[ hierarchy-car hierarchy-car-name
Use either of the commands.
By default, no traffic policing action is configured.
37
Step Command
[ mode { and | or } ] ]
Remarks
7. Return to system view. quit
8. Create a QoS policy and enter QoS policy view. qos policy policy-name
N/A
By default, no QoS policy exists.
9. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name [ insert-before
before-classifier-name ]
By default, a traffic class is not associated with a traffic behavior.
10. Return to system view. quit
11. Apply the QoS policy.
Applying the QoS policy to an interface
•
Applying the QoS policy globally
Applying the QoS policy to a control plane
Applying the QoS policy to a user profile
N/A
Choose one of the application destinations as needed.
By default, no QoS policy is applied.
12. (Optional.) Display traffic policing configuration. user-defined [ behavior-name ]
Available in any view.
Configuring GTS
The switch supports configuring queue-based GTS by using the non-MQC approach. In queue-based GTS, you set GTS parameters for packets of a queue.
To configure GTS:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type interface-number N/A
3. Configure GTS for a queue. qos gts queue queue-id cir
committed-information-rate
committed-burst-size ]
[ cbs
By default, GTS is not configured on an interface.
Configuring the rate limit
This feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this section collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN
Switching Configuration Guide ).
The rate limit of a physical interface specifies the maximum rate of incoming packets or outgoing packets.
To configure the rate limit:
38
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view.
3. Configure the rate limit for the interface. interface interface-number interface-type
N/A qos lr { inbound | outbound } cir committed-information-rate [ cbs committed-burst-size ]
By default, rate limit is not configured on an interface.
Displaying and maintaining traffic policing, GTS, and rate limit
Execute display commands in any view.
Task
Display QoS and ACL resource usage.
Command display qos-acl resource [ slot slot-number ]
Display traffic behavior configuration. display traffic behavior user-defined [ behavior-name ]
Display GTS configuration on an interface. display qos gts interface [ interface-type interface-number ]
Display rate limit configuration on an interface. display qos lr interface [ interface-type interface-number ]
Traffic policing configuration example
Network requirements
As shown in Figure 12 , configure traffic policing on GigabitEthernet 1/0/1 of Switch A to meet the
following requirements:
•
Limit the rate of traffic from the server to 102400 kbps: Transmit the conforming traffic, mark the excess traffic with DSCP value 0, and then transmit the excess traffic.
•
Limit the rate of traffic from Host A to 25600 kbps: Transmit the conforming traffic, and drop the excess traffic.
Configure traffic policing on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 of Switch B to meet the following requirements:
•
Limit the total incoming traffic rate of GigabitEthernet 1/0/1 to 204800 kbps and drop the excess traffic.
•
Limit the outgoing HTTP traffic (traffic accessing the Internet) rate of GigabitEthernet 1/0/2 to
102400 kbps and drop the excess traffic.
39
Figure 12 Network diagram
Server
1.1.1.1/8 Ethernet
Host A
1.1.1.2/8 GE1/0/1
Switch B
GE1/0/2
Internet
Host B GE1/0/1
Switch A
GE1/0/3
GE1/0/2
Configuration procedure
1. Configure Switch A:
# Configure ACL 2001 and ACL 2002 to match traffic from the server and Host A, respectively.
<SwitchA> system-view
[SwitchA] acl number 2001
[SwitchA-acl-basic-2001] rule permit source 1.1.1.1 0
[SwitchA-acl-basic-2001] quit
[SwitchA] acl number 2002
[SwitchA-acl-basic-2002] rule permit source 1.1.1.2 0
[SwitchA-acl-basic-2002] quit
# Create a class named server and use ACL 2001 as the match criterion. Create a class named host and use ACL 2002 as the match criterion.
[SwitchA] traffic classifier server
[SwitchA-classifier-server] if-match acl 2001
[SwitchA-classifier-server] quit
[SwitchA] traffic classifier host
[SwitchA-classifier-host] if-match acl 2002
[SwitchA-classifier-host] quit
# Create a behavior named server and configure the CAR action for the behavior as follows:
Set the CIR to 102400 kbps, and mark the excess packets (red packets) with DSCP value 0 and transmit them.
[SwitchA] traffic behavior server
[SwitchA-behavior-server] car cir 102400 red remark-dscp-pass 0
[SwitchA-behavior-server] quit
# Create a behavior named host and configure the CAR action for the behavior as follows: Set the CIR to 25600 kbps.
[SwitchA] traffic behavior host
[SwitchA-behavior-host] car cir 25600
[SwitchA-behavior-host] quit
# Create a QoS policy named car and associate class server with behavior server and class host with behavior host .
[SwitchA] qos policy car
[SwitchA-qospolicy-car] classifier server behavior server
[SwitchA-qospolicy-car] classifier host behavior host
[SwitchA-qospolicy-car] quit
# Apply QoS policy car to the incoming traffic of GigabitEthernet 1/0/1.
40
[SwitchA] interface GigabitEthernet 1/0/1
[SwitchA-GigabitEthernet1/0/1] qos apply policy car inbound
2. Configure Switch B:
# Configure advanced ACL 3001 to match HTTP traffic.
<SwitchB> system-view
[SwitchB] acl number 3001
[SwitchB-acl-adv-3001] rule permit tcp destination-port eq 80
[SwitchB-acl-adv-3001] quit
# Create a class named http and use ACL 3001 as the match criterion.
[SwitchB] traffic classifier http
[SwitchB-classifier-http] if-match acl 3001
[SwitchB-classifier-http] quit
# Create a class named class and configure the class to match all packets.
[SwitchB] traffic classifier class
[SwitchB-classifier-class] if-match any
[SwitchB-classifier-class] quit
# Create a behavior named car_inbound and configure the CAR action for the behavior as follows: Set the CIR to 204800 kbps.
[SwitchB] traffic behavior car_inbound
[SwitchB-behavior-car_inbound] car cir 204800
[SwitchB-behavior-car_inbound] quit
# Create a behavior named car_outbound and configure a CAR action for the behavior as follows: Set the CIR to 102400 kbps.
[SwitchB] traffic behavior car_outbound
[SwitchB-behavior-car_outbound] car cir 102400
[SwitchB-behavior-car_outbound] quit
# Create a QoS policy named car_inbound and associate class class with traffic behavior car_inbound in the QoS policy.
[SwitchB] qos policy car_inbound
[SwitchB-qospolicy-car_inbound] classifier class behavior car_inbound
[SwitchB-qospolicy-car_inbound] quit
# Create a QoS policy named car_outbound and associate class http with traffic behavior car_outbound in the QoS policy.
[SwitchB] qos policy car_outbound
[SwitchB-qospolicy-car_outbound] classifier http behavior car_outbound
[SwitchB-qospolicy-car_outbound] quit
# Apply QoS policy car_inbound to the incoming traffic of GigabitEthernet 1/0/1.
[SwitchB] interface GigabitEthernet 1/0/1
[SwitchB-GigabitEthernet1/0/1] qos apply policy car_inbound inbound
# Apply QoS policy car_outbound to the outgoing traffic of GigabitEthernet 1/0/2.
[SwitchB] interface GigabitEthernet 1/0/2
[SwitchB-GigabitEthernet1/0/2] qos apply policy car_outbound outbound
41
Configuring congestion management
Overview
Congestion occurs on a link or node when traffic size exceeds the processing capability of the link or node. It is typical of a statistical multiplexing network and can be caused by link failures, insufficient resources, and various other causes.
Figure 13 shows two typical congestion scenarios.
Figure 13 Traffic congestion scenarios
100M
100M 10M 100M 10M
100M > 10M
50M
(100M + 10M + 50M) > 100M
(1) (2)
Congestion produces the following negative results:
•
Increased delay and jitter during packet transmission.
•
Decreased network throughput and resource use efficiency.
•
Network resource (memory, in particular) exhaustion and even system breakdown.
Congestion is unavoidable in switched networks and multiuser application environments. To improve the service performance of your network, take measures to manage and control it.
The key to congestion management is defining a resource dispatching policy to prioritize packets for forwarding when congestion occurs.
Congestion management uses queuing and scheduling algorithms to classify and sort traffic leaving a port.
The Switch Series supports the following queue-scheduling mechanisms.
SP queuing
SP queuing is designed for mission-critical applications that require preferential service to reduce the response delay when congestion occurs.
42
Figure 14 SP queuing
Queue 7
High priority
Packets to be sent through this port
Queue 6 Sent packets
Interface
……
Queue 1
Packet classification
Queue scheduling
Sending queue
Queue 0
Low priority
In Figure 14 , SP queuing classifies eight queues on a port into eight classes, numbered 7 to 0 in
descending priority order.
SP queuing schedules the eight queues in descending order of priority. SP queuing sends packets in the queue with the highest priority first. When the queue with the highest priority is empty, it sends packets in the queue with the second highest priority, and so on. You can assign mission-critical packets to a high priority queue to make sure they are always served first. Common service packets can be assigned to low priority queues to be transmitted when high priority queues are empty.
The disadvantage of SP queuing is that packets in the lower priority queues cannot be transmitted if packets exist in the higher priority queues for a long time. In the worst case, lower priority traffic might never get serviced.
WRR queuing
WRR queuing schedules all the queues in turn to ensure that every queue is served for a certain
Figure 15 WRR queuing
Queue 0 Weight 1
Packets to be sent through this port Queue 1 Weight 2 Sent packets
Interface
……
Queue N-2 Weight N-1
Packet classification
Queue N-1 Weight N
Queue scheduling
Sending queue
43
Assume a port provides eight output queues. WRR assigns each queue a weight value (represented by w7, w6, w5, w4, w3, w2, w1, or w0) to decide the proportion of resources assigned to the queue.
The switch implements the weight of a queue by scheduling a certain number of bytes (byte-count
WRR) or packets (packet-based WRR) for that queue. Take byte-count WRR as an example: On a
10 Gbps port, you can set the weight values of WRR queuing to 5, 5, 3, 3, 1, 1, 1, and 1
(corresponding to w7, w6, w5, w4, w3, w2, w1, and w0, respectively). In this way, the queue with the lowest priority can get a minimum of 500 Mbps of bandwidth. WRR solves the problem that SP queuing might fail to serve packets in low-priority queues for a long time.
WFQ queuing
Figure 16 WFQ queuing
Queue 0 Weight 1
Packets to be sent through this port Queue 1 Weight 2 Sent packets
Interface
……
Queue N-2 Weight N-1
Packet classification
Queue N-1 Weight N
Queue scheduling
Sending queue
WFQ is similar to WRR. The difference is that WFQ enables you to set guaranteed bandwidth that a
WFQ queue can get during congestion.
SP+WRR queuing
You can configure some queues on an interface to use SP queuing and others to use WRR queuing by assigning the queues to the SP group and the WRR group (group 1). With this SP+WRR queuing method, the system first schedules the queues in the SP group and then schedules queues in the
WRR group when all queues in the SP group are empty. The queues in the SP group are scheduled based on their priorities. The queues in the WRR group are scheduled based on their weights.
SP+WFQ queuing
You can configure some queues on an interface to use SP queuing and others to use WFQ queuing by assigning the queues to the SP group and the WFQ group (group 1). With this SP+WFQ queuing method, the system schedules traffic as follows:
1. The system schedules the traffic conforming to the minimum guaranteed bandwidth in the WFQ group.
2. The system uses SP to schedule queues in the SP group.
3. If there is remaining bandwidth, the system schedules the traffic of queues in the WFQ group based on their weights.
44
Congestion management configuration task list
Tasks at a glance
(Required.) Configuring queuing
•
•
•
•
•
(Optional.) Configuring queue scheduling profiles
Remarks
Perform one of the tasks.
N/A
Configuring queuing
This feature is available on both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this chapter collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN
Switching Configuration Guide ).
Configuring SP queuing
Configuration procedure
To configure SP queuing:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view. interface interface-number interface-type
N/A
The default queuing algorithm on an interface is WRR queuing.
3. Configure SP queuing.
qos sp
Configuration example
Configure GigabitEthernet 1/0/1 to use SP queuing:
# Enter system view
<Sysname> system-view
# Configure GigabitEthernet1/0/1 to use SP queuing.
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] qos sp
Configuring WRR queuing
Configuration procedure
To configure WRR queuing:
45
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view. interface interface-type interface-number
3. Enable byte-count or packet-based WRR queuing.
qos wrr { byte-count | weight }
N/A
By default, byte-count WRR queuing is used.
4. Assign a queue to a
WRR group, and 1 configure scheduling { byte-count | weight } parameters for the schedule-value queue.
Select weight or byte-count according to the type (byte-count or packet-based) of
WRR you have enabled.
By default, all queues are in group 1, and the weights of queues 0 through 7 are 1, 2, 3, 4,
5, 9, 13, and 15, respectively.
Configuration example
1. Network requirements
Enable packet-based WRR on port GigabitEthernet 1/0/1, and assign queues 0 through 7 to the
WRR group, with their weights being 1, 2, 4, 6, 1, 2, 4, and 6, respectively.
2. Configuration procedure
# Enter system view.
<Sysname> system-view
# Configure WRR queuing on GigabitEthernet 1/0/1.
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet1/0/1] qos wrr weight
[Sysname-GigabitEthernet1/0/1] qos wrr 0 group 1 weight 1
[Sysname-GigabitEthernet1/0/1] qos wrr 1 group 1 weight 2
[Sysname-GigabitEthernet1/0/1] qos wrr 2 group 1 weight 4
[Sysname-GigabitEthernet1/0/1] qos wrr 3 group 1 weight 6
[Sysname-GigabitEthernet1/0/1] qos wrr 4 group 1 weight 1
[Sysname-GigabitEthernet1/0/1] qos wrr 5 group 1 weight 2
[Sysname-GigabitEthernet1/0/1] qos wrr 6 group 1 weight 4
[Sysname-GigabitEthernet1/0/1] qos wrr 7 group 1 weight 6
Configuring WFQ queuing
Configuration procedure
To configure WFQ queuing:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view. interface interface-type interface-number
N/A
3. Enable byte-count or { byte-count | packet-based WFQ queuing.
weight }
The default queuing algorithm on an interface is WRR queuing.
4. Assign a queue to a WFQ group, qos wfq queue-id group 1 and configure scheduling byte-count | weight } parameters for the queue.
schedule-value
Select weight or byte-count according to the type (byte-count or packet-based) of WFQ you have enabled.
46
Step Command Remarks
By default, all queues are in WFQ group 1 and have a weight of 1.
5. (Optional.) Set the minimum guaranteed bandwidth for a
WFQ queue. qos bandwidth queue
The default setting is 64 kbps for
queue-id min
bandwidth-value each queue.
Configuration example
1. Network requirements
Configure byte-count WFQ queuing on interface GigabitEthernet 1/0/1.
Assign queues 0 through 7 to the WFQ group, with their weights being 1, 1, 2, 5, 10, 10, 10, and 10, respectively.
Set the minimum guaranteed bandwidth to 100 Mbps for each queue.
2. Configuration procedure
# Enter system view.
<Sysname> system-view
# Configure byte-count WFQ queuing on interface GigabitEthernet 1/0/1.
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet1/0/1] qos wfq byte-count
[Sysname-GigabitEthernet1/0/1] qos wfq 0 group 1 byte-count 1
[Sysname-GigabitEthernet1/0/1] qos wfq 1 group 1 byte-count 1
[Sysname-GigabitEthernet1/0/1] qos wfq 2 group 1 byte-count 2
[Sysname-GigabitEthernet1/0/1] qos wfq 3 group 1 byte-count 5
[Sysname-GigabitEthernet1/0/1] qos wfq 4 group 1 byte-count 10
[Sysname-GigabitEthernet1/0/1] qos wfq 5 group 1 byte-count 10
[Sysname-GigabitEthernet1/0/1] qos wfq 6 group 1 byte-count 10
[Sysname-GigabitEthernet1/0/1] qos wfq 7 group 1 byte-count 10
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 0 min 100000
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 1 min 100000
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 2 min 100000
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 3 min 100000
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 4 min 100000
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 5 min 100000
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 6 min 100000
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 7 min 100000
Configuring SP+WRR queuing
Configuration procedure
To configure SP+WRR queuing:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view.
interface interface-type interface-number
N/A
3. Enable byte-count or { byte-count | packet-based WRR }
By default, all ports use WRR queuing.
47
Step queuing.
Command Remarks
4. Assign a queue to the SP group.
qos wrr queue-id group sp
By default, all the queues of a WRR-enabled port are in WRR group 1.
5. Assign a queue to a WRR group, and set the scheduling weight for the queue.
qos wrr queue-id group
1 { weight | byte-count }
schedule-value
Select weight or byte-count according to the type (byte-count or packet-based) of
WRR you have enabled.
By default, all queues are in WRR group 1, and the weights of queues 0 through 7 are 1,
2, 3, 4, 5, 9, 13, and 15, respectively.
Configuration example
1. Network requirements
Configure SP+WRR queuing on GigabitEthernet 1/0/1, and use byte-count WRR.
Assign queues 4 through 7 on GigabitEthernet 1/0/1 to the SP group.
Assign queues 0, 1, 2, and 3 on GigabitEthernet 1/0/1 to WRR group 1, with the weights being 1, 2, 1, and 3, respectively.
2. Configuration procedure
# Enter system view.
<Sysname> system-view
# Configure SP+WRR queuing on GigabitEthernet1/0/1.
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet1/0/1] qos wrr byte-count
[Sysname-GigabitEthernet1/0/1] qos wrr 4 group sp
[Sysname-GigabitEthernet1/0/1] qos wrr 5 group sp
[Sysname-GigabitEthernet1/0/1] qos wrr 6 group sp
[Sysname-GigabitEthernet1/0/1] qos wrr 7 group sp
[Sysname-GigabitEthernet1/0/1] qos wrr 0 group 1 byte-count 1
[Sysname-GigabitEthernet1/0/1] qos wrr 1 group 1 byte-count 2
[Sysname-GigabitEthernet1/0/1] qos wrr 2 group 1 byte-count 1
[Sysname-GigabitEthernet1/0/1] qos wrr 3 group 1 byte-count 3
Configuring SP+WFQ queuing
Configuration procedure
To configure SP+WFQ queuing:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Enter interface view. interface interface-type
interface-number
3. Enable byte-count or packet-based WFQ
[ byte-count | queuing. weight ]
N/A
The default queuing algorithm on an interface is WRR.
4. Assign a queue to the SP group.
qos wfq queue-id group sp
By default, all the queues of a
WFQ-enabled port are in WFQ group 1.
5. Assign a queue to a WFQ group, and set a scheduling
qos wfq queue-id group 1
{ weight | byte-count }
Select weight or byte-count according to the type (byte-count or
48
Step weight for the queue.
Command
schedule-value
Remarks packet-based) of WFQ you have enabled.
If you have enabled WFQ on the port, all the queues are in WFQ group 1 by default and the default scheduling weight is 1 for each queue.
6. (Optional.) Set the minimum guaranteed bandwidth for the queue. qos bandwidth queue
The default setting is 64 kbps for each
queue-id min queue in a WFQ group.
bandwidth-value
Configuration example
1. Network requirements
Configure SP+WFQ queuing on interface GigabitEthernet 1/0/1, and use packet-based
WFQ.
Assign queues 4 through 7 to the SP group.
Assign queues 0, 1, 2, and 3 to the WFQ group, with the weights being 1, 2, 1, and 3, respectively.
Set the minimum guaranteed bandwidth to 128 Mbps for each of the four queues.
2. Configuration procedure
# Enter system view.
<Sysname> system-view
# Configure SP+WFQ queuing on GigabitEthernet 1/0/1.
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet1/0/1] qos wfq weight
[Sysname-GigabitEthernet1/0/1] qos wfq 4 group sp
[Sysname-GigabitEthernet1/0/1] qos wfq 5 group sp
[Sysname-GigabitEthernet1/0/1] qos wfq 6 group sp
[Sysname-GigabitEthernet1/0/1] qos wfq 7 group sp
[Sysname-GigabitEthernet1/0/1] qos wfq 0 group 1 weight 1
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 4 min 128000
[Sysname-GigabitEthernet1/0/1] qos wfq 1 group 1 weight 2
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 5 min 128000
[Sysname-GigabitEthernet1/0/1] qos wfq 2 group 1 weight 1
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 6 min 128000
[Sysname-GigabitEthernet1/0/1] qos wfq 3 group 1 weight 3
[Sysname-GigabitEthernet1/0/1] qos bandwidth queue 7 min 128000
Displaying and maintaining queuing
Execute display commands in any view.
Task
Display SP queuing configuration.
Display WRR queuing configuration.
Display WFQ queuing configuration.
Command display qos queue sp interface [ interface-type interface-number ] display qos queue wrr interface [ interface-type interface-number ] display qos queue wfq interface [ interface-type
49
Task Command interface-number ]
Display queue-based outbound traffic display qos queue-statistics interface [ interface-type statistics. interface-number ] outbound
Configuring queue scheduling profiles
In a queue scheduling profile, you can configure scheduling parameters for each queue. By applying the queue scheduling profile to an interface, you can implement congestion management on the interface.
Queue scheduling profiles support three queue scheduling methods: SP, WRR, and WFQ. In a queue scheduling profile, you can configure SP+WRR or SP+WFQ. When SP+WRR or SP+WFQ is configured, the scheduling priority is as follows:
•
The SP group has higher priority than WRR groups and WFQ groups.
•
Queues in the SP group are scheduled in descending order of queue IDs.
•
Queues in a WRR or WFQ group are scheduled based on their weights.
When SP and WRR groups are configured in a queue scheduling profile, Figure 16 shows the
scheduling order.
Figure 16 Queue scheduling profile configured with both SP and WRR
Q7 Q6 Q5 Q4 Q3 Q2 Q1 Q0
SP group WRR group 1
•
Queue 7 has the highest priority. Its packets are sent preferentially.
•
Queue 5 has the second highest priority. Packets in queue 5 are sent when queue 7 is empty.
•
When both queue 7 and queue 5 are empty, WRR group 1 is scheduled. Queues 0, 1, 2, 3, 4, and 6 in WRR group 1 are scheduled according to their weights.
Configuring a queue scheduling profile
You can modify the scheduling parameters in a queue scheduling profile already applied to an interface. The modification takes effect immediately.
To configure a queue scheduling profile:
Step
1. Enter system view.
Command system-view
2. Create a queue scheduling profile and enter queue scheduling profile view.
qos qmprofile profile-name
Remarks
N/A
By default, no queue scheduling profile exists.
50
Step Command Remarks
3. Configure queue scheduling parameters.
•
Configure a queue to use SP:
queue queue-id sp
•
Configure a queue to use
WRR:
queue queue-id wrr group 1
{ byte-count | weight }
schedule-value
•
Configure a queue to use
WFQ:
queue queue-id wfq group 1
{ byte-count | weight } schedule-value
bandwidth queue queue-id min bandwidth-value
By default, all queues use SP.
You can configure all queues to use one queuing method or different queuing methods
(WRR+WFQ is not allowed).
4. Return to system view.
quit N/A
5. Enter interface view.
interface
interface-number interface-type
N/A
6. Apply the queue scheduling profile to the interface.
qos apply qmprofile profile-name
Only one queue scheduling profile can be applied an interface.
Displaying and maintaining queue scheduling profiles
Execute display commands in any view.
Task Command
Display the configuration of queue scheduling profiles. display qos qmprofile configuration [ profile-name ] [ slot slot-number ]
Display the queue scheduling profiles applied to interfaces. display qos qmprofile interface [ interface-type interface-number ]
Queue scheduling profile configuration example
Network requirements
Configure a queue scheduling profile on interface GigabitEthernet 1/0/1 to meet the following requirements:
•
Queue 7 has the highest priority, and its packets are sent preferentially.
•
Queue 0 through queue 6 in WRR group 1 are scheduled according to their weights, which are
2, 1, 2, 4, 6, 8, and 10, respectively. When queue 7 is empty, WRR group 1 is scheduled.
Configuration procedure
# Enter system view.
<Sysname> system-view
# Create a queue scheduling profile named qm1 .
[Sysname] qos qmprofile qm1
[Sysname-qmprofile-qm1]
# Configure queue 7 to use SP queuing.
[Sysname-qmprofile-qm1] queue 7 sp
51
# Assign queue 0 through queue 6 to WRR group 1, with their weights as 2, 1, 2, 4, 6, 8, and 10, respectively.
[Sysname-qmprofile-qm1] queue 0 wrr group 1 weight 2
[Sysname-qmprofile-qm1] queue 1 wrr group 1 weight 1
[Sysname-qmprofile-qm1] queue 2 wrr group 1 weight 2
[Sysname-qmprofile-qm1] queue 3 wrr group 1 weight 4
[Sysname-qmprofile-qm1] queue 4 wrr group 1 weight 6
[Sysname-qmprofile-qm1] queue 5 wrr group 1 weight 8
[Sysname-qmprofile-qm1] queue 6 wrr group 1 weight 10
# Apply queue scheduling profile qm1 to GigabitEthernet 1/0/1.
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet] qos apply qmprofile qm1
52
Configuring congestion avoidance
Overview
Avoiding congestion before it occurs is a proactive approach to improving network performance. As a flow control mechanism, congestion avoidance:
•
Actively monitors network resources (such as queues and memory buffers).
•
Drops packets when congestion is expected to occur or deteriorate.
When dropping packets from a source end, congestion avoidance cooperates with the flow control mechanism at the source end to regulate the network traffic size. The combination of the local packet drop policy and the source-end flow control mechanism helps maximize throughput and network use efficiency and minimize packet loss and delay.
Tail drop
Congestion management techniques drop all packets that are arriving at a full queue. This tail drop mechanism results in global TCP synchronization. If packets from multiple TCP connections are dropped, these TCP connections go into the state of congestion avoidance and slow start to reduce traffic, but traffic peak occurs later. Consequently, the network traffic jitters all the time.
RED and WRED
You can use Random Early Detection (RED) or Weighted Random Early Detection (WRED) to avoid global TCP synchronization.
Both RED and WRED avoid global TCP synchronization by randomly dropping packets. When the sending rates of some TCP sessions slow down after their packets are dropped, other TCP sessions remain at high sending rates. Link bandwidth is efficiently used, because TCP sessions at high sending rates always exist.
The RED or WRED algorithm sets an upper limit and lower limit for each queue, and processes the packets in a queue as follows:
•
When the queue size is shorter than the lower limit, no packet is dropped.
•
When the queue size reaches the upper limit, all subsequent packets are dropped.
•
When the queue size is between the lower limit and the upper limit, the received packets are dropped based on the user-configured drop probability.
If the current queue size is compared with the upper limit and lower limit to determine the drop policy, burst traffic is not fairly treated. To solve this problem, WRED compares the average queue size with the upper limit and lower limit to determine the drop probability.
The average queue size reflects the queue size change trend but is not sensitive to burst queue size changes, and burst traffic can be fairly treated.
ECN
By dropping packets, WRED alleviates the influence of congestion on the network. However, the network resources for transmitting packets from the sender to the device which drops the packets are wasted. When congestion occurs, it is a better idea to inform the sender of the congestion status and have the sender proactively slow down the packet sending rate or decrease the window size of packets. This better utilizes the network resources.
53
RFC 2482 defined an end-to-end congestion notification mechanism named Explicit Congestion
Notification (ECN). ECN uses the DS field in the IP header to mark the congestion status along the packet transmission path. A ECN-capable terminal can determine whether congestion occurs on the transmission path according to the packet contents, and then adjusts the packet sending speed to avoid deteriorating congestion. ECN defines the last two bits (ECN field) in the DS field of the IP header as follows:
•
Bit 6 indicates whether the sending terminal device supports ECN, and is called the
"ECN-Capable Transport (ECT)" bit.
•
Bit 7 indicates whether the packet has experienced congestion along the transmission path, and is called the "Congestion Experienced (CE)" bit.
For more information about the DS field, see " Appendixes ."
In actual applications, the packets with ECT set to 1 and CE set to 0 and the packets with ECT set to
0 and CE set to 1 are considered as packets that an ECN-capable endpoint transmits.
After you enable ECN on a device, congestion management processes packets as follows:
•
When the average queue size is below the lower limit, no packet is dropped, and the ECN fields of packets are not identified or marked.
•
When the average queue size exceeds the lower limit and is below the upper limit, before the device drops a packet which should be dropped according to the drop probability, the device examines the ECN field of the packet.
If the ECN field shows that the packet is sent out of ECN-capable terminal, the device sets both the ECT bit and the CE bit to 1 and forwards the packet.
If the ECN field shows that the packet has experienced congestion along the transmission path (both the ECT bit and the CE bit are 1), the device forwards the packet without modifying the ECN field.
If both the ECT bit and the CE bit are 0s, the device drops the packet.
•
When the average queue size exceeds the upper limit, the device drops the packet, regardless of whether the packet is sent out from an ECN-capable terminal.
ECN is enabled on a per-queue basis. You can configure the switch to identify and mark the ECN fields of packets for a specific queue.
Configuring and applying a WRED table
You can apply WRED tables to both Layer 2 and Layer 3 Ethernet interfaces. The term "interface" in this section collectively refers to these two types of interfaces. You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3 interface (see Layer 2—LAN
Switching Configuration Guide ).
The switch supports the queue-based WRED table. You can configure separate drop parameters for different queues. When congestion occurs, packets of a queue are randomly dropped based on drop parameters of the queue.
Determine the following parameters before configuring WRED:
•
Upper limit and lower limit —When the average queue size is smaller than the lower limit, packets are not dropped. When the average queue size is between the lower limit and the upper limit, the packets are dropped based on the user-configured drop probability. When the average queue size exceeds the upper limit, subsequent packets are dropped.
•
Drop precedence —A parameter used for packet drop. The value 0 corresponds to green packets, the value 1 corresponds to yellow packets, and the value 2 corresponds to red packets. Red packets are dropped preferentially.
•
Exponent for average queue size calculation —The greater the exponent, the less sensitive the average queue size is to real-time queue size changes. The formula for calculating the
54
average queue size is average queue size = (previous average queue size x (1 – 2
–n
(current queue size x 2 ), where n is the exponent.
–n
)) +
•
Drop probability in percentage —The larger the value is, the greater the drop probability is.
Configuration procedure
A WRED table can be applied to multiple interfaces. For a WRED table already applied to an interface, you can modify the values of the WRED table, but you cannot remove the WRED table.
To configure and apply a WRED table:
Step
1. Enter system view.
Command Remarks system-view
2. Create a WRED table and enter its view.
qos wred queue table table-name
3. (Optional.) Set the WRED exponent for average queue-id weighting-constant queue size calculation.
exponent
N/A
N/A
The default setting is 9.
4. (Optional.) Configure drop parameters.
queue queue-id [ drop-level drop-level ] low-limit low-limit high-limit high-limit
[ discard-probability discard-prob ]
By default, the low limit is 100, the high limit is 1000, and the drop probability is 10%.
5. (Optional.) Enable ECN for a queue. queue queue-id ecn
By default, ECN is not enabled on any queue.
6. Enter interface view. interface interface-number interface-type
N/A
7. Apply the WRED table to the interface.
qos wred apply [ table-name ]
By default, no WRED table is applied to an interface, and tail drop is used on an interface.
Configuration example
Network requirements
Apply a WRED table to interface GigabitEthernet 1/0/2, so that the packets are dropped as follows when congestion occurs:
•
For the interface to preferentially forward higher-priority traffic, set a lower drop probability for a queue with a greater queue ID. Set different drop parameters for queue 0, queue 3, and queue
7.
•
Drop packets according to their colors.
In queue 0, set the drop probability to 25%, 50%, and 75% for green, yellow, and red packets, respectively.
In queue 3, set the drop probability to 5%, 10%, and 25% for green, yellow, and red packets, respectively.
In queue 7, set the drop probability to 1%, 5%, and 10% for green, yellow, and red packets, respectively.
•
Enable ECN for queue 7.
Configuration procedure
# Configure a queue-based WRED table, and set different drop parameters for packets with different drop levels in different queues.
55
<Sysname> system-view
[Sysname] qos wred queue table queue-table1
[Sysname-wred-table-queue-table1] queue 0 drop-level 0 low-limit 128 high-limit 512 discard-probability 25
[Sysname-wred-table-queue-table1] queue 0 drop-level 1 low-limit 128 high-limit 512 discard-probability 50
[Sysname-wred-table-queue-table1] queue 0 drop-level 2 low-limit 128 high-limit 512 discard-probability 75
[Sysname-wred-table-queue-table1] queue 3 drop-level 0 low-limit 256 high-limit 640 discard-probability 5
[Sysname-wred-table-queue-table1] queue 3 drop-level 1 low-limit 256 high-limit 640 discard-probability 10
[Sysname-wred-table-queue-table1] queue 3 drop-level 2 low-limit 256 high-limit 640 discard-probability 25
[Sysname-wred-table-queue-table1] queue 7 drop-level 0 low-limit 512 high-limit 1024 discard-probability 1
[Sysname-wred-table-queue-table1] queue 7 drop-level 1 low-limit 512 high-limit 1024 discard-probability 5
[Sysname-wred-table-queue-table1] queue 7 drop-level 2 low-limit 512 high-limit 1024 discard-probability 10
[Sysname-wred-table-queue-table1] queue 7 ecn
[Sysname-wred-table-queue-table1] quit
# Apply the queue-based WRED table to GigabitEthernet 1/0/2.
[Sysname] interface GigabitEthernet 1/0/2
[Sysname-GigabitEthernet1/0/2] qos wred apply queue-table1
Displaying and maintaining WRED
Execute display commands in any view.
Task
Display WRED configuration and statistics for interfaces.
Command display qos wred interface [ interface-type interface-number ]
Display the configuration of WRED tables. display qos wred table [ name table-name ] [ slot slot-number ]
56
Configuring traffic filtering
You can filter in or filter out traffic of a class by associating the class with a traffic filtering action. For example, you can filter packets sourced from an IP address according to network status.
Configuration procedure
To configure traffic filtering:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create a traffic class and enter traffic class view. traffic classifier
[ operator { and | or } ] classifier-name By default, no traffic class exists.
3. Configure match criteria. if-match match-criteria
By default, no match criterion is configured.
4. Return to system view. quit
5. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name
N/A
By default, no traffic behavior exists.
6. Configure the traffic filtering action. filter { deny | permit }
By default, no traffic filtering action is configured.
If a traffic behavior has the filter deny action, all the other actions except for class-based accounting in the traffic behavior do not take effect.
7. Return to system view.
8. Create a QoS policy and enter QoS policy view. quit qos policy policy-name
N/A
By default, no QoS policy exists.
9. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name [
before-classifier-name ] insert-before
By default, a traffic class is not associated with a traffic behavior.
10.
11.
Return to system view.
Apply the QoS policy. quit N/A
Applying the QoS policy to an interface
•
Applying the QoS policy to a VLAN
•
Applying the QoS policy globally
Applying the QoS policy to a control plane
Choose one of the application destinations as needed.
By default, no QoS policy is applied.
12. (Optional.) Display the traffic filtering configuration.
[ behavior-name ]
Available in any view.
57
Configuration example
Network requirements
As shown in Figure 17 , configure traffic filtering on GigabitEthernet 1/0/1 to deny the incoming
packets with port 21 as the source port.
Figure 17 Network diagram
Host
Switch
GE1/0/1
Configuration procedure
# Create advanced ACL 3000, and configure a rule to match packets whose source port number is
21.
<Switch> system-view
[Switch] acl number 3000
[Switch-acl-adv-3000] rule 0 permit tcp source-port eq 21
[Switch-acl-adv-3000] quit
# Create a traffic class named classifier_1 , and use ACL 3000 as the match criterion in the traffic class.
[Switch] traffic classifier classifier_1
[Switch-classifier-classifier_1] if-match acl 3000
[Switch-classifier-classifier_1] quit
# Create a traffic behavior named behavior_1 , and configure the traffic filtering action to drop packets.
[Switch] traffic behavior behavior_1
[Switch-behavior-behavior_1] filter deny
[Switch-behavior-behavior_1] quit
# Create a QoS policy named policy , and associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.
[Switch] qos policy policy
[Switch-qospolicy-policy] classifier classifier_1 behavior behavior_1
[Switch-qospolicy-policy] quit
# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] qos apply policy policy inbound
58
Configuring priority marking
Overview
Priority marking sets the priority fields or flag bits of packets to modify the priority of packets. For example, you can use priority marking to set IP precedence or DSCP for a traffic class of IP packets to control the forwarding of these packets.
To configure priority marking to set the priority fields or flag bits for a class of packets, perform the following tasks:
1. Configure a traffic behavior with a priority marking action.
2. Associate the traffic class with the traffic behavior.
Color-based priority marking
Packet coloring methods
The color of a packet indicates the device's evaluation for the packet transmission priority. The device can color a packet by using either of the following methods:
•
•
Traffic policing
Traffic policing is a common traffic control technology. Traffic policing uses the token bucket mechanism to evaluate the incoming or outgoing packets and colors the packets according to the evaluation result. By configuring different traffic control policies for packets in different colors, you can provide differentiated services for different traffic flows and use network resources efficiently.
The switch supports evaluating traffic by using two token buckets (bucket C and bucket E), and it colors a packet according to the number of tokens in the token buckets.
The switch supports coloring packets by using either of the following traffic policing functions: common CAR and aggregate CAR. For more information about coloring packets by using token
" and " Configuring aggregate CAR ."
Mapping drop precedence
Without traffic policing configured, a switch looks up the 802.1p priority of a packet in the
802.1p-to-drop priority mapping table, allocates the drop precedence value to the packet, and colors the packet according to the drop precedence value. Drop precedence value 0 denotes green packets, 1 denotes yellow packets, and 2 denotes red packets. For more information about priority
mapping tables, see " Configuring priority mapping ."
Configuring color-based priority marking
Configuring priority marking based on colors obtained through traffic policing
After traffic policing evaluates and colors packets, the switch can mark traffic with various priority values (including DSCP values, 802.1p priority values, and local precedence values) by color.
Configure priority marking by using either of the following methods:
59
•
Configuring the priority marking actions by color in the traffic policing action.
•
Configuring the priority marking actions by color in the behavior where the traffic policing action is configured.
You can use both methods to mark multiple priority values for packets in the same color. However, do not use the two methods to mark different values of the same priority type for packets. Otherwise, the
QoS policy configured with the behavior cannot be applied normally.
In a traffic behavior, an aggregate CAR action cannot be configured together with a priority marking action. Otherwise, the QoS policy configured with the behavior cannot be applied normally.
The switch implements both common CAR and aggregate CAR by using a QoS policy. For more
" and " Configuring aggregate CAR ."
Configuring priority marking based on colors obtained through mapping drop precedence
When packets are colored based on drop precedence values, you can create priority marking actions for packets in different colors in a traffic behavior and mark DSCP values, 802.1p priority values, and local precedence values for packets.
Configuration procedure
To configure priority marking:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator
{ and | or } ]
By default, no traffic class exists.
3. Configure match criteria. if-match match-criteria
By default, no match criterion is configured.
For more information about the if-match command, see ACL and
QoS Command
Reference .
4. Return to system view. quit N/A
5. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name
By default, no traffic behavior exists.
•
Set the DSCP value for packets: remark [ green | red | yellow ] dscp dscp-value
•
Set the 802.1p priority for packets or configure the inner-to-outer tag priority copying function: remark [ green | red | yellow ] dot1p
6. Configure a priority marking action. dot1p-value remark dot1p customer-dot1p-trust
•
Set the drop priority for packets: remark drop-precedence
drop-precedence-value
•
Set the IP precedence for packets: remark ip-precedence ip-precedence-value
•
Set the local precedence for packets: remark [ green | red | yellow ]
By default, no priority marking action is configured.
The switch supports local QoS IDs in the range of 1 to 3999.
The and remark local-precedence remark qos-local-id remark drop-precedence
,
, commands apply only to the incoming traffic.
The customer VLAN
(CVLAN) is the private network VLAN of the customer, and the
60
Step Command local-precedence
local-precedence-value
•
Set the local QoS ID for packets:
remark qos-local-id local-id-value
•
Set the CVLAN for packets: remark customer-vlan-id vlan-id
•
Set the SVLAN for packets: remark service-vlan-id vlan-id
Remarks service provider VLAN
(SVLAN) is the public network VLAN assigned by the service provider to the customer. For more information about the
CVLAN and SVLAN, see
Layer 2—LAN Switching
Configuration Guide .
7. Return to system view. quit N/A
8. Create a QoS policy and enter QoS policy view. qos policy policy-name
By default, no QoS policy exists.
9. Associate the traffic class with the traffic behavior in the QoS policy. classifier behavior-name classifier-name
[ behavior insert-before
before-classifier-name ]
By default, a traffic class is not associated with a traffic behavior.
10.
11.
Return to system view.
Apply the QoS policy. quit
•
Applying the QoS policy to an interface
•
Applying the QoS policy to a VLAN
•
Applying the QoS policy globally
Applying the QoS policy to a control plane
12. (Optional.) Display the priority marking user-defined configuration.
[ behavior-name ]
N/A
Choose one of the application destinations as needed.
By default, no QoS policy is applied.
Available in any view.
Priority marking configuration examples
Local precedence marking configuration example
Network requirements
As shown in Figure 18 , configure priority marking on the switch to meet the following requirements:
Traffic source
Host A, B
Host A, B
Host A, B
Destination
Data server
Mail server
File server
Processing priority
High
Medium
Low
61
Figure 18 Network diagram
Internet
Host A Data server
192.168.0.1/24
GE1/0/1 GE1/0/2 Mail server
192.168.0.2/24
Host B
Switch
File server
192.168.0.3/24
Configuration procedure
# Create advanced ACL 3000, and configure a rule to match packets with destination IP address
192.168.0.1.
<Switch> system-view
[Switch] acl number 3000
[Switch-acl-adv-3000] rule permit ip destination 192.168.0.1 0
[Switch-acl-adv-3000] quit
# Create advanced ACL 3001, and configure a rule to match packets with destination IP address
192.168.0.2.
[Switch] acl number 3001
[Switch-acl-adv-3001] rule permit ip destination 192.168.0.2 0
[Switch-acl-adv-3001] quit
# Create advanced ACL 3002, and configure a rule to match packets with destination IP address
192.168.0.3.
[Switch] acl number 3002
[Switch-acl-adv-3002] rule permit ip destination 192.168.0.3 0
[Switch-acl-adv-3002] quit
# Create a traffic class named classifier_dbserver , and use ACL 3000 as the match criterion in the traffic class.
[Switch] traffic classifier classifier_dbserver
[Switch-classifier-classifier_dbserver] if-match acl 3000
[Switch-classifier-classifier_dbserver] quit
# Create a traffic class named classifier_mserver , and use ACL 3001 as the match criterion in the traffic class.
[Switch] traffic classifier classifier_mserver
[Switch-classifier-classifier_mserver] if-match acl 3001
[Switch-classifier-classifier_mserver] quit
# Create a traffic class named classifier_fserver , and use ACL 3002 as the match criterion in the traffic class.
[Switch] traffic classifier classifier_fserver
[Switch-classifier-classifier_fserver] if-match acl 3002
[Switch-classifier-classifier_fserver] quit
# Create a traffic behavior named behavior_dbserver , and configure the action of setting the local precedence value to 4.
[Switch] traffic behavior behavior_dbserver
62
[Switch-behavior-behavior_dbserver] remark local-precedence 4
[Switch-behavior-behavior_dbserver] quit
# Create a traffic behavior named behavior_mserver , and configure the action of setting the local precedence value to 3.
[Switch] traffic behavior behavior_mserver
[Switch-behavior-behavior_mserver] remark local-precedence 3
[Switch-behavior-behavior_mserver] quit
# Create a traffic behavior named behavior_fserver , and configure the action of setting the local precedence value to 2.
[Switch] traffic behavior behavior_fserver
[Switch-behavior-behavior_fserver] remark local-precedence 2
[Switch-behavior-behavior_fserver] quit
# Create a QoS policy named policy_server , and associate traffic classes with traffic behaviors in the QoS policy.
[Switch] qos policy policy_server
[Switch-qospolicy-policy_server] classifier classifier_dbserver behavior behavior_dbserver
[Switch-qospolicy-policy_server] classifier classifier_mserver behavior behavior_mserver
[Switch-qospolicy-policy_server] classifier classifier_fserver behavior behavior_fserver
[Switch-qospolicy-policy_server] quit
# Apply QoS policy policy_server to the incoming traffic of GigabitEthernet 1/0/1.
[Switch] interface GigabitEthernet 1/0/1
[Switch-GigabitEthernet1/0/1] qos apply policy policy_server inbound
[Switch-GigabitEthernet1/0/1] quit
Local QoS ID marking configuration example
Local QoS ID marking allows you to mark the same local QoS ID for packets of multiple classes and configure a new class to match the local QoS ID to group these packets into the new class. With this feature, you can perform QoS actions for the old classes respectively and perform other QoS actions for the new class. In this way, you can perform layers of QoS actions for the specific packets.
Network requirements
of the Management department and the R&D department to 102400 kbps, respectively, and limit the outgoing traffic of the Marketing department (containing two sub-departments) to 204800 kbps.
63
Figure 19 Network diagram
IP network
GE1/0/1
Switch A
Management department
192.168.1.0/24
R&D department
192.168.2.0/24
Marketing department 1
192.168.3.0/24
Marketing department 2
192.168.4.0/24
Configuration considerations
•
Configure two classes to match the traffic from the Management department and the R&D department, respectively, and then configure traffic policing behaviors for the two classes.
•
Mark the same local QoS ID for the traffic from the two sub-departments of the Marketing department, configure a class to match packets with the local QoS ID, and then configure a traffic policing behavior for the class to limit the outgoing traffic of the two sub-departments.
Configuration procedure
1. Limit the upstream traffic of the Management department and R&D department:
# Configure IPv4 basic ACL 2001 to match the outgoing traffic of the Management department.
<SwitchA> system-view
[SwitchA] acl number 2001
[SwitchA-acl-basic-2001] rule permit source 192.168.1.0 0.0.0.255
[SwitchA-acl-basic-2001] quit
# Configure IPv4 basic ACL 2002 to match the outgoing traffic of the R&D department.
[SwitchA] acl number 2002
[SwitchA-acl-basic-2002] rule permit source 192.168.2.0 0.0.0.255
[SwitchA-acl-basic-2002] quit
# Create a class named admin , and use ACL 2001 as the match criterion.
[SwitchA] traffic classifier admin
[SwitchA-classifier-admin] if-match acl 2001
[SwitchA-classifier-admin] quit
# Create a class named rd , and use ACL 2002 as the match criterion.
[SwitchA] traffic classifier rd
[SwitchA-classifier-rd] if-match acl 2002
[SwitchA-classifier-rd] quit
64
# Create a traffic behavior named car_admin_rd , and configure traffic policing to limit the traffic rate to 102400 kbps.
[SwitchA] traffic behavior car_admin_rd
[SwitchA-behavior-car_admin_rd] car cir 102400
[SwitchA-behavior-car_admin_rd] quit
# Create a QoS policy named car , and associate classes admin and rd with behavior car_admin_rd .
[SwitchA] qos policy car
[SwitchA-qospolicy-car] classifier admin behavior car_admin_rd
[SwitchA-qospolicy-car] classifier rd behavior car_admin_rd
[SwitchA-qospolicy-car] quit
2. Limit the upstream traffic of the marketing department:
# Configure IPv4 basic ACL 2003 to match the outgoing traffic of the sub-department 1 of the marketing department.
[SwitchA] acl number 2003
[SwitchA-acl-basic-2003] rule permit source 192.168.3.0 0.0.0.255
[SwitchA-acl-basic-2003] quit
# Configure IPv4 basic ACL 2004 to match the outgoing traffic of the sub-department 2 of the
Marketing department.
[SwitchA] acl number 2004
[SwitchA-acl-basic-2004] rule permit source 192.168.4.0 0.0.0.255
[SwitchA-acl-basic-2004] quit
# Configure class marketing to match the outgoing traffic of the two sub-departments of the marketing department.
[SwitchA] traffic classifier marketing operator or
[SwitchA-classifier-marketing] if-match acl 2003
[SwitchA-classifier-marketing] if-match acl 2004
[SwitchA-classifier-marketing] quit
# Configure behavior remark_local_id to mark traffic with local QoS ID 100.
[SwitchA] traffic behavior remark_local_id
[SwitchA-behavior-remark_local_id] remark qos-local-id 100
[SwitchA-behavior-remark_local_id] quit
# Configure class marketing_car to match the outgoing traffic of the two sub-departments of the Marketing department.
[SwitchA] traffic classifier marketing_car
[SwitchA-classifier-marketing_car] if-match qos-local-id 100
[SwitchA-classifier-marketing_car] quit
# Create a behavior named marketing_car , and configure traffic policing to limit the traffic rate to 204800 kbps.
[SwitchA] traffic behavior marketing_car
[SwitchA-behavior-marketing_car] car cir 204800
[SwitchA-behavior-marketing_car] quit
# In QoS policy car , associate class marketing with behavior remark_local_id to mark the outgoing traffic of the Marketing department with local QoS ID 100.
[SwitchA] qos policy car
[SwitchA-qospolicy-car] classifier marketing behavior remark_local_id
# In QoS policy car , associate class marketing_car with behavior marketing_car to limit the traffic rate of traffic with local QoS ID 100.
[SwitchA-qospolicy-car] classifier marketing_car behavior marketing_car
65
[SwitchA-qospolicy-car] quit
# Apply QoS policy car to the incoming traffic of GigabitEthernet1/0/1.
[SwitchA] interface gigabitethernet 1/0/1
[SwitchA-GigabitEthernet1/0/1] qos apply policy car inbound
66
Configuring nesting
Nesting adds a VLAN tag to the matching packets to allow the VLAN-tagged packets to pass through the corresponding VLAN. For example, you can add an outer VLAN tag to packets from a customer network to a service provider network. This allows the packets to pass through the service provider network by carrying a VLAN tag assigned by the service provider.
Configuration procedure
To configure nesting:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator
{ and | or } ]
By default, no traffic class exists.
3. Configure match criteria. if-match match-criteria
By default, no match criterion is configured for a traffic class.
For more information about the match criteria, see the if-match command in ACL and
QoS Command
Reference .
N/A 4. Return to system view. quit
5. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name
By default, no traffic behavior exists.
6.
7.
Configure a VLAN tag adding action.
Return to system view.
nest top-most vlan vlan-id quit
8. Create a QoS policy and enter QoS policy view. qos policy policy-name
By default, no VLAN tag adding action is configured for a traffic behavior.
N/A
By default, no QoS policy exists.
9. Associate the traffic class with the traffic behavior in the QoS policy. classifier behavior-name classifier-name
[
before-classifier-name ] behavior insert-before
By default, no class-behavior association is configured for a QoS policy.
10. Return to system view. quit N/A
11. Apply the QoS policy.
•
•
•
Applying the QoS policy to an interface
Applying the QoS policy to a VLAN
Applying the QoS policy globally
Choose one of the application destinations as needed.
By default, a QoS policy is not applied.
67
Configuration example
Network requirements
As shown in Figure 20 , Site 1 and Site 2 in VPN A are two branches of a company, and they use
VLAN 5 to transmit traffic. Because Site 1 and Site 2 are located in different areas, the two sites use the VPN access service of a service provider. The service provider assigns VLAN 100 to the two sites.
Configure nesting, so that the two branches can communicate through the service provider network.
Figure 20 Network diagram
PE 1
GE1/0/1
Public network
GE1/0/2
VLAN 100 VLAN 5 Data
IP network
GE1/0/2
VLAN 100 VLAN 5 Data
PE 2
GE1/0/1
VLAN 5 Data VLAN 5 Data
CE 1
VLAN 5
VPN A
Site 1
VPN A
Site 2
CE 2
Configuration procedure
Configuring PE 1
# Create a class named test to match packets with VLAN ID 5.
<PE1> system-view
[PE1] traffic classifier test
[PE1-classifier-test] if-match service-vlan-id 5
[PE1-classifier-test] quit
# Configure an action to add outer VLAN tag 100 in traffic behavior test .
[PE1] traffic behavior test
[PE1-behavior-test] nest top-most vlan 100
[PE1-behavior-test] quit
# Create a QoS policy named test , and associate class test with behavior test in the QoS policy.
[PE1] qos policy test
[PE1-qospolicy-test] classifier test behavior test
[PE1-qospolicy-test] quit
# Configure the downlink port (GigabitEthernet 1/0/1) as a hybrid port, and assign the port to VLAN
100 as an untagged member.
[PE1] interface GigabitEthernet 1/0/1
[PE1-GigabitEthernet1/0/1] port link-type hybrid
[PE1-GigabitEthernet1/0/1] port hybrid vlan 100 untagged
68
# Apply QoS policy test to the incoming traffic of GigabitEthernet 1/0/1.
[PE1-GigabitEthernet1/0/1] qos apply policy test inbound
[PE1-GigabitEthernet1/0/1] quit
# Configure the uplink port (GigabitEthernet 1/0/2) as a trunk port, and assign it to VLAN 100.
[PE1] interface GigabitEthernet 1/0/2
[PE1-GigabitEthernet1/0/2] port link-type trunk
[PE1-GigabitEthernet1/0/2] port trunk permit vlan 100
[PE1-GigabitEthernet1/0/2] quit
Configuring PE 2
Configure PE 2 in the same way PE 1 is configured.
69
Configuring traffic redirecting
Traffic redirecting redirects packets matching the specified match criteria to a location for processing.
The following redirect actions are supported:
•
Redirecting traffic to the CPU —Redirects packets that require processing by the CPU to the
CPU.
•
Redirecting traffic to an interface —Redirects packets that require processing by an interface to the interface. This action applies only to Layer 2 packets, and the target interface must be a
Layer 2 interface.
Configuration procedure
To configure traffic redirecting:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create a traffic class and enter traffic class view. traffic classifier classifier-name [ operator
{ and | or } ]
By default, no traffic class exists.
3. Configure match criteria. if-match match-criteria
By default, no match criterion is configured for a traffic class.
For more information about the match criteria, see the if-match command in ACL and
QoS Command
Reference .
N/A 4. Return to system view. quit
5. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name
By default, no traffic behavior exists.
6. Configure a traffic { cpu | interface interface-type redirecting action. interface-number }
By default, no traffic redirecting action is configured for a traffic behavior.
The actions of redirecting traffic to the
CPU and redirecting traffic to an interface are mutually exclusive with each other in the same traffic behavior. The last redirecting action configured takes effect.
7. Return to system view. quit N/A
8. Create a QoS policy and enter QoS policy view. qos policy policy-name
By default, no QoS policy exists.
9. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior-name [
before-classifier-name ] behavior insert-before
By default, no class-behavior association is configured for a QoS policy.
70
Step
10. Return to system view.
11. Apply the QoS policy.
Command quit
•
Applying the QoS policy to an interface
•
Applying the QoS policy to a VLAN
•
Applying the QoS policy globally
Applying the QoS policy to a control plane
Remarks
N/A
Choose one of the application destinations as needed.
By default, a QoS policy is not applied.
12. (Optional.) Display traffic redirecting configuration. display traffic behavior user-defined
[ behavior-name ]
Available in any view.
Configuration example
Network requirements
•
Switch A is connected to Switch B through two links. Switch A and Switch B are each connected to other devices.
•
GigabitEthernet 1/0/2 of Switch A and GigabitEthernet 1/0/2 of Switch B belong to VLAN 200.
•
GigabitEthernet 1/0/3 of Switch A and GigabitEthernet 1/0/3 of Switch B belong to VLAN 201.
•
On Switch A, the IP address of VLAN-interface 200 is 200.1.1.1/24, and that of VLAN-interface
201 is 201.1.1.1/24.
•
On Switch B, the IP address of VLAN-interface 200 is 200.1.1.2/24, and that of VLAN-interface
201 is 201.1.1.2/24.
Configure the actions of redirecting traffic to an interface to meet the following requirements:
•
Packets with source IP address 2.1.1.1 received on GigabitEthernet 1/0/1 of Switch A are forwarded to GigabitEthernet 1/0/2.
•
Packets with source IP address 2.1.1.2 received on GigabitEthernet 1/0/1 of Switch A are forwarded to GigabitEthernet 1/0/3.
•
Other packets received on GigabitEthernet 1/0/1 of Switch A are forwarded according to the routing table.
Figure 21 Network diagram
GE1/0/2
VLAN 200
Vlan-int200
200.1.1.1/24
GE1/0/2
VLAN 200
Vlan-int200
200.1.1.2/24
GE1/0/1 FGE1/0/1
Switch A
GE1/0/3
VLAN 201
Vlan-int201
201.1.1.1/24
GE1/0/3
VLAN 201
Vlan-int201
201.1.1.2/24
Switch B
Configuration procedure
# Create basic ACL 2000, and configure a rule to match packets with source IP address 2.1.1.1.
<SwitchA> system-view
[SwitchA] acl number 2000
[SwitchA-acl-basic-2000] rule permit source 2.1.1.1 0
[SwitchA-acl-basic-2000] quit
71
# Create basic ACL 2001, and configure a rule to match packets with source IP address 2.1.1.2.
[SwitchA] acl number 2001
[SwitchA-acl-basic-2001] rule permit source 2.1.1.2 0
[SwitchA-acl-basic-2001] quit
# Create a traffic class named classifier_1 , and use ACL 2000 as the match criterion in the traffic class.
[SwitchA] traffic classifier classifier_1
[SwitchA-classifier-classifier_1] if-match acl 2000
[SwitchA-classifier-classifier_1] quit
# Create a traffic class named classifier_2 , and use ACL 2001 as the match criterion in the traffic class.
[SwitchA] traffic classifier classifier_2
[SwitchA-classifier-classifier_2] if-match acl 2001
[SwitchA-classifier-classifier_2] quit
# Create a traffic behavior named behavior_1 , and configure the action of redirecting traffic to
GigabitEthernet 1/0/2.
[SwitchA] traffic behavior behavior_1
[SwitchA-behavior-behavior_1] redirect interface gigabitethernet 1/0/2
[SwitchA-behavior-behavior_1] quit
# Create a traffic behavior named behavior_2 , and configure the action of redirecting traffic to
GigabitEthernet 1/0/3.
[SwitchA] traffic behavior behavior_2
[SwitchA-behavior-behavior_2] redirect interface gigabitethernet 1/0/3
[SwitchA-behavior-behavior_2] quit
# Create a QoS policy named policy , associate traffic class classifier_1 with traffic behavior behavior_1 , and associate traffic class classifier_2 with traffic behavior behavior_2 in the QoS policy.
[SwitchA] qos policy policy
[SwitchA-qospolicy-policy] classifier classifier_1 behavior behavior_1
[SwitchA-qospolicy-policy] classifier classifier_2 behavior behavior_2
[SwitchA-qospolicy-policy] quit
# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.
[SwitchA] interface gigabitethernet 1/0/1
[SwitchA-GigabitEthernet1/0/1] qos apply policy policy inbound
72
Configuring global CAR
Overview
Global committed access rate (CAR) is an approach to policing traffic flows globally. It adds flexibility to common CAR where traffic policing is performed only on a per-traffic class or per-interface basis.
In this approach, CAR actions are created in system view and each can be used to police multiple traffic flows as a whole.
Global CAR provides the following CAR actions: aggregate CAR and hierarchical CAR.
Aggregate CAR
An aggregate CAR action is created globally. It can be directly applied to interfaces or used in the traffic behaviors associated with different traffic classes to police multiple traffic flows as a whole.
The total rate of the traffic flows must conform to the traffic policing specifications set in the aggregate CAR action.
Hierarchical CAR
A hierarchical CAR action is created globally. It must be used in conjunction with a common CAR or aggregate CAR action. With a hierarchical CAR action, you can limit the total traffic of multiple traffic classes.
A hierarchical CAR action can be used in the common or aggregate CAR action for a traffic class in either AND mode or OR mode.
•
In AND mode, the rate of the traffic class is strictly limited under the common or aggregate CAR.
This mode applies to flows that must be strictly rate limited.
•
In OR mode, the traffic class can use idle bandwidth of other traffic classes associated with the hierarchical CAR. This mode applies to high priority, bursty traffic like video.
By using the two modes appropriately, you can improve bandwidth efficiency.
For example, suppose two flows exist: a low priority data flow and a high priority, bursty video flow.
Their total traffic rate cannot exceed 4096 kbps and the video flow must be assured of at least 2048 kbps bandwidth. You can perform the following tasks:
•
Configure common CAR actions to set the traffic rate to 2048 kbps for the two flows.
•
Configure a hierarchical CAR action to limit their total traffic rate to 4096 kbps.
•
Use the action in AND mode in the common CAR action for the data flow, and in OR mode in the common CAR action for the video flow.
The video flow is assured of 2048 kbps bandwidth and can use idle bandwidth of the data flow.
In a bandwidth oversubscription scenario, the uplink port bandwidth is lower than the total downlink port traffic rate. You can use hierarchical CAR to meet the following requirements:
•
Limit the total rate of the downlink port traffic.
•
Allow each downlink port to forward traffic at the maximum rate when the other ports are idle.
For example, you can perform the following tasks:
•
Use common CAR actions to limit the rates of both Internet access flow 1 and flow 2 to 128 kbps.
•
Use a hierarchical CAR action to limit their total traffic rate to 192 kbps.
•
Use the hierarchical CAR action for both flow 1 and flow 2 in AND mode.
73
When flow 1 is not present, flow 2 is transmitted at the maximum rate, 128 kbps. When both flows are present, the traffic rate of flow 2 might drop below this rate, because the total rate of the two flows cannot exceed 192 kbps.
Configuring aggregate CAR
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Configure an aggregate
CAR action. qos car car-name aggregative cir
committed-information-rate
committed-burst-size [
[ cbs ebs excess-burst-size ] ] [ green action | red action | yellow action ] *
Use either of the commands.
qos car car-name aggregative cir
By default, no aggregate
committed-information-rate [ cbs
CAR action is configured. committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] [ green action | red action | yellow action ] *
3. Enter traffic behavior view. traffic behavior behavior-name N/A
4. Use the aggregate CAR in the traffic behavior.
car name agg-car-name N/A
Configuring hierarchical CAR
Step
1. Enter system view.
Command system-view
Remarks
N/A
qos car hierarchy-car-name hierarchy
cir committed-information-rate [ cbs
committed-burst-size [ ebs
2. Configure a hierarchical excess-burst-size ] ]
CAR action.
qos car hierarchy-car-name hierarchy
cir committed-information-rate [ cbs committed-burst-size ] pir
peak-information-rate excess-burst-size ]
[ ebs
Use either of the commands.
By default, no hierarchical
CAR action is configured.
3. Enter traffic behavior view. traffic behavior behavior-name
•
Aggregate CAR:
car name agg-car-name hierarchy-car hierarchy-car-name
[ mode { and | or } ]
4. Use the hierarchical CAR action in the traffic behavior to cooperate with an aggregate CAR action or
•
Common CAR:
car cir committed-information-rate
[ cbs committed-burst-size [ ebs excess-burst-size red action |
] ] [ green yellow action action
|
] * common CAR action.
[ hierarchy-car hierarchy-car-name [ mode { and | or } ] ]
car cir committed-information-rate
[ cbs committed-burst-size ] pir peak-information-rate [ ebs
N/A
Use any of the commands.
By default, no hierarchical
CAR action is used in a traffic behavior.
For more information about common CAR actions, see
" Configuring traffic policing,
74
Step Command excess-burst-size ] [ green action | red action | yellow action ] *
[ hierarchy-car hierarchy-car-name [ mode { and | or } ] ]
Remarks
Displaying and maintaining global CAR
Execute display commands in any view and reset commands in user view.
Task
Display statistics for global CAR actions.
Clear statistics for global CAR actions.
Command display qos car name [ car-name ] reset qos car name [ car-name ]
Aggregate CAR configuration example
Network requirements
As shown in Figure 22 , configure an aggregate CAR to rate-limit the traffic of VLAN 10 and VLAN
100 received on GigabitEthernet 1/0/1 by using these parameters: CIR is 2560 kbps, CBS is 20480 bytes, and the action for red packets is discard .
Figure 22 Network diagram
Internet
GE1/0/1
Switch
VLAN 10 VLAN 100
Configuration procedure
# Configure an aggregate CAR action named aggcar-1 according to the rate limit requirements.
<Switch> system-view
[Switch] qos car aggcar-1 aggregative cir 2560 cbs 20480 red discard
75
# Create class 1 to match traffic of VLAN 10. Create behavior 1 and use aggregate CAR action aggcar-1 in the behavior.
[Switch] traffic classifier 1
[Switch-classifier-1] if-match customer-vlan-id 10
[Switch-classifier-1] quit
[Switch] traffic behavior 1
[Switch-behavior-1] car name aggcar-1
[Switch-behavior-1] quit
# Create class 2 to match traffic of VLAN 100. Create behavior 2 and use aggregate CAR action aggcar-1 in the behavior.
[Switch] traffic classifier 2
[Switch-classifier-2] if-match customer-vlan-id 100
[Switch-classifier-2] quit
[Switch] traffic behavior 2
[Switch-behavior-2] car name aggcar-1
[Switch-behavior-2] quit
# Create a QoS policy named car , associate class 1 with behavior 1, and associate class 2 with behavior 2.
[Switch] qos policy car
[Switch-qospolicy-car] classifier 1 behavior 1
[Switch-qospolicy-car] classifier 2 behavior 2
[Switch-qospolicy-car] quit
# Apply QoS policy car to the incoming traffic of GigabitEthernet 1/0/1.
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1]qos apply policy car inbound
Hierarchical CAR configuration examples
AND-mode hierarchical CAR configuration example
Network requirements
•
Configure rate limiting for HTTP traffic received on GigabitEthernet 1/0/1 and GigabitEthernet
1/0/2 to limit the rate of HTTP traffic received on each port to 240 kbps.
•
Configure hierarchical CAR to limit the rate of HTTP traffic received on the two ports to 320 kbps and drop the exceeding packets.
76
Figure 23 Network diagram
Internet
GE1/0/1
Switch
GE1/0/2
Configuration procedure
# Configure a hierarchical CAR action named http according to the rate limit requirements.
<Switch> system-view
[Switch] qos car http hierarchy cir 320
# Configure ACL 3000 to match HTTP packets.
[Switch] acl number 3000
[Switch-acl-adv-3000] rule permit tcp destination-port eq 80
[Switch-acl-adv-3000] quit
# Create traffic class 1, and use ACL 3000 as the match criterion in the traffic class.
[Switch] traffic classifier 1
[Switch-classifier-1] if-match acl 3000
[Switch-classifier-1] quit
# Configure a common CAR action in traffic behavior 1, and use hierarchical CAR action http , with the collaborating mode being AND.
[Switch] traffic behavior 1
[Switch-behavior-1] car cir 240 hierarchy-car http mode and
[Switch-behavior-1] quit
# Create a QoS policy named http , and associate traffic class 1 with traffic behavior 1 in the QoS policy.
[Switch] qos policy http
[Switch-qospolicy-http] classifier 1 behavior 1
[Switch-qospolicy-http] quit
# Apply QoS policy http to the incoming traffic of GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2.
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] qos apply policy http inbound
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] qos apply policy http inbound
77
OR-mode hierarchical CAR configuration example
Network requirements
192.168.0.2 and 192.168.0.3. Set the CIR to 240 kbps for each of the video streams according to their regular average rates. To guarantee that occasional large bursts can pass through, configure hierarchical CAR to limit total rate of the two video streams to 640 kbps, and drop the exceeding traffic.
Figure 24 Network diagram
Switch
GE1/0/1
192.168.0.2
192.168.0.3
Configuration procedure
# Configure a hierarchical CAR action named video according to the rate limit requirements.
<Switch> system-view
[Switch] qos car video hierarchy cir 640
# Create traffic class 1, and use ACL 2000 as the match criterion in the traffic class to match packets sourced from 192.168.0.2.
[Switch] acl number 2000
[Switch-acl-basic-2000] rule permit source 192.168.0.2 0.0.0.0
[Switch-acl-basic-2000] quit
# Create traffic behavior 1, configure a common CAR action, and use hierarchical CAR action video , with the collaborating mode being OR.
[Switch] traffic classifier 1
[Switch-classifier-1] if-match acl 2000
[Switch-classifier-1] quit
[Switch] traffic behavior 1
[Switch-behavior-1] car cir 240 hierarchy-car video mode or
[Switch-behavior-1] quit
# Create traffic class 2, and use ACL 2001 as the match criterion in the traffic class to match packets sourced from 192.168.0.3.
[Switch] acl number 2001
[Switch-acl-basic-2001] rule permit source 192.168.0.3 0.0.0.0
[Switch-acl-basic-2001] quit
78
# Create traffic behavior 2, configure a common CAR action, and use hierarchical CAR action video , with the collaborating mode being OR.
[Switch] traffic classifier 2
[Switch-classifier-2] if-match acl 2001
[Switch-classifier-2] quit
[Switch] traffic behavior 2
[Switch-behavior-2] car cir 240 hierarchy-car video mode or
[Switch-behavior-2] quit
# Create a QoS policy named video , and associate traffic classes 1 and 2 with traffic behaviors 1 and
2 in the QoS policy, respectively.
[Switch] qos policy video
[Switch-qospolicy-video] classifier 1 behavior 1
[Switch-qospolicy-video] classifier 2 behavior 2
[Switch-qospolicy-video] quit
# Apply QoS policy video to the incoming traffic of GigabitEthernet 1/0/1.
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] qos apply policy video inbound
79
Configuring class-based accounting
Class-based accounting collects statistics (in packets or bytes) on a per-traffic class basis. For example, you can define the action to collect statistics for traffic sourced from a certain IP address.
By analyzing the statistics, you can determine whether anomalies have occurred and what action to take.
Configuration procedure
To configure class-based accounting:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create a traffic class and enter traffic class view. traffic classifier classifier-name
[ operator { and | or } ]
By default, no traffic class exists.
3. Configure match criteria. if-match match-criteria
By default, no match criterion is configured.
For more information about the if-match command, see
ACL and QoS Command
Reference .
N/A 4. Return to system view. quit
5. Create a traffic behavior and enter traffic behavior view.
traffic behavior behavior-name
By default, no traffic behavior exists.
6. Configure an accounting action. accounting { byte | packet }
By default, no traffic accounting action is configured.
A QoS policy that contains an accounting action cannot be applied globally.
7. Return to system view. quit N/A
8.
10. Return to system view.
11.
Create a QoS policy and enter QoS policy view.
Apply the QoS policy. qos policy policy-name
By default, no QoS policy exists.
9. Associate the traffic class with the traffic behavior in the QoS policy. classifier classifier-name behavior behavior-name [ insert-before
before-classifier-name ]
By default, a traffic class is not associated with a traffic behavior. quit N/A
Applying the QoS policy to an interface
•
Applying the QoS policy to a VLAN
Applying the QoS policy to a control plane
Applying the QoS policy to a user profile
Choose one of the application destinations as needed.
By default, no QoS policy is applied.
80
Step Command Remarks
12. Display traffic accounting configuration.
• display qos policy control-plane
slot slot-number
• display qos policy interface
[ interface-type interface-number ]
[ inbound | outbound ]
• display qos vlan-policy { name policy-name | vlan [ vlan-id ] } [ slot slot-number ] [ inbound | outbound ]
Available in any view.
Configuration example
Network requirements
As shown in Figure 25 , configure class-based accounting on GigabitEthernet 1/0/1 to collect
statistics for the incoming packets with 1.1.1.1/24 as the source IP address.
Figure 25 Network diagram
Switch
GE1/0/1
Configuration procedure
# Create basic ACL 2000, and configure a rule to match packets with source IP address 1.1.1.1.
<Switch> system-view
[Switch] acl number 2000
[Switch-acl-basic-2000] rule permit source 1.1.1.1 0
[Switch-acl-basic-2000] quit
# Create a traffic class named classifier_1 , and use ACL 2000 as the match criterion in the traffic class.
[Switch] traffic classifier classifier_1
[Switch-classifier-classifier_1] if-match acl 2000
[Switch-classifier-classifier_1] quit
# Create a traffic behavior named behavior_1 , and configure the class-based accounting action.
[Switch] traffic behavior behavior_1
[Switch-behavior-behavior_1] accounting packet
[Switch-behavior-behavior_1] quit
# Create a QoS policy named policy , and associate traffic class classifier_1 with traffic behavior behavior_1 in the QoS policy.
[Switch] qos policy policy
[Switch-qospolicy-policy] classifier classifier_1 behavior behavior_1
[Switch-qospolicy-policy] quit
# Apply QoS policy policy to the incoming traffic of GigabitEthernet 1/0/1.
[Switch] interface GigabitEthernet 1/0/1
81
[Switch-GigabitEthernet1/0/1] qos apply policy policy inbound
[Switch-GigabitEthernet1/0/1] quit
# Display traffic statistics to verify the configuration.
[Switch] display qos policy interface GigabitEthernet 1/0/1
Interface: GigabitEthernet1/0/1
Direction: Inbound
Policy: policy
Classifier: classifier_1
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: behavior_1
Accounting enable:
28529 (Packets)
82
Appendixes
Appendix A Default priority maps
For the default dot1p-exp , dscp-dscp , and exp-dot1p priority maps, an input value yields a target value equal to it.
Table 7 Default dot1p-lp and dot1p-dp priority maps
1
2
3
4
5
6
Input priority value dot1p
0 dot1p-lp map lp
2
0
1
3
4
5
6
7 7
Table 8 Default exp-dp priority map
4
5
6
2
3
Input priority value exp
0
1
0
0
0
0
0 dot1p-dp map dp
0
0
7 0
Table 9 Default dscp-dp and dscp-dot1p priority maps
Input priority value dscp
0 to 7
8 to 15
16 to 23
24 to 31
32 to 39
0
0
0
0 dscp-dp map dp
0
0
0
0
0
0
0
0 dot1p-dp map dp
0
1
2
3
4 dscp-dot1p map dot1p
0
83
Input priority value
40 to 47
48 to 55
56 to 63
0
0 dscp-dp map
0
6
7 dscp-dot1p map
5
Appendix B Introduction to packet precedences
IP precedence and DSCP values
3
4
1
2
5
6
Figure 26 ToS and DS fields
Bits:
IPv4 ToS
byte
0 1
Preced ence
2 3 4 5
Type of
Service
6 7
M
B
Z
RFC 1122
RFC 1349
Must
Be
Zero
Bits: 0 1 2 3 4 5 6 7
DS-Field
(for IPv4,ToS octet,and for
IPv6,Traffic
Class octet )
DSCP
Class Selector codepoints
CU
Currently
Unused
IP Type of Service (ToS)
RFC 791
Differentiated Services
Codepoint (DSCP)
RFC 2474
represent IP precedence from 0 to 7. According to RFC 2474, the ToS field is redefined as the differentiated services (DS) field, where a DSCP value is represented by the first six bits (0 to 5) and is in the range 0 to 63. The remaining two bits (6 and 7) are reserved.
Table 10 IP precedence
IP precedence (decimal)
0
7
Table 11 DSCP values
DSCP value (decimal)
46
10
12
14
IP precedence (binary)
000
001
010
011
100
101
110
111
DSCP value (binary)
101110
001010
001100
001110
Description
Routine priority immediate flash flash-override critical internet network
Description ef af11 af12 af13
84
DSCP value (decimal)
18
38
8
16
24
32
40
48
56
0
28
30
34
36
20
22
26
DSCP value (binary)
010010
100110
001000
010000
011000
100000
101000
110000
111000
000000
010100
010110
011010
011100
011110
100010
100100
Description af21 af22 af23 af31 af32 af33 af41 af42 af43 cs1 cs2 cs3 cs4 cs5 cs6 cs7 be (default)
802.1p priority
802.1p priority lies in the Layer 2 header. It applies to occasions where Layer 3 header analysis is not needed and QoS must be assured at Layer 2.
Figure 27 An Ethernet frame with an 802.1Q tag header
Destination
Address
Source
Address
802.1Q header
TPID TCI
Length
/Type
Data
FCS(CRC-
32)
6 bytes 6 bytes 4 bytes 2 bytes 46~1500 bytes 4 bytes
As shown in Figure 27 , the 4-byte 802.1Q tag header consists of the 2-byte tag protocol identifier
(TPID) and the 2-byte tag control information (TCI). The value of the TPID is 0x8100. Figure 28
shows the format of the 802.1Q tag header. The Priority field in the 802.1Q tag header is called the
"802.1p priority", because its use is defined in IEEE 802.1p. Table 12 shows the values for 802.1p
priority.
85
Figure 28 802.1Q tag header
Byte 1 Byte 2 Byte 3 Byte 4
TPID(Tag protocol identifier) TCI(Tag control information)
1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 Priority
C
F
I
VLAN ID
7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
Table 12 Description on 802.1p priority
5
6
7
1
2
3
4
802.1p priority (decimal)
0
802.1p priority (binary)
000
001
010
011
100
101
110
111
Description best-effort background spare excellent-effort controlled-load video voice network-management
EXP values
The EXP field is in MPLS labels for MPLS QoS purposes.
Figure 29 MPLS label structure
As shown in Figure 29 , the EXP field is 3-bit long and is in the range of 0 to 7.
86
Configuring time ranges
You can implement a service based on the time of the day by applying a time range to it. A time-based service takes effect only in time periods specified by the time range. For example, you can implement time-based ACL rules by applying a time range to them. If a time range does not exist, the service based on the time range does not take effect.
The following basic types of time ranges are available:
•
Periodic time range —Recurs periodically on a day or days of the week.
•
Absolute time range —Represents only a period of time and does not recur.
A time range is uniquely identified by the time range name. You can create a maximum of 1024 time ranges, each with a maximum of 32 periodic statements and 12 absolute statements. The active period of a time range is calculated as follows:
1. Combining all periodic statements.
2. Combining all absolute statements.
3. Taking the intersection of the two statement sets as the active period of the time range.
Configuration procedure
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Create or edit a time range. time-range time-range-name
{ start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] | from time1 date1 [ to time2 date2 ] | to time2 date2 }
No time range exists.
Displaying and maintaining time ranges
Execute the display command in any view.
Task
Display time range configuration and status.
Command display time-range { time-range-name | all }
Time range configuration example
Network requirements
As shown in Figure 30 , configure an ACL on Device A to allow Host A to access the server only
during 8:00 and 18:00 on working days from June 2011 to the end of the year.
87
Figure 30 Network diagram
Server
Host A
192.168.1.2/24
GE1/0/1
Device A
GE1/0/2
192.168.0.100/24
Host B
192.168.1.3/24
Configuration procedure
# Create a periodic time range during 8:00 and 18:00 on working days from June 2011 to the end of the year.
<DeviceA> system-view
[DeviceA] time-range work 8:0 to 18:0 working-day from 0:0 6/1/2011 to 24:0 12/31/2011
# Create an IPv4 basic ACL numbered 2001, and configure a rule in the ACL to permit packets only from 192.168.1.2/32 during the time range work .
[DeviceA] acl number 2001
[DeviceA-acl-basic-2001] rule permit source 192.168.1.2 0 time-range work
[DeviceA-acl-basic-2001] rule deny source any time-range work
[DeviceA-acl-basic-2001] quit
# Apply IPv4 basic ACL 2001 to filter outgoing packets on interface GigabitEthernet 1/0/2.
[DeviceA] interface GigabitEthernet 1/0/2
[DeviceA-GigabitEthernet1/0/2] packet-filter 2001 outbound
[DeviceA-GigabitEthernet1/0/2] quit
Verifying the configuration
# Display time range configuration and status on Device A.
[DeviceA] display time-range all
Current time is 13:58:35 6/20/2011 Monday
Time-range : work ( Active )
08:00 to 18:00 working-day
from 00:00 6/1/2011 to 00:00 1/1/2012
The output shows that the time range work is active.
88
Configuring data buffers
An interface stores outgoing packets in the egress buffer when congestion occurs.
An egress buffer uses the following types of resources:
•
Cell resources —Store packets. The buffer uses cell resources based on packet sizes.
Suppose a cell resource provides 208 bytes. The buffer allocates one cell resource to a
128-byte packet and two cell resources to a 300-byte packet.
•
Packet resources —Store packet pointers. A packet pointer indicates where the packet is located in cell resources. The buffer uses one packet resource for each incoming or outgoing packet.
Each type of resources has a fixed area and a shared area.
•
Fixed area —Partitioned into queues, each of which is equally divided by all the interfaces on a
device, as shown in Figure 31 . When congestion occurs, the following rules apply:
a. An interface first uses the relevant queues of the fixed area to store packets. b. When a queue is full, the interface uses the space for the queue in the shared area. c. When the queue in the shared area is also full, the interface discards subsequent packets.
The system allocates the fixed area among queues as specified by the user. Even if a queue is not full, other queues cannot preempt its space. Similarly, the share of a queue for an interface cannot be preempted by other interfaces even if it is not full.
•
Shared area —Partitioned into queues, each of which is not equally divided by the interfaces,
as shown in Figure 31 . The system determines the actual shared-area ratio for each queue
according to user configuration and the number of packets actually sent. If a queue is not full, other queues can preempt its space.
The system puts packets received on all interfaces into a queue in the order they arrive. When the queue is full, subsequent packets are dropped.
Figure 31 Fixed area and shared area
Shared area (configured by the buffer total-shared command)
Queue 0
Queue 1
Queue 2
Queue 3
Queue 4
Queue 5
Queue 6
Queue 7
Port 1 Port 2 Port 3 Port 4 …
Fixed area
Configuration task list
You can configure data buffers either automatically by enabling the Burst feature or manually.
If you have configured data buffers in one way, delete the configuration before using the other way.
Otherwise, the new configuration does not take effect.
To configure the data buffer, perform the following tasks:
89
Tasks at a glance
Perform one of the following tasks:
•
•
Configuring data buffers manually
Setting the total shared-area ratio
Setting the maximum shared-area ratio for a queue
Setting the fixed-area ratio for a queue
Applying data buffer configuration
Enabling the Burst feature
The Burst feature enables the device to automatically allocate cell and packet resources. It is well suited to the following scenarios:
•
Traffic enters a device from a high-speed interface and goes out of a low-speed interface.
•
Traffic enters a device from multiple same-rate interfaces at the same time and goes out of an interface with the same rate.
To enable the Burst feature:
Step
1. Enter system view.
2. Enable the Burst feature.
Command system-view burst-mode enable
Remarks
N/A
By default, the Burst feature is disabled.
The Burst feature takes effect only on known unicast packets.
Configuring data buffers manually
CAUTION:
To avoid impact on the forwarding function of the system, do not manually change data buffer settings. If large buffer spaces are needed, use the Burst feature.
The switch only supports configuring cell resources.
Setting the total shared-area ratio
Each type of resources of a buffer, packet or cell, has a fixed size. After you set the total shared-area ratio for a type of resources, the rest is automatically assigned to the fixed area.
To set the total shared-area ratio:
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Set the total shared-area ratio. buffer egress [ slot slot-number ] cell total-shared ratio ratio-value
By default, the total shared-area ratio is 97% of the buffer.
90
Setting the maximum shared-area ratio for a queue
By default, all queues have an equal share of the shared area. This task allows you to change the maximum shared-area ratio for a queue. The unconfigured queues use the default setting.
The actual maximum shared-area ratio for each queue is determined by the chip based on your configuration and the number of packets to be sent.
To set the maximum shared-area ratio for a queue:
Step
1. Enter system view.
Command system-view
2. Set the maximum shared-area ratio for a buffer egress [ slot slot-number ] cell queue.
queue queue-id shared ratio ratio-value
Remarks
N/A
The default setting is
33% for each queue.
For the maximum shared-area ratio for a queue, the percentage values 0 to 100 are divided into 10
ranges. Table 13 shows the effective values that correspond to the configured values of
ratio-value .
Table 13 Mapping between values of ratio-value and effective values
Value of ratio-value
0 to 1
2 to 3
4 to 7
8 to 16
17 to 29
30 to 42
43 to 60
61 to 76
77 to 86
87 to 100
Effective value
1
67
80
89
3
6
11
20
33
50
Setting the fixed-area ratio for a queue
By default, all queues have an equal share of the fixed area. This task allows you to change the fixed-area ratio for a queue. The unconfigured queues equally share the remaining part.
The fixed-area space for a queue cannot be used by other queues. It is also called the minimum guaranteed buffer.
When you set the fixed-area ratio for a queue, follow these restrictions and guidelines:
•
The sum of ratios configured for all queues cannot be greater than or equal to 100%. Queues 5,
6, and 7 must have available fixed-area space.
•
After you set the fixed-area ratios for some queues, the other queues each are assigned an equal share of the remaining part of the fixed area. The display buffer queue command displays the preceding whole number for each assignment result. Therefore, the sum of the ratios for all queues might be less than 100%.
To set the fixed-area ratio for a queue:
91
Step
1. Enter system view.
Command system-view
Remarks
N/A
2. Set the fixed-area ratio for a queue. buffer egress [ slot slot-number ]
cell queue queue-id guaranteed
ratio ratio-value
The default setting is 12.5% for each queue, but the default value in the display buffer queue command output is 12%.
Applying data buffer configuration
Perform this task to apply the data buffer configuration.
You cannot directly modify the applied configuration. To modify the configuration, you must cancel the application, reconfigure data buffers, and reapply the configuration.
To apply data buffer configuration:
Step
1. Enter system view.
2. Apply data buffer configuration.
Command system-view buffer apply
Displaying and maintaining data buffers
Execute display commands in any view.
Task
Display data buffer configuration.
Display data buffer usage.
Command display buffer [ slot slot-number ] [ queue
[ queue-id ] ] display buffer usage [ slot slot-number ]
92
Document conventions and icons
Conventions
This section describes the conventions used in the documentation.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.
Command conventions
Convention
Boldface
Italic
[ ]
{ x | y | ... }
[ x | y | ... ]
{ x | y | ... } *
[ x | y | ... ] *
&<1-n>
Description
Bold text represents commands and keywords that you enter literally as shown.
Italic text represents arguments that you replace with actual values.
Square brackets enclose syntax choices (keywords or arguments) that are optional.
Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.
Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none.
Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.
Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none.
The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.
A line that starts with a pound (#) sign is comments. #
GUI conventions
Convention
Boldface
Symbols
>
Description
Window names, button names, field names, and menu items are in Boldface. For example, the New User window opens; click OK .
Multi-level menus are separated by angle brackets. For example, File > Create >
Folder .
Convention
WARNING!
CAUTION:
IMPORTANT:
NOTE:
Description
An alert that calls attention to important information that if not understood or followed can result in personal injury.
An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software.
An alert that calls attention to essential information.
An alert that contains additional or supplementary information.
An alert that provides helpful information.
TIP:
93
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
94
Support and other resources
Accessing Hewlett Packard Enterprise Support
•
For live assistance, go to the Contact Hewlett Packard Enterprise Worldwide website: www.hpe.com/assistance
•
To access documentation and support services, go to the Hewlett Packard Enterprise Support
Center website: www.hpe.com/support/hpesc
Information to collect
•
Technical support registration number (if applicable)
•
Product name, model or version, and serial number
•
Operating system name and version
•
Firmware version
•
Error messages
•
Product-specific reports and logs
•
Add-on products or components
•
Third-party products or components
Accessing updates
•
Some software products provide a mechanism for accessing software updates through the product interface. Review your product documentation to identify the recommended software update method.
•
To download product updates, go to either of the following:
Hewlett Packard Enterprise Support Center Get connected with updates page: www.hpe.com/support/e-updates
Software Depot website: www.hpe.com/support/softwaredepot
•
To view and update your entitlements, and to link your contracts, Care Packs, and warranties with your profile, go to the Hewlett Packard Enterprise Support Center More Information on
Access to Support Materials page: www.hpe.com/support/AccessToSupportMaterials
IMPORTANT:
Access to some updates might require product entitlement when accessed through the Hewlett
Packard Enterprise Support Center. You must have an HP Passport set up with relevant entitlements.
95
Websites
Website
Networking websites
Link
Hewlett Packard Enterprise Information Library for
Networking www.hpe.com/networking/resourcefinder
Hewlett Packard Enterprise Networking website
Hewlett Packard Enterprise My Networking website
Hewlett Packard Enterprise My Networking Portal
Hewlett Packard Enterprise Networking Warranty www.hpe.com/info/networking www.hpe.com/networking/support www.hpe.com/networking/mynetworking www.hpe.com/networking/warranty
General websites
Hewlett Packard Enterprise Information Library
Hewlett Packard Enterprise Support Center
Hewlett Packard Enterprise Support Services Central
Contact Hewlett Packard Enterprise Worldwide
Subscription Service/Support Alerts
Software Depot
Customer Self Repair (not applicable to all devices)
Insight Remote Support (not applicable to all devices) www.hpe.com/info/enterprise/docs www.hpe.com/support/hpesc ssc.hpe.com/portal/site/ssc/ www.hpe.com/assistance www.hpe.com/support/e-updates www.hpe.com/support/selfrepair www.hpe.com/support/softwaredepot www.hpe.com/info/insightremotesupport/docs
Customer self repair
Hewlett Packard Enterprise customer self repair (CSR) programs allow you to repair your product. If a CSR part needs to be replaced, it will be shipped directly to you so that you can install it at your convenience. Some parts do not qualify for CSR. Your Hewlett Packard Enterprise authorized service provider will determine whether a repair can be accomplished by CSR.
For more information about CSR, contact your local service provider or go to the CSR website: www.hpe.com/support/selfrepair
Remote support
Remote support is available with supported devices as part of your warranty, Care Pack Service, or contractual support agreement. It provides intelligent event diagnosis, and automatic, secure submission of hardware event notifications to Hewlett Packard Enterprise, which will initiate a fast and accurate resolution based on your product’s service level. Hewlett Packard Enterprise strongly recommends that you register your device for remote support.
For more information and device support details, go to the following website: www.hpe.com/info/insightremotesupport/docs
Documentation feedback
Hewlett Packard Enterprise is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation
Feedback ( [email protected]
). When submitting your feedback, include the document title,
96
part number, edition, and publication date located on the front cover of the document. For online help content, include the product name, product version, help edition, and publication date located on the legal notices page.
97
Index
Numerics
802
QoS packet 802.1p priority, 85
802.1p
priority marking configuration, 59
802.1p priority
A
absolute time range (ACL), 87, 87
ACL
automatic rule numbering, 3 automatic rule renumbering, 3 basics configuration, 3
Ethernet frame header configuration, 7
IPv4 advanced configuration, 5
IPv6 advanced configuration, 6
packet filtering applicable scope (VLAN
interface), 9 packet filtering application (interface), 9
packet filtering configuration, 8
packet filtering default action, 10
packet filtering log interval, 9
QoS ACL-based configuration, 38
time range configuration, 87, 87 time range display, 87
advanced ACL
category, 1 naming, 1 numbering, 1
aggregate CAR
priority marking configuration, 59
Appendix A (Default priority maps), 83
Appendix B (Packet precedence), 84
application
applying
ACL packet filtering (interface), 9
QoS congestion avoidance queue-based WRED
QoS policy (control plane), 19
area
data buffer fixed area, 89, 89 data buffer shared area, 89, 89
QoS data buffer fixed-area max queue ratio, 91
QoS data buffer shared-area max queue ratio, 91
auto
QoS data buffer total shared-area ratio, 90
ACL automatic rule numbering, 3
B bandwidth
basic ACL
behavior
QoS traffic behavior definition, 17
best-effort QoS service model, 13
buffer data.
burst feature (data buffer), 90
C
CAR
aggregate CAR configuration, 74
global CAR configuration, 73 hierarchical CAR, 73
hierarchical CAR configuration, 74
98
hierarchical CAR configuration (AND-mode),
hierarchical CAR configuration (OR-mode), 78
QoS aggregate CAR configuration, 75
QoS hierarchical CAR configuration, 76
category
ACL config match order sort, 2
cell
data buffer configuration, 89, 89
changing
QoS priority mapping interface port priority, 28
classifying
QoS traffic class definition, 16
committed access rate.
common CAR
priority marking configuration, 59
configuring
ACL (Ethernet frame header), 7
ACL packet filtering applicable scope (VLAN
color-based priority marking, 59
priority marking based on colors obtained
through mapping drop precedence, 60
priority marking based on colors obtained
QoS congestion avoidance WRED, 55
QoS congestion management queue
QoS congestion management queue-based
QoS congestion management queuing, 45
QoS congestion management SP queuing, 45
QoS congestion management SP+WFQ queuing,
QoS congestion management SP+WRR queuing,
QoS congestion management WFQ queuing, 46
QoS congestion management WRR queuing, 45
QoS data buffer total shared-area ratio, 90
QoS hierarchical CAR (AND-mode), 76
QoS hierarchical CAR (OR-mode), 78
QoS priority mapping priority trust mode, 28
QoS priority mapping table+priority marking, 29
QoS priority mapping trusted port packet priority,
congestion avoidance
congestion management
SP+WFQ queuing configuration, 48
SP+WRR queuing configuration, 47
control plane
99
QoS policy application (control plane), 19
copying
D data buffer.
data buffer
configuration application, 92 display, 92
fixed-area max queue ratio, 91 shared-area max queue ratio, 91
default
ACL packet filtering default action, 10
defining
detecting
QoS congestion avoidance RED, 53
QoS congestion avoidance WRED, 53
device
ACL packet filtering applicable scope (VLAN
ACL packet filtering application (interface), 9
ACL packet filtering configuration, 8
ACL packet filtering default action, 10
ACL packet filtering log interval, 9
QoS congestion management configuration,
QoS policy application (control plane), 19
QoS policy application (global), 19
QoS policy application (user profile), 20
QoS policy application (VLAN), 19
QoS policy interface application, 18
DiffServ QoS service model, 13
displaying
QoS congestion avoidance WRED, 56
QoS congestion management queue
QoS congestion management queuing, 49
drop precedence
priority marking configuration, 60
drop priority (QoS priority mapping), 22
DSCP
QoS packet IP precedence and DSCP values, 84
E
ECN
enabling
Ethernet frame header
evaluating
QoS traffic with token bucket, 33, 33, 33
Explicit Congestion Notification.
F filtering
QoS traffic filtering configuration,
fixed area
data buffer configuration, 89, 89
QoS data buffer max queue ratio, 91
forwarding
ACL configuration (advanced), 5
ACL configuration (Ethernet frame header), 7
fragment
G
Generic Traffic Shaping.
global
QoS policy application (global), 19
global CAR
aggregate CAR configuration, 74
configuration, 73 hierarchical CAR, 73
hierarchical CAR configuration, 74
hierarchical CAR configuration (AND-mode), 76
hierarchical CAR configuration (OR-mode), 78
100
green packet
GTS
H hierarchical CAR
I
IP addressing
ACL configuration (advanced), 5
ACL configuration (Ethernet frame header), 7
QoS class-based accounting configuration,
IPv4
QoS traffic filtering configuration,
ACL configuration (IPv4 advanced), 5
ACL configuration (IPv4 basic), 4
IPv6
ACL packet filtering configuration, 8
ACL configuration (IPv6 advanced), 6
ACL configuration (IPv6 basic), 4
ACL packet filtering configuration, 8
L limiting
local
QoS priority mapping local precedence, 22
local precedence
priority marking configuration, 59
local precedence marking
logging
ACL packet filtering log interval, 9
M maintaining
match order
mode
QoS priority mapping priority trust, 28
modular QoS.
MPLS QoS
MQC
MQC QoS
N naming
nesting
network
ACL configuration (advanced), 5
ACL configuration (Ethernet frame header), 7
ACL packet filtering applicable scope (VLAN
ACL packet filtering application (interface), 9
ACL packet filtering configuration, 8
ACL packet filtering default action, 10
ACL packet filtering log interval, 9
ACL packet fragment filtering, 3
data buffer configuration application, 92
QoS aggregate CAR configuration,
QoS class-based accounting configuration,
QoS congestion avoidance configuration, 53
QoS congestion avoidance WRED queue-based
QoS congestion avoidance+ECN, 53
QoS congestion management configuration, 42
QoS congestion management queue scheduling
QoS congestion management queuing, 45
QoS congestion management SP queuing, 45
101
QoS congestion management SP+WFQ
QoS congestion management SP+WRR
QoS congestion management WFQ queuing,
QoS congestion management WRR queuing,
QoS data buffer fixed-area max queue ratio,
QoS data buffer shared-area max queue ratio,
QoS data buffer total shared-area ratio, 90
QoS hierarchical CAR configuration,
QoS hierarchical CAR configuration
QoS hierarchical CAR configuration
QoS priority mapping configuration,
QoS priority mapping drop priority, 22
QoS priority mapping interface port priority, 28
QoS priority mapping trusted port packet
QoS priority marking configuration, 59
QoS rate limit configuration, 33
QoS traffic behavior definition, 17
QoS traffic class definition, 16
QoS traffic filtering configuration,
QoS traffic policing configuration, 33
QoS traffic redirection configuration,
network management
data buffer configuration, 89, 89
local precedence marking configuration, 61
QoS global CAR configuration, 73
QoS priority mapping priority trust mode, 28
QoS priority mapping table+priority marking, 29
QoS priority marking configuration, 61
time range configuration, 87, 87
non-modular QoS.
non-MQC
notifying
QoS congestion avoidance+ECN, 53
numbering
ACL automatic rule numbering, 3
ACL automatic rule renumbering, 3
O
P packet
ACL filtering application (interface), 9
data buffer configuration, 89, 89
local precedence marking configuration, 61
QoS aggregate CAR configuration,
QoS class-based accounting configuration,
QoS congestion avoidance configuration, 53
QoS congestion avoidance+ECN, 53
QoS global CAR configuration, 73
QoS hierarchical CAR configuration,
QoS hierarchical CAR configuration (AND-mode),
QoS hierarchical CAR configuration (OR-mode),
QoS priority mapping configuration,
QoS priority mapping priority trust mode, 28
QoS priority mapping table+priority marking, 29
QoS priority marking configuration,
102
QoS traffic filtering configuration,
QoS traffic redirection configuration,
QoS trusted port packet priority, 27
packet coloring
drop precedence, 59 traffic policing, 59
packet filtering
ACL applicable scope (VLAN interface), 9
ACL configuration (advanced), 5
ACL configuration (Ethernet frame header), 7
ACL log generation+output interval, 9
ACL packet fragment filtering, 3
parameter
periodic time range (ACL), 87, 87
policy
QoS application (control plane), 19
QoS application (user profile), 20
port
QoS priority mapping interface port priority, 28
QoS trusted port packet priority, 27
precedence
QoS priority mapping configuration,
QoS priority mapping local precedence, 22
QoS priority mapping priority trust mode, 28
QoS priority mapping table+priority marking,
priority mapping.
marking.
QoS packet 802.1p priority, 85
QoS packet IP precedence and DSCP values,
priority mapping
mapping table+priority marking, 29
trusted port packet priority, 27
priority mapping table
priority marking
procedure
applying ACL packet filtering (interface), 9
applying data buffer configuration, 92
applying QoS congestion avoidance
applying QoS policy (control plane), 19 applying QoS policy (global), 19
applying QoS policy (user profile), 20
applying QoS policy (VLAN), 19
applying QoS policy to interface, 18
changing QoS priority mapping interface port
configuring ACL (Ethernet frame header), 7
configuring ACL (IPv4 advanced), 5
configuring ACL (IPv4 basic), 4
configuring ACL (IPv6 advanced), 6
configuring ACL (IPv6 basic), 4
configuring ACL packet filtering, 8
configuring ACL packet filtering applicable scope
configuring color-based priority marking, 59
configuring data buffers manually, 90
configuring local precedence marking, 61
configuring priority marking based on colors
obtained through mapping drop precedence, 60
configuring priority marking based on colors
obtained through traffic policing, 59
configuring QoS aggregate CAR,
configuring QoS class-based accounting,
configuring QoS congestion avoidance
configuring QoS congestion avoidance WRED,
configuring QoS congestion management, 45
103
configuring QoS congestion management
configuring QoS congestion management
configuring QoS congestion management SP
configuring QoS congestion management
configuring QoS congestion management
configuring QoS congestion management
configuring QoS congestion management
configuring QoS data buffer total shared-area
configuring QoS global CAR, 73
configuring QoS hierarchical CAR,
configuring QoS hierarchical CAR
configuring QoS hierarchical CAR
configuring QoS priority mapping, 26
configuring QoS priority mapping map, 27
configuring QoS priority mapping priority trust
configuring QoS priority mapping
configuring QoS priority mapping trusted port
configuring QoS priority marking,
configuring QoS rate limit, 38
configuring QoS traffic filtering,
configuring QoS traffic policing,
configuring QoS traffic redirection,
configuring time range, 87, 87
defining QoS traffic behavior, 17
defining QoS traffic class, 16
displaying QoS congestion avoidance WRED,
displaying QoS congestion management
displaying QoS congestion management
displaying QoS priority mapping, 28
displaying QoS rate limit, 39 displaying QoS traffic policing, 39
enabling data buffer burst feature, 90
maintaining QoS global CAR, 75
setting ACL packet filtering default action, 10
setting ACL packet filtering log generation+output
setting QoS data buffer fixed-area max queue
setting QoS data buffer shared-area max queue
profile
QoS policy application (user profile), 20
Q
QoS
Appendix A (Default priority maps), 83
Appendix B (Packet precedence), 84
class-based accounting configuration,
complicated traffic evaluation with token bucket,
congestion avoidance WRED configuration, 55
congestion avoidance WRED display, 56
congestion avoidance WRED queue-based table,
congestion management configuration,
congestion management queue scheduling
congestion management queuing, 45
congestion management SP queuing,
congestion management SP+WFQ queuing
congestion management SP+WRR queuing
congestion management WFQ queuing,
congestion management WRR queuing,
data buffer configuration, 89, 89
104
data buffer configuration (manual), 90
data buffer configuration application, 92 data buffer display, 92
data buffer fixed-area max queue ratio, 91 data buffer shared-area max queue ratio, 91
data buffer total shared-area ratio, 90
displaying congestion management queue
displaying congestion management queuing,
hierarchical CAR configuration,
hierarchical CAR configuration (AND-mode),
hierarchical CAR configuration (OR-mode), 78
local precedence marking configuration, 61
policy application (control plane), 19 policy application (global), 19
policy application (user profile), 20
policy interface application, 18
priority mapping configuration,
priority mapping drop priority, 22
priority mapping interface port priority, 28
priority mapping local precedence, 22 priority mapping map,
priority mapping priority trust mode, 28
priority mapping table+priority marking, 29
priority mapping trusted port packet priority, 27
priority mapping user priority, 22
priority marking configuration,
traffic behavior definition, 17
traffic evaluation, 33 traffic evaluation with token bucket, 33, 33
traffic filtering configuration,
traffic policing configuration, 33
traffic redirection configuration,
QoS policy
priority marking configuration, 59
Quality of Service.
queue-based
QoS queue-based GTS configuration, 38
queuing
data buffer configuration, 89, 89
QoS congestion avoidance RED, 53
QoS congestion avoidance WRED, 53
QoS congestion management scheduling profile,
QoS congestion management SP queuing,
QoS congestion management SP+WFQ queuing
QoS congestion management SP+WRR queuing
QoS congestion management WFQ queuing, 44,
QoS congestion management WRR queuing, 43,
QoS data buffer fixed-area max queue ratio, 91
QoS data buffer shared-area max queue ratio, 91
R random early detection.
Use RED rate limiting
105
QoS rate limiting configuration, 33
redirecting
routing
ACL configuration (advanced), 5
ACL configuration (Ethernet frame header), 7
QoS congestion management configuration,
QoS priority mapping configuration,
QoS priority mapping priority trust mode, 28
QoS priority mapping table+priority marking,
QoS rate limit configuration, 33
rule
QoS traffic policing configuration, 33
ACL automatic rule numbering, 3
ACL automatic rule renumbering, 3
ACL config match order sort, 2
S scheduling
QoS congestion management queue
security
ACL configuration (advanced), 5
ACL configuration (Ethernet frame header), 7
ACL configuration (IPv4 advanced), 5
ACL configuration (IPv4 basic), 4
ACL configuration (IPv6 advanced), 6
ACL configuration (IPv6 basic), 4
service
local precedence marking configuration, 61
QoS best-effort service model, 13
QoS congestion avoidance configuration, 53
QoS congestion management configuration,
QoS DiffServ service model, 13
QoS global CAR configuration, 73
QoS priority marking configuration,
QoS traffic filtering configuration,
setting
ACL packet filtering default action, 10
ACL packet filtering log interval, 9
QoS data buffer fixed-area max queue ratio, 91
QoS data buffer shared-area max queue ratio, 91
shared area
data buffer configuration, 89, 89
QoS data buffer max queue ratio, 91
QoS data buffer total ratio, 90
sorting
ACL config match order sort, 2
SP queuing
SP+WFQ queuing
SP+WRR queuing
statistics
QoS class-based accounting configuration,
switch
switching
QoS congestion management configuration, 42
T
TCP
QoS congestion avoidance RED, 53
QoS congestion avoidance tail drop, 53
time range
configuration, 87, 87 display, 87
token bucket
QoS complicated traffic evaluation, 33
QoS traffic evaluation, 33, 33
traffic
ACL configuration (advanced), 5
ACL configuration (Ethernet frame header), 7
local precedence marking configuration, 61
106
QoS aggregate CAR configuration,
QoS class-based accounting configuration,
QoS congestion avoidance configuration, 53
QoS congestion avoidance WRED
QoS congestion avoidance+ECN, 53
QoS congestion management, 42,
See also
QoS congestion management configuration,
QoS congestion management queue
QoS congestion management queuing, 45
QoS congestion management SP queuing, 45
QoS congestion management SP+WFQ
QoS congestion management SP+WRR
QoS congestion management WFQ queuing,
QoS congestion management WRR queuing,
QoS global CAR configuration, 73
QoS hierarchical CAR configuration,
QoS hierarchical CAR configuration
QoS hierarchical CAR configuration
QoS policy application (control plane), 19
QoS policy application (global), 19
QoS policy application (user profile), 20
QoS policy application (VLAN), 19
QoS policy interface application, 18
QoS priority mapping interface port priority, 28
QoS priority mapping priority trust mode, 28
QoS priority mapping process, 24
QoS priority mapping table+priority marking,
QoS priority mapping trusted port packet priority,
QoS priority marking configuration,
QoS rate limit configuration, 33
QoS traffic behavior definition, 17
QoS traffic class definition, 16
QoS traffic filtering configuration,
QoS traffic policing configuration, 33
QoS traffic redirection configuration,
traffic behavior
priority marking configuration, 59
traffic policing
drop precedence, 59 drop precedence mapping, 59 priority marking configuration, 59
trusted port packet priority (QoS), 27
U user
QoS policy application (user profile), 20
QoS priority mapping user priority, 22
user-defined ACL
V
VLAN
ACL packet filtering applicable scope (VLAN
QoS policy application (VLAN), 19
W weighted random early detection.
WFQ queuing
WRED
WRR queuing
107
Y yellow packet
108
다운로드
공개 링크 업데이트됨
문서 공개 링크
광고