Layer 3 QoS

Layer 3 QoS
CAR Workflow
Managing Access Lists

Creating Access Lists

Configuring an Access List

Managing CAR Policies

Creating a CAR Policy

Configuring a CAR Policy

Applying and Removing CAR Policies from an Interface

Viewing the CAR Policy Status

Deleting a CAR Policy

Layer 3 QoS

This chapter describes how to create and configure Layer 3 Quality of Service (QoS) Committed Access Rate (CAR) policies. CAR is a policing mechanism that allows you to partition your network into multiple priority levels or classes of service. You set the IP precedence for packets entering the network. Networking devices within your network can then use the adjusted IP precedence to determine how to treat the traffic. CAR services limit the input or output transmission rate on an interface or subinterface based on a flexible set of criteria.

CAR is often configured on interfaces at the edge of a network to limit traffic into or out of the network. CAR can rate-limit traffic based on certain matching criteria, such as incoming interface, IP precedence, or IP access list. You configure the actions CAR will take when traffic conforms to or exceeds the rate limit. Each interface can have multiple CAR policies, corresponding to different types of traffic. For example, low-priority traffic can be limited to a lower rate than high-priority traffic.

There are two types of CAR objects: CAR policies and access lists. When you create these objects in the Cisco 7000 Series Manager, you can work within the Layer 3 QoS view to create, apply, delete, or edit Layer 3 QoS objects. The CAR policies you create are placed under the CAR policies container in the Layer 3 QoS view. The access list you create are placed under the Access List container in the Layer 3 QoS view. Layer 3 QoS CAR objects (access lists and policies) can be applied to any physical interface.

This chapter contains the following information:

CAR Workflow

To begin working with CAR objects:

Step 1 Create and configure an access list (optional).

Step 2 Create and configure a CAR policy.

Step 3 Apply one or more access lists to the CAR policy.

Step 4 Apply the created CAR policy to one or more interfaces.

At any given time, you have the option to edit or delete CAR policies (which are not applied) or view the status of CAR policies on any interface.

Managing Access Lists

Access lists are supplemental to CAR policies and enhance their abilities. For example, access lists allow you to specify certain types of traffic, or certain locations where the traffic is coming from.

Managing access lists involves:

Creating Access Lists

When you create a new access list, an IP Standard list is created as a default. The next available index is automatically assigned by the system.

To create an access list, proceed as follows:

Step 1 Right-click on a relevant object and choose Cisco 7000 Series Manager > Configuration > Connection > Access List. For information on which objects allow you to launch the Access List Configuration window, see "EM Windows".

The Access List Configuration window displays.

Figure 10-1 Access List Configuration—General Tab

Step 2 Choose Create Access List.

The Prompt window displays, asking you to enter a name for the new access list you are creating.

Figure 10-2 Prompt Window

Step 3 In the text field provided, enter a unique name for the access list you are creating.

A confirmation window appears. The new access list is created and displays in the list box on the left side of the window.

Step 4 Choose File > Close to close the Access List Configuration window.

Configuring an Access List

Once you have created an access list, you can configure general attributes such as the index allocation mode, index value, access list type, and logging level. Depending upon the type of list you are creating, you can configure IP standard, IP Precedence, MAC, or IP Extended attributes as well. If the access list type is modified, the index can be manually or automatically reallocated to the next available index for the new type selected.

To configure an access list, proceed as follows:

The Access List Configuration window displays.

Figure 10-3 Access List Configuration—General Tab

Step 2 Configure the attributes on the General tab as follows:

Index Allocation Mode—Possible values are Manual or Automatic. When the access list type is changed, the index can be manually or automatically reallocated to the next available index for the new type selected.
Index—Refers to the unique identification number for an access list. The Index field is automatically generated if the Index Allocation Mode is set to Automatic. Other wise, you can manually enter a unique value in this field.
Type—Lists the type of access lists that can be created. Possible types include: IP Standard, IP Precedence, MAC, and IP Extended.
Logging Level—(Applicable only to IP standard and IP extended access lists.) If you enable the logging level, then informational messages about the packet that matched the criteria specified in the access list are generated.

Step 3 If you selected to create an IP Standard access list, configure those parameters as follows:

a. Select the IP Standard tab.

The IP Standard tab on the Access List Configuration window displays.

Figure 10-4 Access List Configuration Window (IP Standard Tab)

b. Configure the IP Standard parameters as follows:

Access Action—Action to be taken if the conditions are matched. Valid values are either Deny or Permit.
Host Type—Indicates the hosts for which the access actions are available. Possible values for this field include:

Any—All hosts
Host Name—Specified host name with wild card bits
A.B.C.D—Specified IP address with wild card bits
Host Hostname—Only the specified host name
Host A.B.C.D—Only the specified IP address

Note Values are grayed out in the IP Standard area depending upon the host type selected.

Host Name—Name of the host (or source of the packet) for which the access action is applicable.
IP Address—IP address of the host (or source of the packet) for which the access action is applicable.
Wild Card—If the access action is applicable for more than one host, then this field should be used as a mask. For example, the wild card 255.255.255.255 represents any host.

Step 4 If you selected to create an IP Precedence access list, configure those parameters as follows:

a. Select the IP Precedence tab.

The IP Precedence tab on the Access List Configuration window displays.

Figure 10-5 Access List Configuration Window (IP Precedence Tab)

b. Configure the IP Precedence parameters as follows:

Mask—Masking should be used for classification purposes if more than one precedence comes into the same classification. Enabling this option enables the Precedence Bit Mask field while disabling this option enables the Precedence field.
Precedence—Enter the IP precedence to be matched. Possible values are 0 to 7.
Precedence Bit Mask—If more than one precedence comes into the same classification, Precedence Bit Mask should be used. Possible values for this field are 00 to FF.

Step 5 If you selected to create a MAC access list, configure those parameters as follows:

a. Select the MAC tab.

The MAC tab on the Access List Configuration window displays.

Figure 10-6 Access List Configuration Window (MAC Tab)

b. Configure the MAC parameter(s) as follows:

MAC Address—Enter the MAC address for the packets to be classified.

Step 6 If you selected to create an IP Extended access list, configure those parameters as follows:

a. Select the IP Extended tab.

The IP Extended tab on the Access List Configuration window displays.

Figure 10-7 Access List Configuration Window (IP Extended Tab)

b. Configure the parameters in the IP Extended area as follows:

Access Action—Action to be taken if the conditions are matched. Possible actions are either Deny or Permit.
Protocol Name—Enter the name or number of an IP protocol. Valid protocol number values are 0 to 255. Valid protocol names are listed in the following table.

Table 10-1 Valid Protocol Names

Valid Protocol Names
ahp	ipinip
eigrp	nos
gre	ospf
icmp	pcp
igmp	pim
igrp	tcp
ip	udp
esp

c. Configure the parameters in the Dynamic List area as follows:

Dynamic—Defines the selected access list as dynamic. Dynamic access lists grant access to users, to a specific source or destination host, through a user authentication process. You can allow user access dynamically through a firewall, without compromising security restrictions.
Name—(Available only if the Dynamic button is selected.) Defines a name for the dynamic list.
Time Out—(Available only if the Dynamic button is selected.) Specifies the absolute length of time (in minutes) that a temporary access list entry can remain in a dynamic access list. The default (0) is an infinite length of time and allows an entry to remain permanently.

d. Configure the parameters in the Source and Destination areas as follows:

Host Type—Indicates the hosts for which the access action is available. Possible values for this field include:

Any—All hosts
A.B.C.D—Specified IP address with wild card bits
Host Hostname—Only the specified host name
Host A.B.C.D—Only the specified IP address

Host Name—Name of the host (or source of the packet) for which the access action is applicable.
IP Address—IP address of the host (or source of the packet) for which the access action is applicable.
Wild Card—If the access action is applicable for more than one host, then this field should be used as a mask. For example, the wild card 255.255.255.255 represents any host.
Port Criteria—Values to be applied on the specified port (interface) number. Possible values are:

None—Port number is insignificant
Equal To—Equal to the port number
Not Equal To—Not equal to the port number
Greater Than—Greater than the port number
Less Than—Less than the port number
Range—Port number range

Port Number—Port (interface) number from or to where the packet is sent.
Port Range—Port (interface) numbers that will be allowed through this filter.

Step 7 Click the Save icon on the toolbar to save your changes.

Step 8 Choose File > Close to close the Access List Configuration window.

Managing CAR Policies

CAR policies can rate-limit traffic based on certain matching criteria, such as incoming interface, IP precedence, or IP access list. You configure the actions CAR will take when traffic conforms to or exceeds the rate limit. You can set CAR policies that are associated with one of the following:

All IP traffic
IP precedence
MAC address
IP access list (both standard and extended)

Note Matching to IP access lists is more processor-intensive than matching based on other criteria.

Managing CAR policies involves:

Creating a CAR Policy

To create a CAR policy, proceed as follows:

Step 1 Right-click on a relevant object and choose Cisco 7000 Series Manager > Configuration > Connection > CAR Policy Configuration. For information on which objects allow you to launch the CAR Policy Configuration window, see "EM Windows".

The CAR Policy Configuration window displays.

Figure 10-8 CAR Policy Configuration Window

Step 2 Choose Create CAR Policy.

The Prompt window displays, asking you to enter a name for the new CAR policy you are creating.

Figure 10-9 Prompt Window

Step 3 In the text field provided, enter a unique name for the CAR policy you are creating.

Step 4 Choose OK.

A confirmation window appears. The new CAR policy is created and displays in the list box on the left side of the window.

Step 5 Choose File > Close to close the CAR Policy Configuration window.

Configuring a CAR Policy

Once you have created a CAR policy, you can configure policy attributes such as the traffic direction, average transmission rate, and burst size. As part of configuring a CAR policy, you can also apply one or more previously-created access lists to the CAR policy.

To configure a CAR policy, proceed as follows:

The CAR Policy Configuration window displays.

Figure 10-10 CAR Policy Configuration Window

Step 2 Select the policy you want to configure from the CAR Policy list on the lefthand side of the window.

Step 3 Configure the parameters in the CAR Parameters area as follows:

Traffic Direction—Choose either incoming (input) or outgoing (output) traffic.
Average Transmission Rate—Enter the normal transmission rate (in bps) based on a long-term average.
Normal Burst Size—Enter the number of bytes allowed in a burst before some packets will exceed the rate limit. Larger bursts are more likely to exceed the rate limit.
Maximum Burst Size—Enter the number of bytes allowed in a burst before all packets will exceed the rate limit.

Step 4 To apply access lists to a CAR policy:

a. From the With Access List menu, choose the Yes option.

The available access lists display in the list on the left side of the Access List Choice pane.

b. Select one or more of the desired lists, then select the right-facing arrow in the Actions area.

The selected list(s) are moved to the Required Access Lists list.

c. You can click the left-facing arrow in the Actions area to remove the selected access list(s) from the CAR policy.

Step 5 Configure the parameters in the Conform Action area as follows:

Continue—Evaluates the next rate-limit command.
Drop—Choose whether or not to drop the packet.
Transmit—Choose whether or not to transmit the packet.
Set Prec. To X and Continue—Set precedence to an integer and continue. Options are 0 to 7.
Set Prec. To X and Transmit—Set precedence to an integer and transmit. Options are 0 to 7.

Step 6 Configure the parameters in the Exceed Action area as follows:

Continue—Evaluates the next rate-limit command.
Drop—Choose whether or not to drop the packet.
Transmit—Choose whether or not to transmit the packet.
Set Prec. To Y and Continue—Set precedence to an integer and continue. Options are 0 to 7.
Set Prec. To Y and Transmit—Set precedence to an integer and transmit. Options are 0 to 7.

Step 7 Click the Save icon on the toolbar to save your changes.

Step 8 Choose File > Close to close the CAR Policy Configuration window.

Applying and Removing CAR Policies from an Interface

Once you have created and configured a CAR policy, you can apply that policy to one or more selected IP interfaces. In return, you can also remove a policy that has been previously applied to an interface.

To apply or remove a CAR policy from an interface, proceed as follows:

Step 1 Right-click on a relevant object and choose Cisco 7000 Series Manager > Configuration > Connection > CAR Policy Apply. For information on which objects allow you to launch the CAR Policy Apply window, see "EM Windows".

The CAR Policy Apply window displays.

Figure 10-11 CAR Policy Apply Window

Step 2 From the list boxes at the left of the window, choose a chassis, module, and IP interface to or from which you want to apply or remove the CAR policy.

Step 3 To apply a policy to an interface:

a. From the Available Policies list, select the policy you want to apply to an interface.

b. Select the Force Synchronization option if you want to force synchronization with the selected device upon application.

c. Click the right-facing arrow in the Actions area to assign the policy to the selected interface.

The policy moves to the Required Order list.

d. Choose Apply.

The policy is assigned to the interface. If the interface is being managed, the selected CAR policy is downloaded to the device.

Note If a CAR policy fails to be applied to an interface, the Apply Status area on the CAR Policy Apply window (see Figure 10-11) is updated accordingly.

Step 4 To remove a policy from an interface:

a. From the Required Order list, select the policy you want to remove from an interface.

b. Select the Force Synchronization option if you want to force synchronization with the selected device upon removal.

c. Click the left-facing arrow in the Actions area to remove the policy from the selected interface.

The policy moves to the Available Policies list.

d. Choose Apply.

The policy is removed from the interface.

Step 5 Choose File > Close to close the CAR Policy Apply window.

Viewing the CAR Policy Status

The CAR Policy Status window displays the CAR policies that are currently applied to a selected interface and the order in which they have been applied.

To view the CAR policy status, proceed as follows:

Step 1 Right-click on a relevant object and choose Cisco 7000 Series Manager > Configuration > Connection > CAR Policy Status. For information on which objects allow you to launch the CAR Policy Status window, see "EM Windows".

The CAR Policy Status window displays.

Figure 10-12 CAR Policy Status Window

Step 2 Choose the appropriate chassis, module, and IP interface from the list boxes at the left of the window.

The CAR policies that have been previously applied to the selected interface and the order in which they were applied displays in the Current CAR Policies list.

Step 3 Choose File > Close to close the CAR Policy Status window.

Deleting a CAR Policy

A CAR policy can be deleted only if it is not currently applied to an interface. Once you have applied a CAR policy to an interface, you cannot delete it unless you first remove it from the interface.

To delete an existing CAR policy:

Step 1 In the Layer 3 QoS View of the Map Viewer, choose the CAR policies you want to delete.

Step 2 Choose Deployment > Delete Objects.

The Deployment Wizard appears with a summary of the objects you have selected for deletion.

Figure 10-13 Deployment Wizard—Summary

:50677.bmp

Step 3 Click Finish.

The CAR policy is deleted.

If deletion fails, another interface might currently be using the CAR policy; therefore, you cannot delete the CAR policy until you have removed it from the interface.

Table of Contents

Layer 3 QoS

CAR Workflow

Managing Access Lists

Creating Access Lists

Configuring an Access List

Managing CAR Policies

Creating a CAR Policy

Configuring a CAR Policy

Applying and Removing CAR Policies from an Interface

Viewing the CAR Policy Status

Deleting a CAR Policy