congestion management

CCIE Security V4 Technology Labs Section 1:System Hardening and Availability

Congestion Management

Last updated: May 3, 2013

Task

Load the starting configuration files for task 1.17.

On R3, create a QoS policy to match ICMP traffic coming from vlan 23 and mark it with a dscp of

AF12.

On R3, also create a policy that matches ICMP traffic coming from the Test PC on vlan 11 and mark

it with a dscp of AF23.

ICMP traffic leaving the F0/0 interface should have the following policy applied.

AF12 Traffic should be given 25% of the interface bandwidth.

AF23 Traffic should be given 15% of the interface bandwidth.

If any voice traffic is seen with a DSCP of EF, it should be priority queued and given 35%

bandwidth.

Remaining Traffic should be fair-queued.

Explanation and Verification

Congestion management can take the form of policing or shaping data so that it conforms to the

policy set forth in the network. A CCIE candidate should be able to do this, as wel as configure

basic QoS policies . This task does not require any policing, but other tasks have. This task simply

tests your know-how of basic QoS configurations.

Start by configuring the policy on R3 to match ICMP traffic from vlan 23.

R3#conf t

Enter configuration commands, one per line. End with CNTL/Z.

R3(config)#access-list 101 permit icmp any any

R3(config)#class-map match-icmp

R3(config-cmap)#match access-g 101

R3(config-cmap)#policy-map mark-traffic

R3(config-pmap)#class match-icmp

R3(config-pmap-c)#set dscp af12

R3(config-pmap-c)#int f0/0.23

R3(config-subif)#service-policy input mark-traffic

R3(config-subif)#

Now configure the policy to mark traffic coming in vlan 11 from the test PC.

R3(config-subif)#exit

R3(config)#class-map match-test-pc

R3(config-cmap)#match access-group 101

R3(config-cmap)#policy-map mark-testpc

R3(config-pmap)#class match-test-pc

R3(config-pmap-c)#set dscp AF23

R3(config-pmap-c)#int f0/0.11

R3(config-subif)#service-policy input mark-testpc

R3(config-subif)#exit

R3(config)#

Create the queueing policy and apply it to the f0/0 interface. Understand that the policy cannot be

applied to a sub-interface.

R3(config)#class-map match-vlan23

R3(config-cmap)#match dscp AF12

R3(config-cmap)#exit

R3(config)#class-map match-vlan11

R3(config-cmap)#match dscp AF23


R3(config)#class-map match-voice

R3(config-cmap)#match dscp ef


R3(config)#policy-map QUEUE-OUT

R3(config-pmap)#class match-voice

R3(config-pmap-c)# priority percent 35

R3(config-pmap-c)#class match-vlan23

R3(config-pmap-c)#bandwidth percent 25

R3(config-pmap-c)#class match-vlan11

R3(config-pmap-c)#bandwidth percent 15

R3(config-pmap-c)#class class-default

R3(config-pmap-c)#fair-queue

R3(config-pmap-c)#interface f0/0

R3(config-if)#service-policy output QUEUE-OUT

R3(config-if)#

Verify the policy on each interface. You'll need to generate traffic from each respective vlan so that

the counters increment.

First we verify f0/0.23.

R3#show policy-map int f0/0.23

FastEthernet0/0.23

Service-policy input: mark-traffic

Class-map: match-icmp (match-all)

5 packets, 590 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 101

QoS Set

dscp af12

Packets marked 5

Class-map: class-default (match-any)



Match: any

Next, verify f0/0.11.

R3#show policy-map int f0/0.11

FastEthernet0/0.11

Service-policy input: mark-testpc

Class-map: match-test-pc (match-all)



Match: access-group 101

QoS Set

dscp af23

Packets marked 4




Match: any

Now look at the queueing policy to ensure that each type of traffic gets its allocated bandwidth.

R3#show policy-map int f0/0

FastEthernet0/0

Service-policy output: QUEUE-OUT

queue stats for all priority classes:

queue limit 64 packets

(queue depth/total drops/no-buffer drops) 0/0/0

(pkts output/bytes output) 0/0

Class-map: match-voice (match-all)

0 packets, 0 bytes


Match: dscp ef (46)

Priority: 35% (35000 kbps), burst bytes 875000, b/w exceed drops: 0

Class-map: match-vlan23 (match-all)



Match: dscp af12 (12)

Queueing




bandwidth 25% (25000 kbps)

Class-map: match-vlan11 (match-all)



Match: dscp af23 (22)

Queueing




bandwidth 15% (15000 kbps)




Match: any

Queueing


(queue depth/total drops/no-buffer drops/flowdrops) 0/0/0/0


Fair-queue: per-flow queue limit 16

R3#

Also note that the class-default is being fair-queued.

congestion management

Documents