CCIE OCG: Classification and Marking

IP Precedence and DSCP Compared

• IP header includes a 1-byte Type of Service (ToS) field.
• The ToS was intended to be used to mark a packet for treatment with QoS tools.
• The ToS field is further divided: the high-order 3 bits defined as IP Precedence (IPP).
• Bits 3 through 6 of the ToS byte included flag fields which were not used very often.
• Along came Differentiated Services (DiffServ).
• DiffServ needed more than 3 bits to mark packets, so it redefined the ToS byte.
• The ToS was renamed Differentiated Services (DS) field, and IPP was replaced with a 6-bit field called Differentiated Services Code Point (DSCP).
• The low-order 2 bits is used with QoS Explicit Congestion Notification (ECN).

 
IP Precendence Values

Name	Decimal Value	Binary Value
Routine	Precedence 0	000
Priority	Precedence 1	001
Immediate	Precedence 2	010
Flash	Precedence 3	011
Flash Override	Precedence 4	100
Critical	Precedence 5	101
Internetwork Control	Precedence 6	110
Network Control	Precedence 7	111

DSCP Settings and Terminology

• For example, DSCP 46 is Expedited Forwarding (EF). 
• EF should be given queuing preference for minimal latency but the packets should be prevented from congesting the link.
• The suggested settings and associated QoS behavior are called Per-Hop Behaviors (PHB). 
• IPP and DSCP overlap.
• Class Selector (CS) PHB provide backward compatibility between DSCP and IPP. 
• IPP can still understand DSCP values.
• Packets with larger CS DSCPs should be given better queuing preference than packets with lower CS DSCPs.

Default and Class Selector DSCP Values

DSCP Class Selector	Binary DSCP Value	IPP Value	IPP Names
Default/CS0	00000000	000	Routine
CS1	00100000	001	Priority
CS2	01000000	010	Immediate
CS3	01100000	011	Flash
CS4	10000000	100	Flash Override
CS5	10100000	101	Critical
CS6	11000000	110	Internetwork Control
CS7	11100000	111	Network Control

• The Assured Forwarding (AF) defines four classes for queuing purposes and three levels of drop probability inside each queue.
• AF conforms to the following format:

1. AFxy, where x implies one of the queues (1-4) and y implies one the three drop priorities (1-3).
2. The higher the x, the better queuing treatment a packet should get.
3. The higher the y, the worse the drop treatment for those packets (more likely to get dropped).

• For example, AF11 should get worse queuing treatment than AF23. However, AF11 has better drop treatment than AF23.

Assured Forwarding DSCP Values

Queue Class	Low Drop Probability	Medium Drop Probability	High Drop Probability
	Name/Decimal/Binary	Name/Decimal/Binary	Name/Decimal/Binary
1	AF11/10/001010	AF12/12/001100	AF13/14/001110
2	AF21/18/010010	AF22/20/010100	AF23/22/010110
3	AF31/26/011010	AF32/28/011100	AF33/30/011110
4	AF41/34/100010	AF42/36/100100	AF43/38/100110

• Conversion Formula: If AFxy, then 8x-2y.
• Example: AF41 = 8*4+2*1 = 34.

• Expedited Forwarding (EF):

1. Queue EF packets so that they get scheduled quickly, to give them low latency.
2. Police the EF packets so that they do not consume all bandwidth on the link or starve other queues. 

• IP packets get encapsulated inside other headers, which have their own QoS fields.

 

Ethernet LAN Class of Service (CoS)

• Ethernet supports a 3-bit QoS marking field but it only exists when the Ethernet header includes either a 802.1Q or ISL header.
• 802.1Q: the 3 most significant bits of the 2-byte Tag Control field (user-priority bits).
• ISL: the 3 least significant bits from the 1-byte User field. 
• Frame Relay and ATM have a single bit to define drop probability: Discard Eligibility (DE) and Cell Loss Priority (CLP), respectively.
• MPLS defines a 3-bit field called the MPLS Experimental (EXP) bit that is intended for general QoS marking.

 

Location for Marking and Matching

• For classification: On ingress only, and only if the interface supports that particular header field.
• For marking: On egress only, and only if the interface supports that particular header field.

Marking Field Summary

Field	Location	Length
IP Precedence	IP Header	3 bits
IP DSCP	IP Header	6 bits
DS field	IP Header	1 byte
ToS byte	IP Header	1 byte
CoS	ISL and 802.1Q header	3 bits
Discard Eligibel (DE)	Frame Relay header	1 bit
Cell Loss Priority (CLP)	ATM cell header	1 bit
MPLS Experimental	MPLS header	3 bits

Cisco Modular QoS CLI

• Intended to simply QoS configuration. 
• MQC-based tools all begin with the phrase "class-based".
• Three major commands:
  1. The class-map command defines the matching parameters for classifying packets into service classes.
  2. The PHB actions (marking, queuing, and so on) are configured under a policy-map command.
  3. The policy-map is enabled on an interface by using a service-policy command. 
• Packets are classified using the match command inside the class-map. 
• The match command has many options for matching packets, including QoS fields, ACLs, and MAC addresses. 
• Class-map names are case-sensitive. 
• The match protocol commands means that IOS uses NBAR to perform that match. 
• The match any command matches any and all packets. 
• CEF is required for class-based marking. Without it, the class-map and policy-map configuration would be allowed, but the service-policy command would be rejected. 
• Class-maps can use multiple match commands, and even nest class-maps inside other class-maps.
• Up to four (CoS and IPP) or eight (DSCP) values can be listed on a single match cos, match precedence, or match dscp command. If any is found in the packet, the statement is matched.
• If the class-map has multiple match commands, the match-any or match-all (default) defines whether a logical OR or a logical AND is used, respectively.
• The match class command refers to another class-map by name, nesting the logic. It is considered a match if the referenced class-map also results in a match.

! This class-map matches packets that are permitted by ACL 101 and have an IPP of 5.
class-map match-all EXAMPLE-A
 match access-group 101
 match precedence 5

! This class-map matches packets that are permitted by ACL 101 or have a DSCP of AF21.
class-map match-any EXAMPLE-B
 match access-group 101
 match dscp AF21

! This class-map will never match anything because a packet cannot have two DSCP values.
class-map match-all EXAMPLE-C
 match dscp 0
 match dscp 1

! This example shows the use of nested class-maps.
class-map match-all CHILD-CLASS
 match access-group 101
 match precedence 5
!
class-map match-any PARENT-CLASS
 match class CHILD-CLASS
 match cos 5

Mach: Packets permitted by ACL 101 AND marked with IPP 5 OR frames with CoS 5.

Classification Using NBAR

• NBAR classifies packets that are normally difficult to classify.
• Some applications use dynamic port numbers, so static match command will not work.
• NBAR can do deep packet inspection, looking at the host name, URL, MIME, and so on.
• NBAR can look past the TCP and UDP headers to recognize application-specific information.

 

Configuration

• CB marking requires CEF.
• Packets are classified based on the logic in MQC class-maps.
• An MQC policy-map refers to one or more class-maps; packets classified into that class are then marked.
• CB marking is enabled in either ingress or egress direction.
• A policy-map is processed sequentially; after a packet has matched a class, it is marked based on the set command(s) defined for that class.
• Multiple set commands can be configured in one class to set multiple fields, for example to set both DSCP and CoS.
• Packets that do not explicitly match a defined class are considered to have matched a special class called class-default.
• For any class inside the policy-map for which there is no set command, packets in that class are not marked.

 Example:

• Frames entering with CoS 5 will be marked with DSCP EF.
• Frames entering with CoS 1 will be marked with DSCP AF11.
• Frames entering with any other CoS will be marked with DSCP 0.
• Packets exiting with DSCP EF will be marked with CoS 5.
• Packets exiting with DSCP AF11 will be marked with CoS 1.
• Packets exiting with any other DSCP will be marked with CoS 0.

class-map COS1
 match cos 1
!
class-map COS5
 match cos 5
!
class-map AF11
 match dscp af11
!
class-map EF
 match dscp EF
!
policy-map COS-TO-DSCP-IN
 class COS1
  set dscp af11
 class COS5
   set dscp ef
 class class-default
  set ip dscp default
!
policy-map DSCP-TO-COS-OUT
 class AF11
  set cos 1
 class EF
  set cos 5
 class class-default
  set cos 0
!
interface FastEthernet0/0.10
 encapsulation dot1q 10
 service-policy input COS-TO-DSCP-IN
 service-policy output DSCP-TO-COS-OUT

Only interfaces configured for 802.1Q accept service-policy commands that reference policy-maps that either classify or mark based on CoS.

CB Marking Design Choices

• Packets should generally be marked as close to the ingress point of the packet as possible. 
• However, the earliest point might not be a trusted device.
• Rule: "Mark as close to the ingress edge of the network as possible, but not so close to the edge that the marking is made by an untrusted device." 
• Cisco recommends not to use more than four or five different service classes for data traffic.

Recommended Values For Marking

Type of Traffic	CoS	IPP	DSCP
Voice Payload	5	5	EF
Video Payload	4	4	AF41
Voice/Video Signaling	3	3	CS3
Mission-Critical Data	3	3	AF31, AF32, AF33
Transactional Data	2	2	AF21, AF22, AF23
Bulk Data	1	1	AF11, AF12, AF13
Best Effort	0	0	BE
Scavenger	0	0	2, 4, 6

Marking Using Policers

• Traffic policers measure entering/exiting an interface -determining whether a configured traffic contract has been exceeded.
• Two components: a traffic rate (bits/second), and a burst size (bytes).
• Traffic within the limits is conformed to the contract.
• Traffic over the rate or burst is exceeding the contract.
• The simplest form of policing discards packets that exceeded the contract.
• Another option: mark down packets instead of dropping them.
• Example: a policer could re-mark AF11 packets that exceeded the contract with a new DSCP value of AF13, but not discard the packet.

QoS Pre-Classification

• When packets are tunneled or encrypted, the original headers and packet contents are unavailable for inspection.
• QoS pre-classification allows a VPN endpoint router to make egress QoS decisions based on the original traffic, before encapsulation.

AutoQoS

• A macro that helps automate class-based QoS configuration.
• It creates and applies QoS configurations based on Cisco best practice recommendations.
• Two flavors: AutoQoS for VoIP and AutoQoS for the Enterprise.

AutoQoS for VoIP

• Automatic QoS configuration for voice and video applications.
• Assumes two types of ports on switches: user access and uplink.
• Also assumes that a user access port might or might not have an IP phone.
• When enabled for any interface, the command starts a macro that globally enables QoS, configures interface ingress and egress queues, configures class-maps and policy-maps, and applies the policy-map to the interface.
• Enabled with the interface-level command auto qos [cisco-phone | cisco-softphone].
• If no phone is found, all traffic is marked down to DSCP 0 and treated as best effort.
• If a phone is found, the received QoS markings are trusted.
• Voice and video control traffic, real-time video traffic, voice traffic, routing protocol traffic, and STP BPDU traffic has priority (expedited forwarding).
• Uplink ports use the auto qos voip trust command.

AutoQoS for the Enterprise

• Automates the QoS configuration for VoIP and other network applications.
• Meant to be used for WAN links.
• It detects the types and amounts of network traffic and then creates policies based on that.
• Two steps:

1. Discover the traffic.
2. Provide recommended QoS configuration.

• Enable discovery: auto discovery qos [trust].
• Make sure CEF is enabled, the interface bandwidth is configured, and no QoS configuration is applied.
• Use the trust keyword to trust received markings.
• Traffic discovery uses NBAR to learn the types and amounts of traffic on each enabled interface.
• After traffic discovery has collected enough information, run auto qos on the interface.
• This runs a macro that creates templates based on the traffic collected, creates class-maps to classify traffic, and creates a policy-map to allocate bandwidth and mark the traffic.