Automated tool for deploying QoS
+Simplifies QoS configuration
+Less chance of configuration error
+Makes deployment simpler, faster and cheaper
+Follows DIVSERV model
Phase 1 - AutoQoS VoIP: designed purely for VoIP, only one command required, supported on majority of switch/router platforms
Pahse 2 - AutoQos Enterprise: Extends to cover VoIP/video/data, only supported on routers
NBAR used for protocol discovery.
Prerequisites:
1. No existing QoS policies on interface
2. CEF enabled on interface
3. Correct bandwidth specified
Enable autoqos enterprise on a router interface: 'auto qos discovery', then 'auto qos'
Enable autoqos voip on switch interface: 'auto qos voip trust' for uplinks (trust markings), 'auto qos voip cisco-phone' (extends trust boundary to phone).
Verify AutoQos on routers:
- show auto discovery qos - auto discovery results
- show auto qos - view templates and initial configuration
- show policy-map interface - shows interface QoS statistics
Verify AutoQoS VoIP on switches:
- show mls qos maps - examine cos to DSCP mappings
Common AutoQoS problems:
1. Too many classes generated - manually consolidate classes
2. QoS configuration doesn't adapt to changing network conditions - re-run discovery
3. QoS configuration doesn't fit specific circumstances - manually configure QoS elements
skip to main |
skip to sidebar
This blog will contain my revision notes, whilst studying for the Cisco ONT CCNP exam.
About Me
.jpg)
KEY POINTS - WLAN Management
Unified Wireless Network Elements:
Client Devices: PC/Phones Cisco Compatible Extensions
Mobility Platform: Indoor or outdoor access points, autonomous or lightweight (communicating with LWAPP)
Network Unification: Wireless LAN Controllers (WLC) RF/configuration management, IPS
World-class Network Management: Wireless Control System (WCS) for LWAP, WLSE for autonomous, design/control/monitoring.
Autonomous AP: individual configuration, independant, management via WLSE and WDS
Lightweight AP: Configuration via WLC, dependant on WLC, management via WCS.
WLSE: for autonomous APs, supports 2500 APs, bulk configuration changes, wireless IDS, simple AP deployment, RF visibility, RF management. Self healing, auto re-site survey.
WLSE Express: for SME, 100 devices only, includes AAA, IDS, auto/manual setup modes.
WCS: Solution for LWAP, IDS, config/RF management, 50 controllers, 1500 APs. Initial CLI config, then HTTPS interface, SNMP v.1/2/3 for communication with controllers, windows/linux OS,
WCS base: informs of AP client is associated to
WCS location: RF finger printing, accurate to 10m,
WCS location + 2700 appliance: real-time tracking of thousands of clients, inventory management, historical info.
Clients tracked using LWAP, RSSI info sent to controller, then to location appliance using SNMP. Rogue AP location, alarms, and shut down.
Client Devices: PC/Phones Cisco Compatible Extensions
Mobility Platform: Indoor or outdoor access points, autonomous or lightweight (communicating with LWAPP)
Network Unification: Wireless LAN Controllers (WLC) RF/configuration management, IPS
World-class Network Management: Wireless Control System (WCS) for LWAP, WLSE for autonomous, design/control/monitoring.
Autonomous AP: individual configuration, independant, management via WLSE and WDS
Lightweight AP: Configuration via WLC, dependant on WLC, management via WCS.
WLSE: for autonomous APs, supports 2500 APs, bulk configuration changes, wireless IDS, simple AP deployment, RF visibility, RF management. Self healing, auto re-site survey.
WLSE Express: for SME, 100 devices only, includes AAA, IDS, auto/manual setup modes.
WCS: Solution for LWAP, IDS, config/RF management, 50 controllers, 1500 APs. Initial CLI config, then HTTPS interface, SNMP v.1/2/3 for communication with controllers, windows/linux OS,
WCS base: informs of AP client is associated to
WCS location: RF finger printing, accurate to 10m,
WCS location + 2700 appliance: real-time tracking of thousands of clients, inventory management, historical info.
Clients tracked using LWAP, RSSI info sent to controller, then to location appliance using SNMP. Rogue AP location, alarms, and shut down.
KEY POINTS - Wireless Encryption and Security
Wireless Security Issues:
- Reliance on SSID as a security feature
- Vulnerable to rogue APs
- Reliance on MAC address filters
WEP:
- WEP keys hard to distribute
- WEP vulnerable to dictionary attacks
- WEP keys can be easily cracked
WPA:
Wifi Alliance, uses 802.1x or PSK, TKIP encryption and MIC for message intergrity, Initialisation Vector Space Expansion for per-packet keying. Issues include reliance on RC4, software update, DOS attacks shutting down SSID
WPA2 (802.11i):
Wifi Alliance, interoperable with 802.11i, encryption using AES, 802.1x authentication, proactive key caching, IDS (detect rogue APs, manage RF interference, enforce security)
WPA/WPA2 Features:
Enterprise or personal mode, both support PSK, or 802.1x/EAP. WPA uses TKIP/MIC encryption, WPA2 uses AES/CCMP encryption. Hardware upgrade may be required, RADIUS server must support EAP.
Features of 801.1x/EAP:
- Use of centralised AAA thru RADIUS
- Both client and server authenticated
- Use of mutliple encryption almorithms (AES/TKIP/WPA/WEP)
- Dynamic WEP keys
- Roaming
LEAP: Cisco, single login, roaming, multiple OS
EAP-FAST: IETF, single login, roaming with WDS, multiple OS, passwd expiry and change, support for 802.11i/x, TKIP, AES
EAP-TLS: IETF, client/server certificates, uses PKI, mutliple clients, single login
PEAP: Cisco/MS/RSA, server only certificate (PKI), authentication with EAP-MSCAPv2 (supports single login) for MS user databased, or EAP-GTC for generic databases such as LDAP
- Reliance on SSID as a security feature
- Vulnerable to rogue APs
- Reliance on MAC address filters
WEP:
- WEP keys hard to distribute
- WEP vulnerable to dictionary attacks
- WEP keys can be easily cracked
WPA:
Wifi Alliance, uses 802.1x or PSK, TKIP encryption and MIC for message intergrity, Initialisation Vector Space Expansion for per-packet keying. Issues include reliance on RC4, software update, DOS attacks shutting down SSID
WPA2 (802.11i):
Wifi Alliance, interoperable with 802.11i, encryption using AES, 802.1x authentication, proactive key caching, IDS (detect rogue APs, manage RF interference, enforce security)
WPA/WPA2 Features:
Enterprise or personal mode, both support PSK, or 802.1x/EAP. WPA uses TKIP/MIC encryption, WPA2 uses AES/CCMP encryption. Hardware upgrade may be required, RADIUS server must support EAP.
Features of 801.1x/EAP:
- Use of centralised AAA thru RADIUS
- Both client and server authenticated
- Use of mutliple encryption almorithms (AES/TKIP/WPA/WEP)
- Dynamic WEP keys
- Roaming
LEAP: Cisco, single login, roaming, multiple OS
EAP-FAST: IETF, single login, roaming with WDS, multiple OS, passwd expiry and change, support for 802.11i/x, TKIP, AES
EAP-TLS: IETF, client/server certificates, uses PKI, mutliple clients, single login
PEAP: Cisco/MS/RSA, server only certificate (PKI), authentication with EAP-MSCAPv2 (supports single login) for MS user databased, or EAP-GTC for generic databases such as LDAP
KEY POINTS - Congestion Avoidance
Tail Drops:
When software buffer is full
Congestion avoidance aims to minimise tail-drop
Effects of tail-drop are TCP Global Syncronisation, TCP Starvation.
TCP Global Syncronisation:
Packets from multiple flows are dropped, window size fluctuates
TCP Starvation:
- UDP traffic which doesn't utilise windowing fills up buffers when TCP window size is small.
RED: Packets dropped at random before queue is full, only effective on TCP, configure high/low threshold and MDP.
WRED:Distinguishes between priority of traffic based on IPP/DSCP
CBWRED: Profiling of traffic based on class-maps, rather than enabling at interface level. Do not apply on LLQ.
Traffic Shaping: Slow down rate of traffic by buffering, only in outbound direction, responds to network conditions/signals, detection using class-maps.
Traffic Policing: Drops packets to ensure specific traffic rate, appliable in/outbound, able to remark traffic, detection using class-maps
Payload Compression: IOS supports stacker/predictor/MPPC. Compresses data in frames, enabled link-by-link
Header Compression: Doesn't compress payload, enabled link-by-link, removes headers on all packets in a flow after initial packet. Calculates hash.
Fragmentation/Interleaving: Prevents small low-delay packets from being queued behind large low priority packets.
When software buffer is full
Congestion avoidance aims to minimise tail-drop
Effects of tail-drop are TCP Global Syncronisation, TCP Starvation.
TCP Global Syncronisation:
Packets from multiple flows are dropped, window size fluctuates
TCP Starvation:
- UDP traffic which doesn't utilise windowing fills up buffers when TCP window size is small.
RED: Packets dropped at random before queue is full, only effective on TCP, configure high/low threshold and MDP.
WRED:Distinguishes between priority of traffic based on IPP/DSCP
CBWRED: Profiling of traffic based on class-maps, rather than enabling at interface level. Do not apply on LLQ.
Traffic Shaping: Slow down rate of traffic by buffering, only in outbound direction, responds to network conditions/signals, detection using class-maps.
Traffic Policing: Drops packets to ensure specific traffic rate, appliable in/outbound, able to remark traffic, detection using class-maps
Payload Compression: IOS supports stacker/predictor/MPPC. Compresses data in frames, enabled link-by-link
Header Compression: Doesn't compress payload, enabled link-by-link, removes headers on all packets in a flow after initial packet. Calculates hash.
Fragmentation/Interleaving: Prevents small low-delay packets from being queued behind large low priority packets.
KEY POINTS - Congestion Management & Queuing
FIFO (First In First Out): Single queue, no configuration, no priority, adequate on high bandwith links, VoIP may be stuck behind bulk data. Default on interfaces larger than E1.
PQ (Priority Queuing): Four queues, configuration with access-lists, traffic assigned to priority queues, no lower priority packets sent until higher priority queues empty.
RR (Round Robin): Multiple queues, no priority, one packet processed in each queue, large packets could potentially starve other queues
WRR (Weighted Round Robin): Same as RR but it is possible to weight queues, Custom Queuing is a form of WRR, where by specific number of bytes can be processed before moving to next queue
WFQ (Weighted Fair Queuing): Default on interfaces smaller than E1. Method used by LLQ/CBWFQ. Flows identified using number of features, queue created for each traffic flow.
-'Agressive Dropping' -any packets that exceed threshold dropped, unless the destination queue is empy
-'Early Dropping' - Each queue has Congestion Discard Threshold, packets exceeding will be dropped on a per-queue basis, exception is if queue has a packet with higher seq. number, this packet would be dropped instead.
-WFQ is configured using 'fair-queue' command
CBWFQ (Class Based Weighted Fair Queuing): Uses same principle as WFQ but uses flexible class-maps to identify flows. Queues created on a class-map basis, up to 64 queues. Default class always exists, packets not matching user-defined maps will fall into default. Default class can use FIFO or WFQ. No strict priority queuing possible for delay sensitive packets.
LLQ (Low Latency Queuing): Based on CBWFQ, but has additional ability to create strict priority queuing for delay sensitive packets. 'Priority priority_value' command used to define a class-map as strict priority queue. Important to police SPQ to prevent starvation of other queues.
PQ (Priority Queuing): Four queues, configuration with access-lists, traffic assigned to priority queues, no lower priority packets sent until higher priority queues empty.
RR (Round Robin): Multiple queues, no priority, one packet processed in each queue, large packets could potentially starve other queues
WRR (Weighted Round Robin): Same as RR but it is possible to weight queues, Custom Queuing is a form of WRR, where by specific number of bytes can be processed before moving to next queue
WFQ (Weighted Fair Queuing): Default on interfaces smaller than E1. Method used by LLQ/CBWFQ. Flows identified using number of features, queue created for each traffic flow.
-'Agressive Dropping' -any packets that exceed threshold dropped, unless the destination queue is empy
-'Early Dropping' - Each queue has Congestion Discard Threshold, packets exceeding will be dropped on a per-queue basis, exception is if queue has a packet with higher seq. number, this packet would be dropped instead.
-WFQ is configured using 'fair-queue' command
CBWFQ (Class Based Weighted Fair Queuing): Uses same principle as WFQ but uses flexible class-maps to identify flows. Queues created on a class-map basis, up to 64 queues. Default class always exists, packets not matching user-defined maps will fall into default. Default class can use FIFO or WFQ. No strict priority queuing possible for delay sensitive packets.
LLQ (Low Latency Queuing): Based on CBWFQ, but has additional ability to create strict priority queuing for delay sensitive packets. 'Priority priority_value' command used to define a class-map as strict priority queue. Important to police SPQ to prevent starvation of other queues.
KEY POINTS - QoS Classification and Marking
Layer2
Ethernet 802.1q, VLAN tag priority, 802.1p field, 3bits
Frame-relay DE discard eligable, on or off
ATM CPE, candidate for drops, on or off
MPLS EXP field, three significant bits from ToS, or manually specified
Layer3
ToS field in IP header, 8 bytes
ToS field containing: IPP old, unsophisticated only 3 bits
ToS field containing: DSCP new, sophisticated 6bits
DSCP/IPP backwards compatible
DSCP Assured forwarding (AF), 4 equal queues, 3 drop levels, guaranteed service
DSCP Expidited forwarding (EF), 1 queue, low delay/jitter
Ethernet 802.1q, VLAN tag priority, 802.1p field, 3bits
Frame-relay DE discard eligable, on or off
ATM CPE, candidate for drops, on or off
MPLS EXP field, three significant bits from ToS, or manually specified
Layer3
ToS field in IP header, 8 bytes
ToS field containing: IPP old, unsophisticated only 3 bits
ToS field containing: DSCP new, sophisticated 6bits
DSCP/IPP backwards compatible
DSCP Assured forwarding (AF), 4 equal queues, 3 drop levels, guaranteed service
DSCP Expidited forwarding (EF), 1 queue, low delay/jitter
KEY POINTS - Cisco VoIP Implementation
Analogue Interfaces: FXO (PSTN/CO Switch), FXS (phone/modem/fax), E&M (PSTN-PSTN).
Digital Interfaces: PRI (e1 -30 channels/t1 -23 channels)/BRI (2 channels)
Analogue to digital conversion:
1. Sampling - capture and record voice
2. Quantization - assign 8bit numeric value based on voltage
3. Encoding - represent numeric values as binary
4. Compress - reduce bit rate (often less samples/sec)
Pulse Code Modulation (PCM):
8000 samples/sec * 8bit binary value based on voltage = bit rate 640000bits/sec (64Kb/sec). Uncompressed digital voice, can be transmitted in a single e1 channel.
cRTP - RTP header compression: beneficial on links less than 2mb/sec.
Fragmentation: Prevents small VoIP packets being queued behind large data packets. Reduces MTU to set size for all packets.
VAD: Prevents voice packets being transmitted during silence, substantial savings.
Digital Interfaces: PRI (e1 -30 channels/t1 -23 channels)/BRI (2 channels)
Analogue to digital conversion:
1. Sampling - capture and record voice
2. Quantization - assign 8bit numeric value based on voltage
3. Encoding - represent numeric values as binary
4. Compress - reduce bit rate (often less samples/sec)
Pulse Code Modulation (PCM):
8000 samples/sec * 8bit binary value based on voltage = bit rate 640000bits/sec (64Kb/sec). Uncompressed digital voice, can be transmitted in a single e1 channel.
cRTP - RTP header compression: beneficial on links less than 2mb/sec.
Fragmentation: Prevents small VoIP packets being queued behind large data packets. Reduces MTU to set size for all packets.
VAD: Prevents voice packets being transmitted during silence, substantial savings.
Way this page useful to you?
Blog Archive
-
▼
2008
(44)
-
▼
April
(22)
- WLAN Management - Ciscoworks WCS
- WLAN Management - Ciscoworks WLSE
- WLAN Management - Introduction
- 802.1x, Encryption and Authentication - 802.11i an...
- 802.1x, Encryption and Authentication - WPA, 802.1...
- 802.1x, Encryption and Authentication - PEAP
- 802.1x, Encryption and Authentication - EAP-TLS
- 802.1x, Encryption and Authentication - EAP-FAST
- 802.1x, Encryption and Authentication - Cisco LEAP
- 802.1x, Encryption and Authentication - 802.1x and...
- 802.1x, Encryption and Authentication - Evolution ...
- Wireless LAN QoS - Introduction
- Auto QoS
- End-to-end QoS - Control Plane Policing (CoPP)
- End-to-End QoS - Pre-classify
- Congestion Avoidance - Fragmentation & Interleaving
- Congestion Avoidance - Payload & Header Compression
- Congestion Avoidance - Traffic Policing/Shaping Ov...
- Congestion Avoidance - CBWRED
- Congestion Avoidance - WRED
- Congestion Avoidance - Random Early Detection
- Congestion Avoidance - Tail Drop Limitations
-
▼
April
(22)
No comments:
Post a Comment