Advanced QoS on IOS-XE Pt. 2
Last updated
Last updated
Topology: ine-spv4
Load basic.l3vpn.fully.setup.cfg
On R2, remove Gi2.12 and create two subinterfaces:
Gi2.100
Gi2.200
We will pretend these connect to the same CE on two different VLANs. Perhaps VLAN 100 is for internet and VLAN 200 is for MPLS.
We must police the aggregate of VLAN 100 and VLAN 200 to 100M.
Additionally, let’s imagine we are connecting to a NID which has already done initial policing at the VLAN level, and marked conforming traffic to CS0 and traffic exceeding 100M on either VLAN with CS1.
Use a tool to ensure that previously-exceeding traffic cannot be marked down to CS0.
Conforming traffic should be left marked as CS0.
Previously-conforming or exceeding traffic that is up to 120M should be marked with CS1.
Violating traffic should be dropped.
Lastly, R2’s egress interface towards the core is MPLS enabled. Without marking the packets directly, find a way to do WRED based on exceeding traffic from the customer. (On the MPLS link, the DSCP value is not visible).
The service-group feature is a nice way to be able to apply an aggregate policy to multiple EFPs and/or sub-interfaces. The idea is that you create a logical service-group, to which the policy-map is applied, and associate the subinterfaces or EFPs with that group. All members of the group must be on the same physical interface.
In order to not mark down previously exceeding traffic to conforming, we must use a color-aware policer. This simply means that the policer is aware of the color of the traffic as it was marked by the previous device upstream. The previous device marked exceeding traffic as CS1, so this local device must not mark this traffic down to conforming.
To do this, we must identify conforming and exceeding traffic using a QoS-group marking. There is no other way to match this traffic. We use a simple marking policy as follows:
This is applied to the policer:
Now we need two more class-maps to match the QoS group marking.
The conform-color and exceed-color match these class-maps:
You might wonder why the exceed-color is needed. Isn’t the conform color enough to not mark non-conforming packets down to conform? The reason seems to be that violate packets are implicitly any packet not colored as conform or exceed. Violate packets cannot be marked down to exceed.
Finally, we are asked to use WRED on the egress MPLS-enabled link. The DSCP value will not be visable. To account for this, we use an internal marking on the packet which is called the discard-class. We can use multiple set statements for conforming and exceeding traffic:
This is an internal marking similar to the QoS group, but it is only used for the purpose of WRED.
On the egress link we would use a policy such as this:
Also note that if you use WRED in DSCP mode, the MPLS EXP can be used. The EXP value is treated as IPP which is mapped to a CS value. So using the MPLS EXP value for WRED on egress is a valid alternative to using this discard-class tool.
