Cisco QoS Technical Tips Page

AutoQoS Q&A <http://www.cisco.com/en/US/tech/tk543/tk759/tk879/technologies_q_and_a_item0900aecd8020a589.shtml>

Return to Quick Pick List at the top.

Cisco IOS Order of Operations

The order of operations is hard coded into Cisco IOS and tells the router how to process traffic according to the configuration of different router functions and features.  While we cant' make you think like a router, it is likely you have already picked up on some of these.  When configuring features such as Network Address Translation (NAT), Quality of Service (QoS), and encryption, it's essential to understand the order of operations in order to configure these features successfully.

QoS Order of Operations

Here's the order of operations for inbound traffic to the router:

1. QoS Policy Propagation through Border Gateway Protocol (BGP)—or QPPB
2. Input common classification
3. Input ACLs
4. Input marking—class-based marking or Committed Access Rate (CAR)
5. Input policing—through a class-based policer or CAR
6. IPSec
7. Cisco Express Forwarding (CEF) or Fast Switching

Here's the order of operations for outbound traffic from the router:

1. CEF or Fast Switching
2. Output common classification
3. Output ACLs
4. Output marking
5. Output policing—through a class-based policer or CAR
6. Queueing—Class-Based Weighted Fair Queueing (CBWFQ) and Low Latency Queueing (LLQ)—and Weighted Random Early Detection (WRED)

NAT Order of Operations

We assume understanding of NAT basic operations.   If the packet is from a NAT inside-designated interface, it uses the inside-to-outside list. If the packet is from an outside-to-inside interface, it uses that list.

Here's the order of operations for the inside-to-outside list:

1. If IPSec, then check input access list
2. Decryption—for Cisco Encryption Technology (CET) or IPSec
3. Check input access list
4. Check input rate limits
5. Input accounting
6. Policy routing
7. Routing
8. Redirect to Web cache
9. NAT inside to outside (local to global translation)
10. Crypto (check map and mark for encryption)
11. Check output access list
12. Inspect context-based access control (CBAC)
13. TCP intercept
14. Encryption

Here's the order of operations for the outside-to-inside list:

1. If IPSec, then check input access list
2. Decryption—for CET or IPSec
3. Check input access list
4. Check input rate limits
5. Input accounting
6. NAT outside to inside (global to local translation)
7. Policy routing
8. Routing
9. Redirect to Web cache
10. Crypto (check map and mark for encryption)
11. Check output access list
12. Inspect CBAC
13. TCP intercept
14. Encryption

Let's say that you have an IP packet coming in from an outside-to-inside interface. When translating that packet, you want to use an access control list to block traffic from certain IP addresses. Which IP address should you put in the ACL—the IP address before the packet's translation (i.e., the public IP address), or the IP address after the packet's translation (i.e., the private address)?

By checking the order of operations, you can determine that the "NAT outside to inside" operation occurs after the "Check input access list" task. Therefore, you would use the public IP address in the ACL because the packet hasn't gone through NAT.

On the other hand, what if you want to create a static route for traffic going through NAT?  In this case, you would use the private (inside) IP address because the traffic has already gone through NAT when it gets to the "Routing" operation.

Return to Quick Pick List at the top.

NBAR is a powerful packet filtering/identification/firewall that you may already have installed on your Cisco router.  For a list of what NBAR can detect look at: http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124tcg/tqos_c/part_05/qsnbar1.htm#wp1056828.

NBAR is also what we call Cisco's "autopilot" for QoS.  It has been in IOS since ver. 12.0 and has been continually updated with recognition of new applications.  A huge improvement was made with IOS 12.3  which introduced the ability to recognize more applications because of the availability of the Packet Description Language Module (PDLM) feature.   PDLMs help IOS to know which application is which when it looks through the traffic flow. Cisco regularly releases new PDLMs for new applications, and you can get more info at http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm (a valid CCO login is required).

For list of NBAR applications recognized with IOS version 12.3, use the following commands:

Configuring and using NBAR to identify and block traffic is done as follows (you can find further details at http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/nbar_mqc_ps6922_TSD_Products_Configuration_Guide_Chapter.html):

First, make sure that CEF is on using the following command:

Next create a class-map, identifying the traffic you want to block.

Now create a policy to mark the traffic:

Next, apply the policy to the interface that faces the Internet or the source of the traffic that you want to block. This marks the traffic when it enters the router:

Now create an access control list (ACL) that denies the marked traffic:

Lastly, deny the marked traffic as it’s about to exit your router by applying the ACL to an interface:

A less talked about feature of NBAR is its security aspect. NBAR can identify  fields in a HTTP packet, such as the URL, content type, or user agent.  For example, NBAR recognized the fast-moving Code Red Worm that first circulated the Internet in 2001. While traditional firewalls weren’t able to look inside the HTTP stream of data and block the Code Red traffic, NBAR was ideal for the situation.

Lastly, there are some things that NBAR cannot do. You can’t use it on a tunnel or encrypted interface, and you can’t use it to work with asymmetric traffic flows, understand URLs or other traffic in HTTPS traffic, work with non-CEF traffic, or identify fragmented traffic.

Return to Quick Pick List at the top.

CAR — or “rate limiting” — is a method for managing unwanted traffic on your network and making sure it doesn’t affect important traffic.  Essentially, CAR controls the bandwidth of a certain type of traffic, and an access control list (ACL) defines which traffic it controls. Once you’ve created the ACL, you can set CAR to enforce a bandwidth rate on that traffic in either an INBOUND or OUTBOUND direction, according to the interface on which you applied CAR.

Configuring  CAR requires two simple steps: a) Create an ACL to define the traffic you want to rate limit, and b) Use the rate-limit command, referencing the ACL on your interface closest to the source of the traffic, referencing the proper direction, and referencing the proper bandwidth amounts.

You can only use CAR with IP traffic. To use CAR, you must first enable CEF on your routers.

Lets say you wanted to limit a branch office PC (10.1.100.1) access to the Internet.  First, we must define the traffic  to be rate limited on the main office router:

Now use the rate-limit command on the interface:

Main_Office(config)# interface Serial1/0

Main_Office(config-if)# rate-limit output access-group 110 40000 10000 30000 conform-action transmit exceed-action drop

This command has applied the rate limit to the interface, referencing ACL 110 in the outbound direction (because it is applied it on the headquarters router not the remote router). The 40000, 10000, 30000 represents the normal bits per second (bps) for this traffic (i.e., 40000 bps or about 40 Kb), the normal burst size for the traffic (i.e., 10000 or about 10 Kb), and the maximum burst size for the traffic (i.e., 30000 or about 20 Kb). The traffic must conform to these numbers in order for the router to transmit it (as specified by conform-action transmit). If the traffic exceeds those bandwidth settings, the router will drop it (as specified by exceed-action drop).

While you can use CAR in a variety of situations, keep in mind that CAR only limits what you tell it to limit with the ACL. In addition, the CAR bandwidth settings you reference limit all traffic referenced in the ACL.

Return to Quick Pick List at the top.

Return to Quick Pick List at the top.