JANET-BMAS Cisco NBAR

Bandwidth Management Advisory Service Cisco NBAR Ben Horner George Neisser

Bandwidth Management Advisory Service Introduction BMAS  To keep abreast of the latest developments, technologies and standards in bandwidth management  To trial and evaluate products  To assess their usefulness and applicability within UK education  To produce advisory materials, usage guidelines and recommendations BMAS web site:  To collaborate with organisations NBAR  What can it do?  How is it applied?  BMAS Results  What can’t it do?

Bandwidth Management Advisory Service What is NBAR? Cisco:  Intelligent classification engine used with Quality of Service (QoS) class-based features  Protocol Discovery analyses application traffic patterns in real time and identifies which traffic is running on the network  Capable of classifying applications that have: Statically assigned TCP and UDP port numbers Non-TCP and non-UDP IP protocols Dynamically assigned TCP and UDP port numbers during connection establishment Classification based on deep packet inspection: NBAR can look deeper into the packet to identify applications HTTP traffic by URL, host name or MIME type using regular expressions (*, ?, [ ]), Citrix ICA traffic, RTP Payload type classification Currently supports 88 protocols/applications

Bandwidth Management Advisory Service What can NBAR do? 2Mb/s WAN Bottleneck causes traffic to back up into queues that are all given best effort HTTP KaZaA Video Conference Key: LOCAL CAMPUS INTERNET NBAR can stop KaZaA and give priority to the video conference traffic

Bandwidth Management Advisory Service Applying NBAR Get the latest IOS and PDLMs Enable NBAR on your interfaces Collect and analyse results Decide upon and create classes Decide upon and create policies Apply policies to interfaces Collect and analyse results Modify classes and policies appropriately

Bandwidth Management Advisory Service Example Router# conf t Router(config)# ip cef Router(config)# int eth0/0 Router(config-if)# ip nbar protocol-discovery Router(config-if)# exit Router(config)# int se0/0 Router(config-if)# ip nbar protocol-discovery Router# show ip nbar protocol discovery int eth0/0 top 3 FastEthernet0/0 Input Output Protocol Packet Count Packet Count Byte Count Byte Count 5 minute bit rate (bps) 5 minute bit rate (bps) ftp http netshow unknown Total

Bandwidth Management Advisory Service Router(config)# class-map match-any streams Router(config-cmap)# match protocol rtp Router(config-cmap)# match protocol rtsp Router(config-cmap)# match protocol netshow Router(config-cmap)# match ip dscp ef Router(config-cmap)# exit Router(config)# policy-map dscp_mark Router(config-pmap)# class streams Router(config-pmap-c)# set ip dscp ef Router(config-pmap-c)# exit Router(config-pmap)# exit Router(config)# policy-map apply_qos Router(config-pmap)# class streams Router(config-pmap-c)# bandwidth 600 Router(config-pmap-c)# exit Router(config-pmap)# class class-default Router(config-pmap-c)# fair-queue Router(config-pmap-c)# exit Router(config-pmap)# exit Router(config)# int eth0/0 Router(config-if)# service-policy input dscp_mark Router(config-if)# exit Router(config)# int se0/0 Router(config-if)# service-policy output apply_qos Router(config-if)# exit Router(config)# exit Router# show running-config class-map match-any streams match protocol rtp match protocol rtspplayer match protocol netshow match ip dscp ef ! policy-map input_mark class stream set ip dscp ef policy-map apply_qos class stream bandwidth 600 class class-default fair-queue Example continued…

Bandwidth Management Advisory Service Example continued… Router# show policy-map int eth0/0 Ethernet0/0 Service-policy input: dscp_mark Class-map: stream (match-any) packets, bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: protocol rtp 0 packets, 0 bytes 5 minute rate 0 bps Match: protocol rtspplayer packets, bytes 5 minute rate 0 bps Match: protocol netshow packets, bytes 5 minute rate 0 bps Match: ip dscp ef 0 packets, 0 bytes 5 minute rate 0 bps QoS Set dscp ef Packets marked Class-map: class-default (match-any) packets, bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any

Bandwidth Management Advisory Service BMAS NBAR Results

Bandwidth Management Advisory Service What can’t NBAR do? It’s not a magic wand It doesn’t recognise everything (but what does?) Requires the very latest IOS and PDLMs to be fully effective  You can create your own PDLMs(ish) ip nbar custom lunar_light 8 ascii Moonbeam tcp range NBAR is quite crude. Queues and drops rather than shapes. It will add a CPU overhead NBAR is not particularly easy to configure/get right It probably will improve as it becomes a more accepted method of bandwidth management

Bandwidth Management Advisory Service Further Information Cisco presentations and documentation  NBAR Overview (12.2T) html html  Code Red virus blocking:  Nimda virus blocking ml ml  Many NBAR presentations and papers  NBAR Protocol Discovery MIB BMAS website  Contact me  Thank you