1. © 2001, Cisco Systems, Inc. Modular QoS CLI Classification

2. © 2001, Cisco Systems, Inc. QOS v1.0—8-2 Objectives Upon completing of this module, you will be able to: Describe the classification part of the Modular QoS CLI Describe and configure all currently supported classification options within the MQC Understand network-based application recognition (NBAR) Monitor and troubleshoot class maps

3. Introduction to Modular QoS CLI © 2001, Cisco Systems, Inc. QOS v1.0—8-3

4. © 2001, Cisco Systems, Inc. QOS v1.0—8-4 Objectives Upon completing this lesson, you will be able to: Describe MQC concepts and structure Configure class maps Monitor and troubleshoot class maps

5. © 2001, Cisco Systems, Inc. QOS v1.0—8-5 Modular QoS CLI The Modular QoS CLI (MQC) provides a modular approach to configuration of QoS mechanisms. Classification is configured separately from the QoS service policy. MQC also provides modularity to implementation of QoS mechanisms in the Cisco IOS: –New QoS mechanisms can reuse old classification options. –New QoS classification options can also be used by older QoS mechanisms.

6. © 2001, Cisco Systems, Inc. QOS v1.0—8-6 Separation of Classification Classification Traffic Policy Class 1? Class 2? Class N? CBWFQ CBLLQ Class-Based Policing Packet Interface or Forwarding

7. © 2001, Cisco Systems, Inc. QOS v1.0—8-7 Class Maps Each class is identified using a class map. Each class map is identified by a case-sensitive name. Class maps can operate in two modes: –match-all–all conditions have to succeed –match-any–at least one condition must succeed The default mode is Match all.

8. © 2001, Cisco Systems, Inc. QOS v1.0—8-8 Classification Using Class Maps Match Mode? Match all conditions? Match all conditions? Match at least one condition? Match at least one condition? No Yes No Match Match Class Map name Class Map name Yes No Match all Match any

9. © 2001, Cisco Systems, Inc. QOS v1.0—8-9 Classification Using the match-all Strategy match-all requires all conditions to return a positive answer. If one condition is not met, the class map will return a “no match” result. Match Condition? Match Condition? No Match Match More Conditions? More Conditions? Yes No Class Map name Class Map name No Yes

10. © 2001, Cisco Systems, Inc. QOS v1.0—8-10 Classification Using the match-any Strategy match-any requires at least one condition to return a positive answer. If no condition is met, the class map will return a “no match” result. Match Condition? Match Condition? No Match Match Class Map name Class Map name No Yes More Conditions? More Conditions? Yes No

11. © 2001, Cisco Systems, Inc. QOS v1.0—8-11 Classification Options The main classification options include: Access list (all access lists are available) IP Precedence value IP DSCP value QoS group number MPLS experimental bits Protocol (including NBAR)

12. © 2001, Cisco Systems, Inc. QOS v1.0—8-12 Other Classification Options Other classification options include: Using another class map Frame Relay DE bit IEEE 802.1Q CoS or ISL priority values Input interface Source MAC address Destination MAC address RTP (UDP) port range Any packet

13. © 2001, Cisco Systems, Inc. QOS v1.0—8-13 Configuring Class Maps class-map [{match-all | match-any}] name router(config)# Enter the class map configuration mode. Specify the matching strategy. match-all is the default matching strategy. match condition router(config-cmap)# Use at least one condition to match packets. description router(config-cmap)# It is recommended to use descriptions in large and complex configurations. The description has no operational meaning.

14. © 2001, Cisco Systems, Inc. QOS v1.0—8-14 Configuring Class Maps rename new-name router(config-cmap)# Complex class maps can easily be renamed by using the rename class map command. All references to the class map are also renamed.

15. © 2001, Cisco Systems, Inc. QOS v1.0—8-15 Class Map Example This example illustrates how class maps are configured. Class maps on their own have no function. class-map match-any Test1 match access-group 101 match access-group 102 class-map match-all Test2 match access-group 101 match access-group 102 class-map match-any Test1 match access-group 101 match access-group 102 class-map match-all Test2 match access-group 101 match access-group 102

16. © 2001, Cisco Systems, Inc. QOS v1.0—8-16 Monitoring and Troubleshooting Class Maps show class-map [class-map] router# Lists all class maps or the selected class map Router#show class-map Class Map match-all Test2 (id 0) Match access-group 101 Match access-group 102 Class Map match-any Test1 (id 1) Match access-group 101 Match access-group 102 Router# Router#show class-map Class Map match-all Test2 (id 0) Match access-group 101 Match access-group 102 Class Map match-any Test1 (id 1) Match access-group 101 Match access-group 102 Router#

17. © 2001, Cisco Systems, Inc. QOS v1.0—8-17 Summary Upon completing this lesson, you should be able to: Describe MQC concepts and structure Configure class maps Monitor and troubleshoot class maps

18. © 2001, Cisco Systems, Inc. QOS v1.0—8-18 Lesson Review 1.What are the benefits of the Modular QoS CLI? 2.Which two matching strategies do class maps support? 3.Which classification options do class maps support?

19. © 2001, Cisco Systems, Inc. QOS v1.0—8-19 Classification Options © 2001, Cisco Systems, Inc. QOS v1.0—8-19

20. © 2001, Cisco Systems, Inc. QOS v1.0—8-20 Objectives Upon completing this lesson, you will be able to : Describe and configure classification using access lists Describe and configure classification using the IP Precedence Describe and configure classification using the DSCP Describe and configure classification using the QoS group Describe and configure classification using the MPLS experimental bits Describe and configure classification based on the input interface Describe and configure classification based on the source MAC address Describe and configure classification based on the destination MAC address Describe and configure classification based on IEEE 802.1Q ISL CoS or ISL priority bits Describe and configure classification using another class map, a negation or any keyword Describe and configure classification based on the Frame Relay DE bit

21. © 2001, Cisco Systems, Inc. QOS v1.0—8-21 Classification Using Access Lists Access lists are the oldest classification tool that has been used with QoS mechanisms. Class maps support all types of access lists Class maps are multiprotocol. Class maps can use named access lists and numbered access lists (ranging from 1 to 2699) for all protocols.

22. © 2001, Cisco Systems, Inc. QOS v1.0—8-22 Configuring Classification Using Access Lists match access-group {number | name} router(config-cmap)# Select an access list to be used for classification. class-map Telnet match access-group 100 ! class-map IPX_Printers match access-group IPX_Printers ! access-list 100 permit tcp any any eq 23 access-list 100 permit tcp any eq 23 any ! ipx access-list sap IPX_Printers permit -1 7 ! class-map Telnet match access-group 100 ! class-map IPX_Printers match access-group IPX_Printers ! access-list 100 permit tcp any any eq 23 access-list 100 permit tcp any eq 23 any ! ipx access-list sap IPX_Printers permit -1 7 !

23. © 2001, Cisco Systems, Inc. QOS v1.0—8-23 Configuring Classification Using IP Precedence match ip precedence precedence [prec [prec [prec]]] router(config-cmap)# Select up to four IP Precedence values or names. All packets marked with one of the selected IP precedence values are matched by this class map. IP Precedence ValueName 0routine 1priority 2immediate 3flash 4flash-override 5critical 6internet 7networkIP Precedence ValueName 0routine 1priority 2immediate 3flash 4flash-override 5critical 6internet 7network class-map VoIP match ip precedence 5 ! class-map Gold match ip precedence 3 4 ! class-map Silver match ip precedence 1 2 ! class-map Bronze match ip precedence routine ! class-map VoIP match ip precedence 5 ! class-map Gold match ip precedence 3 4 ! class-map Silver match ip precedence 1 2 ! class-map Bronze match ip precedence routine !

24. © 2001, Cisco Systems, Inc. QOS v1.0—8-24 Configuring Classification Using DSCP match ip dscp dscp [dscp...] router(config-cmap)# Select up to eight DSCP values or names. All packets marked with one of the selected DSCP values are matched by this class map. DSCPDSCP Class ValueName 0(000000)default 1(001000)cs1 2(010000)cs2 3(011000)cs3 4(100000)cs4 5(101000)cs5 6(110000)cs6 7(111000)cs7 46(101110)ef DSCPDSCP Class ValueName 0(000000)default 1(001000)cs1 2(010000)cs2 3(011000)cs3 4(100000)cs4 5(101000)cs5 6(110000)cs6 7(111000)cs7 46(101110)ef DSCPDSCP Class ValueName 10(001010)af11 12(001100)af12 14(001110)af13 18(010010)af21 20(010100)af22 22(010110)af23 26(011010)af31 28(011100)af32 30(011110)af33 34(100010)af41 36(100100)af42 38(100110)af43 DSCPDSCP Class ValueName 10(001010)af11 12(001100)af12 14(001110)af13 18(010010)af21 20(010100)af22 22(010110)af23 26(011010)af31 28(011100)af32 30(011110)af33 34(100010)af41 36(100100)af42 38(100110)af43

25. © 2001, Cisco Systems, Inc. QOS v1.0—8-25 Configuring Classification Using DSCP (cont.) class-map Voice match ip dscp ef ! class-map Gold match ip dscp af11 af12 af13 cs3 cs4 ! class-map Silver match ip dscp af21 af22 af23 cs1 cs2 ! class-map Bronze match ip dscp af31 af32 af33 ! class-map Best-effort match ip dscp default ! class-map Voice match ip dscp ef ! class-map Gold match ip dscp af11 af12 af13 cs3 cs4 ! class-map Silver match ip dscp af21 af22 af23 cs1 cs2 ! class-map Bronze match ip dscp af31 af32 af33 ! class-map Best-effort match ip dscp default !

26. © 2001, Cisco Systems, Inc. QOS v1.0—8-26 Configuring Classification Using QoS Group match ip qos-group qos-group router(config-cmap)# Select the QoS group identifying the class. Allowed values are from 0 to 99. All packets marked with the QoS group value are matched by this class map. The QoS group is a parameter local to the router; it has to be set by some other QoS mechanism (CAR, PBR, class-based marking, class-based policing, QPPB). class-map QoS1 match qos-group 1 ! class-map QoS2 match qos-group 2 ! class-map QoS1 match qos-group 1 ! class-map QoS2 match qos-group 2 !

27. © 2001, Cisco Systems, Inc. QOS v1.0—8-27 Configuring Classification Using MPLS Experimental Bits match mpls experimental exp [exp...] router(config-cmap)# Select up to eight MPLS experimental values. Allowed values are from 0 to 7. All MPLS-labeled packets marked with the selected MPLS experimental bits are matched by this class map. class-map MPLS1 match mpls experimental 3 4 ! class-map MPLS2 match mpls experimental 1 2 ! class-map MPLS1 match mpls experimental 3 4 ! class-map MPLS2 match mpls experimental 1 2 !

28. © 2001, Cisco Systems, Inc. QOS v1.0—8-28 Configuring Classification Using the Input Interface match input-interface intf router(config-cmap)# All packets received through the selected input interface are matched by this class map class-map match-any Ethernets match input-interface Ethernet0/0 match input-interface Ethernet0/1 ! class-map match-any FastEthernets match input-interface FastEthernet1/0 match input-interface FastEthernet1/1 ! class-map match-any Serials match input-interface Serial2/0 match input-interface Serial2/1 match input-interface Serial2/2 match input-interface Serial2/3 ! class-map match-any Ethernets match input-interface Ethernet0/0 match input-interface Ethernet0/1 ! class-map match-any FastEthernets match input-interface FastEthernet1/0 match input-interface FastEthernet1/1 ! class-map match-any Serials match input-interface Serial2/0 match input-interface Serial2/1 match input-interface Serial2/2 match input-interface Serial2/3 !

29. © 2001, Cisco Systems, Inc. QOS v1.0—8-29 Configuring Classification Using MAC Addresses match source-address mac mac-address router(config-cmap)# Classifies packets based on the source MAC address This classification option can be used only on interfaces using MAC addresses (e.g., Ethernet, FastEthernet) match destination-address mac mac-address router(config-cmap)# Classifies packets based on the destination MAC address This classification option can be used only on interfaces using MAC addresses (e.g., Ethernet, Fast Ethernet) class-map RTR1_dst match destination-address mac 00f0.64e2.2860 ! class-map RTR2_src match source-address mac 00f0.64e2.3321 ! class-map RTR1_dst match destination-address mac 00f0.64e2.2860 ! class-map RTR2_src match source-address mac 00f0.64e2.3321 !

30. © 2001, Cisco Systems, Inc. QOS v1.0—8-30 Configuring Classification Using 802.1q COS or ISL Priority bits match cos cos [cos [cos [cos ]]] router(config-cmap)# Select up to four CoS/priority values. Allowed values are 0 to 7. This classification option can be used only on interfaces using 802.1Q or ISL encapsulation. class-map Strict-priority match cos 5 ! class-map High-priority match cos 4 6 7 ! class-map Low-priority match cos 0 1 2 3 ! class-map Strict-priority match cos 5 ! class-map High-priority match cos 4 6 7 ! class-map Low-priority match cos 0 1 2 3 !

31. © 2001, Cisco Systems, Inc. QOS v1.0—8-31 Configuring Classification Using Special Options match not condition router(config-cmap)# The not keyword inverts the condition. match class-map class-map router(config-cmap)# One class map can use another class map for classification. Nested class maps allow generic template class maps to be used in other class maps. match any router(config-cmap)# The any keyword can be used to match all packets.

32. © 2001, Cisco Systems, Inc. QOS v1.0—8-32 Configuring Classification Using Special Options (cont.) class-map Well-known-services match access-group 100 ! Class-map Unknown-services match not class-map Well-known-services ! Class-map All-services match any ! access-list 100 permit tcp any any lt 1024 access-list 100 permit tcp any lt 1024 any class-map Well-known-services match access-group 100 ! Class-map Unknown-services match not class-map Well-known-services ! Class-map All-services match any ! access-list 100 permit tcp any any lt 1024 access-list 100 permit tcp any lt 1024 any

33. © 2001, Cisco Systems, Inc. QOS v1.0—8-33 Configuring Classification Using the Frame Relay DE Bit match fr-de router(config-cmap)# Use this command to match all frames with the Frame Relay DE bit set. class-map FR_Out_of_Contract match fr-de ! class-map FR_Within_Contract match not fr-de ! class-map FR_Out_of_Contract match fr-de ! class-map FR_Within_Contract match not fr-de !

34. © 2001, Cisco Systems, Inc. QOS v1.0—8-34 Configuring Classification Using a UDP Port Range match ip rtp starting-port port-range router(config-cmap)# Use this command to implement classification equal to IP RTP Prioritization. All UDP packets with source or destination port numbers within the specified range are matched. Range is between the starting-port (values from 2000 to 65535) and the sum of the starting-port and the port-range (values from 0 to 16383). The command should be used in combination with class-based low- latency queuing to implement IPRTP Prioritization using the Modular QoS CLI. class-map RTP match ip rtp 16384 16383 ! class-map RTP match ip rtp 16384 16383 !

35. © 2001, Cisco Systems, Inc. QOS v1.0—8-35 Summary Upon completing this lesson, you should be able to: Describe and configure classification using access lists Describe and configure classification using the IP Precedence Describe and configure classification using the DSCP Describe and configure classification using the QoS group Describe and configure classification using the MPLS experimental bits Describe and configure classification based on the input interface Describe and configure classification based on the source MAC address Describe and configure classification based on destination MAC address Describe and configure classification based on IEEE 802.1Q CoS or ISL priority bits Describe and configure classification using another class map, a negation or any keyword Describe and configure classification based on the Frame Relay DE bit

36. © 2001, Cisco Systems, Inc. QOS v1.0—8-36 Lesson Review 1.Which classification options are available using class maps? 2.What command is used to configure classification?

37. © 2001, Cisco Systems, Inc. QOS v1.0—8-37 Network Based Application Recognition (NBAR) © 2001, Cisco Systems, Inc. QOS v1.0—8-37

38. © 2001, Cisco Systems, Inc. QOS v1.0—8-38 Objectives Upon completing this lesson, you will be able to: Describe and configure NBAR Describe and configure classification of FTP and TFTP Describe and configure complex classification of HTTP sessions Monitor and troubleshoot class maps

39. © 2001, Cisco Systems, Inc. QOS v1.0—8-39 Network-Based Application Recognition (NBAR) The IntServ model uses RSVP to signal QoS requirements, including application definition. The DiffServ model relies on the network to recognize applications. Recognizing simple applications is possible by matching on the static source or destination TCP/UDP port numbers. Some applications use multiple sessions and dynamic port numbers.

40. © 2001, Cisco Systems, Inc. QOS v1.0—8-40 NBAR Capabilities NBAR was introduced to enable recognition of applications using dynamic port numbers (e.g., FTP, Exchange, SQL*net) NBAR supports a number of applications that use static port numbers (e.g.,Telnet) NBAR also allows recognition of sessions based on higher-layer information (e.g., HTTP by URL, host, or MIME, Citrix by application)

41. © 2001, Cisco Systems, Inc. QOS v1.0—8-41 NBAR Support for Static Protocols NBAR supports a number of applications that are recognized based on a well-known destination port number. Such applications were previously matched by using extended IP access lists.

42. © 2001, Cisco Systems, Inc. QOS v1.0—8-42 NBAR Support for Dynamic Protocols NBAR is primarily used to recognize applications that use multiple sessions and dynamic port numbers: –Such applications usually start with a control session on a well-known port number. –Additional ports are negotiated through the control session. NBAR inspects the negotiation of additional ports. Most of these applications could previously not be matched by any mechanism.

43. © 2001, Cisco Systems, Inc. QOS v1.0—8-43 Packet Description Language Modules An external Packet Description Language Module (PDLM) can be loaded at run time to extend the NBAR list of recognized protocols. PDLMs can also be used to enhance an existing protocol recognition capability. PDLMs allow NBAR to recognize new protocols without requiring a new IOS image or a router reload.

44. © 2001, Cisco Systems, Inc. QOS v1.0—8-44 Configuring NBAR match protocol protocol router(config-cmap)# Use the protocol keyword and the name of the protocol to match. Static protocols are recognized based on the well-known destination port number. Dynamic protocols are recognized by inspecting the session.

45. © 2001, Cisco Systems, Inc. QOS v1.0—8-45 Configuring NBAR (cont.) ip nbar pdlm pdlm-file router(config)# Enter the location of the Packet Description Language Module file to extend the NBAR capabilities of the router. The file name is in the URL format (e.g., flash://citrix.pdlm). ip nbar port-map protocol {tcp | udp} new-port [new-port...] router(config)# Specify an additional port for a well-known protocol. Up to 16 additional port numbers can be specified.

46. © 2001, Cisco Systems, Inc. QOS v1.0—8-46 Configuring NBAR for HTTP match protocol http url url router(config-cmap)# match protocol http mime mime-type router(config-cmap)# Select the mime-type to be matched Matches a packet containing the MIME type and all subsequent packets until the next HTTP transaction Recognizes the HTTP GET packets containing the URL, and then matches all packets that are part of the HTTP GET request Include only the portion of the URL following the address or host name in the match statement match protocol http host hostname router(config-cmap)# Performs a regular expression match on the host field contents inside an HTTP GET packet and classifies all packets from that host

47. © 2001, Cisco Systems, Inc. QOS v1.0—8-47 NBAR for FTP Case Study FTP control sessions can be recognized based on the well- known port number 21. FTP data sessions may be recognized by the well-known source port number 20. Not all implementations of FTP use port 20. NBAR recognizes FTP data sessions by inspecting the FTP control session. Open control session to well-known port 21 GET file; use port 1050 Open data session to negotiated port 1050 Sending file class-map FTP match protocol ftp class-map FTP match protocol ftp class-map FTP match protocol ftp class-map FTP match protocol ftp

48. © 2001, Cisco Systems, Inc. QOS v1.0—8-48 NBAR for TFTP Case Study TFTP uses UDP for transport. The first packet uses a well-known destination port number 69 and a random source port (>1023). The receiver responds to the received source port and uses a new source port for its packets (>1023). The session from then on uses those port numbers. Send first packet to port 69, source port 1060 GET file Send packet to port 1060, source port 1035 Sending file class-map FTP match protocol tftp class-map FTP match protocol tftp class-map FTP match protocol tftp class-map FTP match protocol tftp Send packet to port 1035, source port 1060 Acknowledge Send packet to port 1060, source port 1035 Sending file

49. © 2001, Cisco Systems, Inc. QOS v1.0—8-49 NBAR for HTTP Case Study #1 HTTP is a static protocol using a well-known port number 80. Some web servers are using HTTP on other ports. Use the ip nbar port-map command to inform the router that other ports are also used for HTTP. Open HTTP session to port 80 GET page ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http Open HTTP session to port 8080 GET page

50. © 2001, Cisco Systems, Inc. QOS v1.0—8-50 NBAR for HTTP Case Study #2 The class map matches all HTTP requests that contain either xxx.gif or xxx.jpg. It does so on both ports 80 and 8080. Open HTTP session to port 80 GET /images/xxx.gif ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http url *xxx.(jpg|gif) ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http url *xxx.(jpg|gif) Open HTTP session to port 8080 GET /images/xxx.jpg

51. © 2001, Cisco Systems, Inc. QOS v1.0—8-51 NBAR for HTTP Case Study #3 The class map matches all HTTP requests containing a MIME type that contains jpeg (e.g. image/jpeg). It does so on both ports 80 and 8080. Open HTTP session to port 80 GET /html/pictures.html ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http mime *jpeg ip nbar port-map http tcp 80 8080 ! class-map HTTP match protocol http mime *jpeg Open HTTP session to port 8080 GET /html/pictures.html

52. © 2001, Cisco Systems, Inc. QOS v1.0—8-52 Summary Upon completing this lesson, you should be able to: Describe and configure NBAR Describe and configure classification of FTP and TFTP Describe and configure complex classification of HTTP sessions Monitor and troubleshoot class maps

53. © 2001, Cisco Systems, Inc. QOS v1.0—8-53 Lesson Review 1.What is NBAR used for? 2.What types of applications can NBAR recognize? 3.How can support for recognizing new applications be included into existing IOS versions? 4.What additional classification options are available for HTTP? 5.Which special characters are available with regular expressions for matching HTTP flows?

54. © 2001, Cisco Systems, Inc. QOS v1.0—8-54 Module Summary Upon completing this module, you should be able to: Describe the classification part of the Modular QoS CLI Describe and configure all currently supported classification options within the MQC Describe and configure network-based application recognition (NBAR) Monitor and troubleshoot class maps

55. IP QoS - Modular QoS CLI Classification-55 © 2001, Cisco Systems, Inc.