Enterprise QoS Solution Reference Network Design Guide

WAN Aggregator/Branch Router Handoff Considerations
2-122
conform-action transmit exceed-action policed-dscp-transmit
! Excess call signaling traffic from any source is marked down to CS1
CAT6500-PFC3-I(config-pmap-c)# class BEST-EFFORT
CAT6500-PFC3-I(config-pmap-c)# police flow mask src-only 5000000 8000
conform-action transmit exceed-action policed-dscp-transmit
! Excess PC Data traffic from any source is marked down to CS1
CAT6500-PFC3-I(config-pmap-c)# exit
CAT6500-PFC3-IOS(config-pmap)#exit
CAT6500-PFC3-IOS(config)#
CAT6500-PFC3-IOS(config)#interface range GigabitEthernet4/1 - 4
CAT6500-PFC3(config-if-range)# mls qos trust dscp
CAT6500-PFC3(config-if-range)# service-policy input PER-USER-POLICING
! Attaches Per-User Microflow policing policy to Uplinks from Access
CAT6500-PFC3(config-if-range)#end
CAT6500-PFC3-IOS#
Catalyst 6500 MLS QoS Verification Commands:
show mls qos
show class-map
show policy-map
show policy interface
Enterprise QoS Solution Reference Network Design Guide
Chapter 2 Campus QoS Design
WAN Aggregator/Branch Router Handoff Considerations
A final consideration in campus QoS design is the Campus-to-WAN (or VPN) handoff; in the case of a
branch, this equates to the Branch Switch to Branch router handoff.
In either case, a major speed mismatch is impending, as GigabitEthernet/FastEthernet campus networks
are connecting to WAN links that may only be a few Megabits (if that).
Granted, the WAN Aggregation Routers and the Remote-Branch Routers have advanced QoS
mechanisms to prioritize traffic on their links, but it is critical to keep in mind that Cisco router QoS is
performed in IOS software, while Catalyst switch QoS is performed in ASIC hardware.
Therefore, the optimal distribution of QoS operations would be to have as much QoS actions performed
on the Catalyst switches as possible, saving the WAN/Branch router valuable CPU cycles. This is an
especially critical consideration when deploying DoS/Worm mitigation designs.
For example, some enterprises have deployed advanced QoS policies on their Branch Switches and
Routers, only to have DoS/Worm attacks originate from within the Branch. Remember, queuing will not
engage on a switch unless its links are congested, and even if it does, should the Branch switch hands
off 100 Mbps of (correctly queued) traffic to a Branch router, it will more than likely bring it down.
Thus, the following design principles for the Campus-to-WAN handoff can help mitigate these types of
scenarios:
First, resist the urge to automatically use a GigabitEthernet connection to the WAN Aggregation
router, even if the router supports GE.
It is extremely unlikely that the WAN Aggregator (WAG) is serving anywhere close to a (combined)
WAN-circuit-rate of 1 Gbps. Therefore, use one (or more) FastEthernet connections on the distribution
layer Catalyst switch to connect to the WAG, so that the aggregate traffic sent to the WAG is not only
limited (in 100 Mbps increments), but also (since congestion points are now pulled back into the Catalyst
switch, thus forcing queuing to engage on the FE switch port) the traffic will be correctly queued within
these (100 Mbps-increment) limits.
Version 3.3