Enterprise QoS Solution Reference Network Design Guide

QoS Design Overview
2-2
Enterprise QoS Solution Reference Network Design Guide
Chapter 2 Campus QoS Design
Classify and mark applications as close to their sources as technically and administratively feasible.
This principle promotes end-to-end Differentiated Services/Per-Hop Behaviors. Sometimes
endpoints can be trusted to set Class of Service (CoS)/Differentiated Services Code Point (DSCP)
markings correctly, but this is not recommended because users can easily abuse provisioned QoS
policies if permitted to mark their own traffic.
For example, if DSCP Expedited Forwarding (EF) received priority services throughout the
enterprise, a user could easily configure the NIC on a PC to mark all traffic to DSCP EF, thus
hijacking network priority queues to service their non-real time traffic. Such abuse could easily ruin
the service quality of real time applications (like VoIP) throughout the enterprise. For this reason,
the clause “as close as… administratively feasible” is included in the design principle.
Police unwanted traffic flows as close to their sources as possible.
There is little sense in forwarding unwanted traffic only to police and drop it at a subsequent node.
This is especially the case when the unwanted traffic is the result of Denial of Service (DoS) or worm
attacks. Such attacks can cause network outages by overwhelming network device processors with
traffic.
Always perform QoS in hardware rather than software when a choice exists.
Cisco IOS routers perform QoS in software. This places additional demands on the CPU, depending
on the complexity and functionality of the policy. Cisco Catalyst switches, on the other hand,
perform QoS in dedicated hardware ASICS and as such do not tax their main CPUs to administer
QoS policies. You can therefore apply complex QoS policies at Gigabit/TenGigabitEthernet line
speeds in these switches.
For these reasons, you should enable QoS policies such as classification and marking policies to
establish and enforce trust boundaries as well as policers to protect against undesired flows at the access
edge of the LAN.
Most campus links are underutilized. Some studies have shown that 95 percent of campus access layer
links are utilized at less than 5 percent of their capacity. This means that you can design campus networks
to accommodate oversubscription between access, distribution and core layers. Oversubscription allows
for uplinks to be utilized more efficiently and more importantly, reduces the overall cost of building the
campus network.
Common campus oversubscription values are 20:1 for the access-to-distribution layers and 4:1 for the
distribution-to-core layers, as shown in Figure 2-1.
Figure 2-1 Typical Campus Oversubscription Ratios
Core
Distribution
Access
Si Si
Si Si
Typical 4:1
Oversubscription
Typical 20:1
Oversubscription
Version 3.3