02.10.2013 Views

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Determine <strong>the</strong> order in which ACLs are used to classify traffic<br />

When you link class-maps to queues using <strong>the</strong> command service-queue, <strong>FTOS</strong> matches <strong>the</strong> class-maps<br />

according to queue priority (queue numbers closer to 0 have lower priorities). For example, in Figure 402,<br />

class-map cmap2 is matched against ingress packets be<strong>for</strong>e cmap1.<br />

ACLs acl1 and acl2 have overlapping rules because <strong>the</strong> address range 20.1.1.0/24 is within 20.0.0.0/8.<br />

There<strong>for</strong>e, (without <strong>the</strong> keyword order) packets within <strong>the</strong> range 20.1.1.0/24 match postive against cmap1<br />

and are buffered in queue 7, though you intended <strong>for</strong> <strong>the</strong>se packets to match positive against cmap2 and be<br />

buffered in queue 4.<br />

In cases such as <strong>the</strong>se, where class-maps with overlapping ACL rules are applied to different queues, use<br />

<strong>the</strong> order keyword to specify <strong>the</strong> order in which you want to apply ACL rules, as shown in Figure 402. The<br />

order can range from 0 to 254. <strong>FTOS</strong> writes to <strong>the</strong> CAM ACL rules with lower order numbers (order<br />

numbers closer to 0) be<strong>for</strong>e rules with higher order numbers so that packets are matched as you intended.<br />

By default, all ACL rules have an order of 254.<br />

Set DSCP values <strong>for</strong> egress packets based on flow<br />

Match-any Layer 3 flows may have several match criteria. All flows that that match at least one of <strong>the</strong><br />

match criteria are mapped to <strong>the</strong> same queue since <strong>the</strong>y are in <strong>the</strong> same class map. Setting a DSCP value<br />

from QOS-POLICY-IN mode (see Set a DSCP value <strong>for</strong> egress packets on page 569) assigns <strong>the</strong> same<br />

DSCP value to all of <strong>the</strong> matching flows in <strong>the</strong> class-map. The Flow-based DSCP Marking feature allows<br />

you to assign different DSCP to each match criteria CLASS-MAP mode using <strong>the</strong> option set-ip-dscp with<br />

<strong>the</strong> match command so that matching flows within a class map can have different DSCP values, as shown<br />

in Figure 403. The values you set from CLASS-MAP mode override <strong>the</strong> value you QoS input policy DSCP<br />

value, and packets matching <strong>the</strong> rule are marked with <strong>the</strong> specified value.<br />

Figure 403 Marking Flows in <strong>the</strong> Same Queue with Different DSCP Values<br />

<strong>Force10</strong>#show run class-map<br />

!<br />

class-map match-any example-flowbased-dscp<br />

match ip access-group test set-ip-dscp 2<br />

match ip access-group test1 set-ip-dscp 4<br />

match ip precedence 7 set-ip-dscp 1<br />

<strong>Force10</strong>#show run qos-policy-input<br />

!<br />

qos-policy-input flowbased<br />

set ip-dscp 3<br />

<strong>Force10</strong># show cam layer3 linecard 2 port-set 0<br />

Cam Port Dscp Proto Tcp Src Dst SrcIp DstIp DSCP Queue<br />

Index Flag Port Port Marking<br />

-------------------------------------------------------------------------------------------<br />

-----<br />

16260 1 0 TCP 0x0 0 0 1.1.1.0/24 0.0.0.0/0 2 0<br />

16261 1 0 UDP 0x0 0 0 2.2.2.2/32 0.0.0.0/0 4 0<br />

16262 1 56 0 0x0 0 0 0.0.0.0/0 0.0.0.0/0 1 0<br />

<strong>FTOS</strong> <strong>Configuration</strong> <strong>Guide</strong>, version 7.7.1.0 567

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!