Introduction to QoS
The switch comes with a set of traffic management tools that you can use to provide QoS for Layer 2 (bridged) or Layer 3 (routed) traffic flows. Many of these flows are multiplexed across a set of network switches and compete for network resources at convergence points. Without traffic management, the congested data flows compete for resources and the result is unpredictable. The resulting QoS can only be described as best-effort. The opposite is also true, without congestion there are sufficient network resources for all traffic to pass without competition. Without congestion, traffic management is not required. In this sense, you cannot separate discussions about QoS and traffic management from those on congestion. The switch provides a set of tools that you can use to provide network services that are far superior to best-effort thereby enabling the delivery of provisioned QoS.
Congestion management
Congestion handling
Congestion management acts to prevent congestion by prioritizing traffic flows through priority queuing and priority-aware servicing methods. Other functions, such as policing, are also considered congestion management. Policing indirectly prioritizes some traffic by limiting the rates of other traffic.
Congestion handling alleviates existing congestion by dropping lower priority traffic before higher priority traffic. The switch handles the congestion by queue-specific tail dropping. The basic QoS architecture of the switch identifies three primary functional areas:
Ingress QoS identification and classification
the switch‘s internals and queuing architecture
QoS marking/remarking for downstream use
![Important](images/important.png)
Important
Remarking packets with an ACL filter does not change the internal QoS level of the packets. You must add the permit internal-qos [value] statement to the ACL filter.
The QoS architecture is coherent end-to-end across a network. The QoS at any particular network element can be marked in the relevant Layer 2 or Layer 3 protocol fields and provided to the next hop. The receiving next hop can then use this information to classify its own ingress traffic, apply its specific internal traffic management features, and remark the results for subsequent hops.
Depending on the product, the QoS implementation on the switch can support the following options:
Ingress priority mappings including: DSCP to internal QoS, 802.1p-bits to internal QoS, and port-level QoS configuration.
Egress priority mappings including: internal QoS to DSCP and internal QoS to 802.1p-bits.
-
Automatic QoS
Port-based rate limiting or ingress policers
Port-based broadcast and multicast rate limiting
Port-based egress shaping
Egress queue rate limiting
![Note](images/note.png)
Note
The VSP 7400 Series does not support port-based rate limiting or ingress policers.
For information about feature support, see VOSS Feature Support Matrix.
Traffic management
Prioritized traffic handling requires QoS classification first. The switch typically classifies traffic by using the endpoint switch configuration in conjunction with the protocol elements of the incoming frame such as priority. You can add additional classification by using access control lists (ACLs) and other filtering functionality.
The switch‘s internal traffic management functions use the results of classification to determine the prioritization of traffic. Examples of internal functions that prioritize traffic would be both strict and weighted round robin (WRR) queue scheduling. These mechanisms prioritize data by favorable scheduling or weighting.
The disposition of a particular data frame is not necessarily fully determined as a result of classification. You can apply additional traffic management functions such as Ingress Port Rate Limiting or Policing depending on your switch features. Ingress Port Rate Limiting is a congestion management mechanism to limit the traffic rate accepted by the specified ingress port. Policing is a congestion management method that limits incoming traffic at the ingress that could cause congestion at the egress. While queuing strategies affect prioritization by favoring some traffic; policing is essentially the opposite. Policing works not by favoring some traffic, but by penalizing the bursty traffic. Queue scheduling and policing are only two of the available tools for congestion management. Additional details are presented in subsequent sections of this document.
In addition to the traffic management tools which aid in the prevention of congestion, tools are also provided to handle congestion as it occurs. Congestion handling tools monitor congestion levels at convergence points in the switch and selectively discard frames if congestion begins to increase. Per queue tail dropping is the primary congestion handling function of the switch. You can also use ACLs and filtering as congestion handling tools.
Differentiated Services (DiffServ)
Feature |
Product |
Release introduced |
---|---|---|
Differentiated Services (DiffServ) including Per-Hop Behavior |
VSP 4450 Series |
VSP 4000 4.0 |
VSP 4900 Series |
VOSS 8.1 |
|
VSP 7200 Series |
VOSS 4.2.1 |
|
VSP 7400 Series |
VOSS 8.0 |
|
VSP 8200 Series |
VSP 8200 4.0 |
|
VSP 8400 Series |
VOSS 4.2 |
|
VSP 8600 Series |
VSP 8600 4.5 |
|
XA1400 Series |
VOSS 8.0.50 |
Differentiated Services (DiffServ) is a traffic management tool that classifies network traffic into eight traffic classes, and then gives each class differentiated treatment. DiffServ networks map the traffic‘s class into a set of packet forwarding behavior, referred to as a Per-Hop Behavior (PHB). A PHB could specify which egress queue to use. For example, a switch may classify a packet by determining its protocol to be IPv4, subsequently extract the DSCP value, and apply a PHB by directing the packet to a specific queue. DiffServ does not prescribe a set of traffic classes and does not predetermine which types of traffic should be handled by a given class. DiffServ simply provides a generic means of classifying packets so they may be treated differently.
DiffServ applies to IP packets only.
DiffServ Access and DiffServ Core
A fundamental characteristic of DiffServ networks is the distinction made between switches at the network edges and those residing in the network interior. The switch refers to this distinction as DiffServ Access (edge) and DiffServ Core (interior), respectively.
-
If you configure a port as an access port, the system does not trust packet markings.
-
If you configure a port as a core port, the system trusts packet markings.
On the access side, malicious users can send packets into a network with intent to cause serious harm (e.g., denial of service attacks). However, on core switches, the only traffic sources are one‘s own upstream switches. As such, a core switch has the opportunity to trust the classification, markings (and implied PHB) determined by the previous hop.
The following figure shows DiffServ network operations. The devices are on the network edge where they perform classification, marking, policing, and shaping functions.
![](GUID-18F42F8B-B672-4215-965F-E3B628B49F24-low.png)
Use a DiffServ Access port at the edge of a DiffServ network. The access port classifies traffic according to port QoS. Outgoing packet DSCP and 802.1p values are derived from port QoS and QoS maps. The system strips Dot1Q headers at ingress, and adds them back at egress only if you configure the egress port as a tagged or trunk port.
A DiffServ Core port does not change packet classification or markings; the port trusts the incoming traffic markings. A core port preserves the DSCP marking of all incoming packets, and uses these markings to assign the packet to an internal QoS level. For tagged packets, the port honors the 802.1p bits within a Dot1Q header, and uses these bits to classify ingress traffic. You can control the honoring (or not) of 802.1p bits by configuring the 802.1p override.
Per-Hop Behavior (PHB)
Traffic entering the DiffServ network enter a queue according to their marking, which determines the PHB of the packets. For example, if the system marks a video stream to receive the highest priority, it enters a high-priority queue. As these packets traverse the DiffServ network, the system forwards the video stream before other packets.
As a standard, DiffServ is described in the context of Layer 3. Classification is accomplished by mapping a packet priority field from the packet and then applying a per-hop behavior. DiffServ standards define the IPv4 header‘s Differentiated Services Code Point (DSCP) field to determine classification and subsequent per-hop behavior.
The RFC2598 standard provides only the following four fundamental per-hop behaviors:
-
Default (DF) — This PHB provides best-effort forwarding behavior.
-
Expedited Forwarding (EF) — This PHB provides performance-critical forwarding.
-
Assured Forwarding (AF) — This PHB classifies traffic based upon class (priority) only.
Important
The switch never classifies nor takes action based upon drop precedence. In response to congestion, the only drops available for a given traffic class are tail drops.
-
Class Selector (CS) — This PHB provides a simple mapping of a DSCP to one of eight traffic classes. While the switch provides all four PHBs, the CS PHB is most analogous to the switch‘s internal processing – classification occurs to derive priority, which subsequently determine the per-hop behavior (e.g., queuing).
DiffServ and filters
QoS (DiffServ) and filters operate independently; you do not have to use filters to provide QoS. However, filters can override QoS operations. For more information, see Traffic filtering fundamentals.
DiffServ and VXLAN Gateway
DSCP bits in the outer IP header of VXLAN-encapsulated packets are always derived from the internal QoS, irrespective of the ingress port DiffServ configuration. Customer packet IP DSCP bits are not modified as part of VXLAN encapsulation. For more information about VXLAN, see VXLAN Gateway.
Traffic traversing the switch
Classification and ingress mapping
Filtering
Rate Limiting or Policing
Queueing
Remarking
Shaping
If the packet arrives on an untrusted port (DiffServ Access), then the packet‘s priority comes from user-configured parameters such as port priority.
If the packet arrives on a trusted port, priority comes from information contained in the packet‘s header (p-bits or DSCP).
After the switch determines the packet‘s configured or marked priority, it maps that value to be used internally. The QoS level used by the switch is referred to as the Internal QoS Level (IQL). The IQL is the internal numerical value that the switch uses to determine the packets per-hop behaviors such as queue selection and bandwidth guarantee.
Packet classification: IEEE 802.1p and DSCP markings classify (map) the packet to its appropriate PHB and QoS level.
Remarking: The switch can remark packets according to QoS actions you configure on the switch (internal QoS mappings).
Shaping: The switch provides port-based shaping. Port-based shaping shapes all outgoing traffic to a specific rate.