Network QoS policies

Cards store QoS policy match-criteria entries in dedicated memory banks in hardware, also referred to as CAM tables:

• IP/MAC ingress

• IP/MAC egress

• IPv6 ingress

• IPv6 egress

By default, a tunnel that terminates on the ingress IP interface (the node is the last hop for the tunnel) is evaluated based on the type of tunnel: IP GRE or MPLS LSP. An IP tunneled packet may match a dot1p entry, IP ToS precedence entry, or IP ToS DSCP entry when defined in the applied policy. An MPLS LSP may match a dot1p entry or MPLS EXP entry when defined.

Tunnel termination QoS override only applies to IP routing decisions when the tunnel encapsulation is removed. Non-IP routed packets within a terminating tunnel are ignored by the override and are forwarded as described in Network ingress.

Any tunnel received on the ingress IP interface that traverses the node (where the node is not the ultimate hop for the tunnel) is not affected by the QoS override mechanism and is forwarded as described in Network ingress.

Tunnel termination QoS override, provides the ability to ignore the network ingress QoS mapping of a terminated tunnel containing an IP packet that is to be routed to a base router or VPRN destination. This is useful when the mapping for the tunnel QoS marking does not accurately or completely reflect the required QoS handling for the IP routed packet. When the mechanism is enabled on an ingress network IP interface using the ingress ler-use-dscp parameter, the IP interface ignores the tunnel’s QoS mapping and derive the internal forwarding class and profile based on the precedence or DSCP values within the routed IP header ToS field compared to the network QoS policy defined on the IP interface.

IP match criteria classification is supported in the ingress section of a network QoS policy.

The classification only applies to the outer IPv4 header of non-tunneled traffic. Consequently, the use of an IP criteria statement in a network QoS policy is ignored for received traffic when the network QoS policy is applied on the ingress network IP interface in the following cases:

• mesh SDPs in VPLS services

• spoke SDPs in VPLS and Xpipe services

• spoke SDPs under an IP interface in an IES or VPRN service

• spoke SDPs in a VPRN service

• bindings created automatically by the auto-bind-tunnel command in a VPRN service

• IPv6 over IPv4 tunnels

• VXLAN bindings (egress VTEP, VNI)

The only exception is for traffic received on a Draft Rosen tunnel, for which classification on the outer IP header only is supported.

Attempting to apply a network QoS policy containing an IP criteria statement to any object except a network IP interface results in an error.

The following is an example configuration:

  configure
     qos
        network 10 name ‟10” create
            ingress
                ip-criteria
                    entry 10 create
                        match
                            dst-ip 10.0.0.1/32
                        exit
                        action fc "h2" profile in
                    exit
                exit
            exit
        exit
     exit

IPv6 match criteria classification is supported in the ingress section of a network QoS policy.

The classification only applies to the outer IPv6 header of non-tunneled traffic; consequently, the use of an ipv6-criteria statement in a network QoS policy is ignored for received traffic when the network QoS policy is applied on the ingress network IP interface in the following cases:

• mesh SDPs in VPLS services

• spoke SDPs in VPLS and Xpipe services

• spoke SDPs under an IP interface in an IES or VPRN service

• spoke SDPs in a VPRN service

• bindings created automatically by the auto-bind-tunnel command in a VPRN service

• IPv6 over IPv4 tunnels

• VXLAN bindings (egress VTEP, VNI)

Attempting to apply a network QoS policy containing an IPv6 criteria statement to any object except a network IP interface results in an error.

The following is an example configuration:

  configure
     qos
        network 10 name ‟10” create
            ingress
                ipv6-criteria
                    entry 10 create
                        match
                            dst-ip 2001:db8:1000::1/128
                        exit
                        action fc "ef" profile in
                    exit
                exit
            exit
        exit
     exit

The user enables IP precedence or DSCP based egress reclassification by applying the following command in the context of the network QoS policy applied to the egress context of a spoke SDP.

config>qos>network>egress>prec ip-prec-value [fc fc-name] [profile {exceed | out | in | inplus}]

config>qos>network>egress>dscp dscp-name [fc fc-name] [profile {exceed | out | in | inplus}]

The IP precedence bits used to match against DSCP reclassification rules come from the Type of Service (ToS) field within the IPv4 header or the Traffic Class field from the IPv6 header.

The IP DSCP bits used to match against DSCP reclassification rules come from the Type of Service (ToS) field within the IPv4 header or the Traffic Class field from the IPv6 header.

If the packet does not have an IP header, DSCP or IP-precedence based matching is not performed.

The IP precedence and DSCP based re-classification are supported on a network interface, on a CSC network interface in a VPRN, and on a PW used in an IES or VPRN spoke-interface. The CLI blocks the application of a network QoS policy with the egress re-classification commands to a network IP interface or to a spoke SDP part of L2 service. Conversely, the CLI does not allow the user to add the egress re-classification commands to a network QoS policy if it is being used by an L2 spoke SDP.

In addition, the egress re-classification commands only take effect if the redirection of the spoke SDP or CSC interface to use an egress port queue-group succeeds. For example, the following CLI commands succeed:

config>service>vprn>if>spoke-sdp>egress>qos network-policy-id port-redirect-group queue-group-name instance instance-id

config>service>ies>if>spoke-sdp>egress>qos network-policy-id port-redirect-group queue-group-name instance instance-id

config>service>vprn>nw-if>qos network-policy-id port-redirect-group queue-group-name instance instance-id

When the redirection command fails in CLI, the PW uses the network QoS policy assigned to the network IP interface, however any reclassification in the network QoS policy applied to the network interface is ignored.

IP match criteria classification is supported in the egress section of a network QoS policy.

The configuration of egress prec/DSCP classification and the configuration of an egress IP criteria entry statement within a network QoS policy are mutually exclusive.

The criteria action statement port redirect group is not supported on the 7750 SR-a4/a8.

Network QoS policies containing egress IP criteria entry statements are only applicable to network interfaces.

The following is an example configuration:

  configure
     qos
        network 10 name ‟10” create
            egress
                ip-criteria
                    entry 10 create
                        match
                            dst-ip 192.168.1.0/24
                        exit
                        action fc "af" profile out
                    exit
                exit
            exit
        exit

IPv6 match criteria classification is supported in the egress section of a network QoS policy.

The configuration of egress prec/DSCP classification and the configuration of an egress IPv6 criteria entry statement within a network QoS policy are mutually exclusive.

The criteria action statement port redirect group is not supported on the 7750 SR-a4/a8.

Network QoS policies containing egress IPv6 criteria entry statements are only applicable to network interfaces.

The following is an example configuration:

  configure
     qos
        network 10 name ‟10” create
            egress
                ipv6-criteria
                    entry 10 create
                        match
                            dst-ip 2001:db8:2000::1/128
                        exit
                        action fc "ef" profile in
                    exit
                exit
            exit
        exit

DSCP Name  DSCP Value  DSCP Value    DSCP Value    Label
            Decimal    Hexadecimal    Binary    
=============================================================
Default       0            0x00       0b000000    be
nc1           48           0x30       0b110000    h1
nc2           56           0x38       0b111000    nc
ef            46           0x2e       0b101110    ef
af11          10           0x0a       0b001010    assured
af12          12           0x0c       0b001100    assured
af13          14           0x0e       0b001110    assured
af21          18           0x12       0b010010    l1
af22          20           0x14       0b010100    l1
af23          22           0x16       0b010110    l1
af31          26           0x1a       0b011010    l1
af32          28           0x1c       0b011100    l1
af33          30           0x1d       0b011110    l1
af41          34           0x22       0b100010    h2
af42          36           0x24       0b100100    h2
af43          38           0x26       0b100110    h2

default*    0

*The default forwarding class mapping is used for all DSCP names/values for which there is no explicit forwarding class mapping.

Configuring and applying QoS policies other than the default policy is optional. A default network policy of the appropriate type is applied to each router interface.

To create a network QoS policy when operating, define the following:

• A network policy ID value. The system does not dynamically assign a value.

• Include a description. The description provides a brief overview of policy features.

• Egress criteria can be modified to customize the forwarding class queues to be instantiated. Otherwise, the default values are applied.

  • remarking

    When enabled, this command remarks all packets that egress on the specified network port. The remarking is based on the forwarding class to DSCP and LSP EXP bit mapping defined under the egress node of the network QoS policy.

  • forwarding class criteria

    The forwarding class name represents an egress queue. The forwarding class criteria define the egress characteristics of the queue and the marking criteria of packets flowing through it.

    • DE marking

      This specifies that the DE bit should be marked based on whether the packet profile is in-profile, inplus-profile, out-of-profile, or exceed-profile.

    • dot1p

      The dot1p value is used for all VLAN-tagged packets requiring marking that egress on this forwarding class queue, with the option of specifying a different value for packets that are in-profile or out-of-profile. Inplus-profile traffic is marked with the same values as in-profile traffic. Exceed-profile traffic is marked with the same values as out-of-profile traffic.

    • DSCP

      The DSCP value is used for all IP packets requiring marking that egress on this forwarding class queue that are in-profile or out-of-profile. Inplus-profile traffic is marked with the same values as in-profile traffic. Exceed-profile traffic is marked with the same values as out-of-profile traffic.

    • LSP EXP

      The EXP value is used for all MPLS-labeled packets requiring marking that egress on this forwarding class queue that are in-profile or out-of-profile. Inplus-profile traffic is marked with the same values as in-profile traffic. Exceed-profile traffic is marked with the same values as out-of-profile traffic.

    • port redirection

      This specifies that the traffic should be redirected to a network egress queue group policer or queue.

  • DSCP

    Creates a mapping between the DSCP of the network egress traffic and the forwarding class and profile. Egress traffic that matches the specified DSCP is assigned to the corresponding forwarding class with the specified profile.

  • IP criteria

    Creates a mapping between the possible match criteria of the network egress traffic and the forwarding class and profile. Egress traffic that matches the IPv4 criteria is assigned to the corresponding forwarding class and profile.

  • IPv6 criteria

    Creates a mapping between the possible match criteria of the network egress traffic and the forwarding class and profile. Egress traffic that matches the IPv6 criteria is assigned to the corresponding forwarding class and profile.

  • prec

    Creates a mapping between the IP precedence of the network egress traffic and the forwarding class and profile. Egress traffic that matches the specified IP precedence is assigned to the corresponding forwarding class with the specified profile.

• Ingress criteria specifies the DSCP- or dot1p-to-forwarding class mapping for all IP packets and defines the MPLS EXP bits-to-forwarding class mapping for all labeled packets.

  • default action

    Defines the default action to be taken for packets that have an undefined configured classification. The default action specifies the forwarding class and profile to which such packets are assigned.

  • dot1p

    Creates a mapping between the dot1p of the network ingress traffic and the forwarding class and profile. Ingress traffic that matches the specified dot1p is assigned to the corresponding forwarding class and profile.

  • DSCP

    Creates a mapping between the DSCP of the network ingress traffic and the forwarding class and profile. Ingress traffic that matches the specified DSCP is assigned to the corresponding forwarding class.

  • forwarding class

    The forwarding class name represents an ingress queue.

  • IP criteria

    Creates a mapping between the possible match criteria of the network ingress traffic and the forwarding class and profile. Ingress traffic that matches the IPv4 criteria is assigned to the corresponding forwarding class and profile.

  • IPv6 criteria

    Creates a mapping between the possible match criteria of the network ingress traffic and the forwarding class and profile. Ingress traffic that matches the IPv6 criteria is assigned to the corresponding forwarding class and profile.

  • LER use DSCP

    Specifies that DSCP matching based on the tunneled IP packet should be used on an LER instead of matching on the outer encapsulated header.

  • LSP EXP

    Creates a mapping between the LSP EXP bits of the network ingress traffic and the forwarding class and profile. Ingress traffic that matches the specified LSP EXP bits is assigned to the corresponding forwarding class and profile.

Use the following CLI syntax to create a network QoS policy:

config>qos# network network-policy-id [create]
  description description-string
  egress
    dscp dscp-name fc fc-name profile {in | out | exceed 
      | inplus}
    fc {be | l2 | af | l1 | h2 | ef | h1 | nc}
      de-mark [force de-value]
      dot1p dot1p-priority
      dot1p-in-profile dot1p-priority
      dot1p-out-profile dot1p-priority
      dscp-in-profile dscp-name
      dscp-out-profile dscp-name
      lsp-exp-in-profile lsp-exp-value
      lsp-exp-out-profile lsp-exp-value
      port-redirect-group {queue queue-id | policer 
        plcr-id [queue queue-id]}
prec dscp-name fc fc-name profile {in | out | exceed 
  | inplus}
  remarking
ip-criteria
  entry entry-id [create]
    action [fc fc-name profile {in | out | exceed 
      | inplus}]
      [port-redirect-group {queue queue-id | 
        policer policer-id [queue queue-id]}]
    description description-string
    match [protocol protocol-id]
      dscp dscp-name
      dst-ip {ip-address/mask | ip-address ipv4-
        address-mask}
      dst-port [{lt | gt | eq} {dst-port-number | 
        range start end}]
      fragment {true | false}
      icmp-type icmp-type
      src-ip {ip-address/mask | ip-address ipv4-
        address-mask}
      src-port [{lt | gt | eq} {src-port-number | 
        range start end}]
   renum old-entry-id new-entry-id
ipv6-criteria
  entry entry-id [create]
    action fc fc-name profile {in | out |exceed | 
      inplus}]
      [port-redirect-group {queue queue-id | 
        policer policer-id [queue queue-id]}]
    description description-string
    match [next-header next-header]
      dscp dscp-name
      dst-ip {ipv6-address/mask | ipv6-address
ipv6-address-mask}
      dst-port [{lt | gt | eq} {dst-port-number | 
        range start end}]
      fragment {true | false | first-only | non-
        first-only}
      src-ip {ipv6-address/mask | ipv6-address
ipv6-address-mask}
      src-port [{lt | gt | eq} src-port-number 
      src-port range start end
   renum old-entry-id new-entry-id
 ler-use-dscp
 lsp-exp lsp-exp-value fc fc-name profile {in | out}
scope {exclusive | template}

A:ALA-10:A:ALA-12>config>qos# info
#------------------------------------------
echo "QoS Policy Configuration"
#------------------------------------------
...
     network 600 create
            description "Network Egress Policy"
            ingress
                default-action fc ef profile in
            exit
            egress
                remarking
            exit
        exit
...
#------------------------------------------
A:ALA-12>config>qos#

Use the following CLI syntax to apply network policies to the router access uplink port’s IP interfaces:

config>router
interface interface-name
  qos network-policy-id

The following output displays the configuration for router interface ALA-1-2 with network policy 600 applied to the interface.

A:ALA-7>config>router# info
#------------------------------------------
echo "IP Configuration"
#------------------------------------------
...
        interface "ALA-1-2"
            address 10.10.4.3/24
            qos 600
        exit
...
----------------------------------------------
A:ALA-7>config>router#

The default network policy for IP interfaces is identified as policy ID 1. Default policies cannot be modified or deleted. Network policy defaults lists default network policy parameters.

The following output displays the default configuration:

A:ALA-49>config>qos>network# info detail
----------------------------------------------
            description "Default network QoS policy."
            scope template
            ingress
                default-action fc be profile out
                no ler-use-dscp
                dscp be fc be profile out
                dscp ef fc ef profile in
                dscp cs1 fc l2 profile in
                dscp nc1 fc h1 profile in
                dscp nc2 fc nc profile in
                dscp af11 fc af profile in
                dscp af12 fc af profile out
                dscp af13 fc af profile out
                dscp af21 fc l1 profile in
                dscp af22 fc l1 profile out
                dscp af23 fc l1 profile out
                dscp af31 fc l1 profile in
                dscp af32 fc l1 profile out
                dscp af33 fc l1 profile out
                dscp af41 fc h2 profile in
                dscp af42 fc h2 profile out
                dscp af43 fc h2 profile out
                lsp-exp 0 fc be profile out
                lsp-exp 1 fc l2 profile in
                lsp-exp 2 fc af profile out
                lsp-exp 3 fc af profile in
                lsp-exp 4 fc h2 profile in
                lsp-exp 5 fc ef profile in
                lsp-exp 6 fc h1 profile in
                lsp-exp 7 fc nc profile in
            exit
            egress
                no remarking
                fc af
                    dscp-in-profile af11
                    dscp-out-profile af12
                    lsp-exp-in-profile 3
                    lsp-exp-out-profile 2
                    dot1p-in-profile 2
                    dot1p-out-profile 2
                exit
                fc be
                    dscp-in-profile be
                    dscp-out-profile be
                    lsp-exp-in-profile 0
                    lsp-exp-out-profile 0
                    dot1p-in-profile 0
                    dot1p-out-profile 0
                exit
                fc ef
                    dscp-in-profile ef
                    dscp-out-profile ef
                    lsp-exp-in-profile 5
                    lsp-exp-out-profile 5
                    dot1p-in-profile 5
                    dot1p-out-profile 5
                exit
                fc h1
                    dscp-in-profile nc1
                    dscp-out-profile nc1
                    lsp-exp-in-profile 6
                    lsp-exp-out-profile 6
                    dot1p-in-profile 6
                    dot1p-out-profile 6
                exit
                fc h2
                    dscp-in-profile af41
                    dscp-out-profile af42
                    lsp-exp-in-profile 4
                    lsp-exp-out-profile 4
                    dot1p-in-profile 4
                    dot1p-out-profile 4
                exit
                fc l1
                    dscp-in-profile af21
                    dscp-out-profile af22
                    lsp-exp-in-profile 3
                    lsp-exp-out-profile 2
                    dot1p-in-profile 3
                    dot1p-out-profile 3
                exit
                fc l2
                    dscp-in-profile cs1
                    dscp-out-profile cs1
                    lsp-exp-in-profile 1
                    lsp-exp-out-profile 1
                    dot1p-in-profile 1
                    dot1p-out-profile 1
                exit
                fc nc
                    dscp-in-profile nc2
                    dscp-out-profile nc2
                    lsp-exp-in-profile 7
                    lsp-exp-out-profile 7
                    dot1p-in-profile 7
                    dot1p-out-profile 7
                exit
            exit
----------------------------------------------
A:ALA-49>config>qos>network#

A network policy is associated by default with router interfaces.

The default policy can be replaced with a non-default policy but cannot be removed from the configuration. When a non-default policy is removed, the policy association reverts to the appropriate default network policy.

config>router
interface interface-name
  qos network-policy-id

The following output displays an example configuration.

A:ALA-7>config>router# info
#------------------------------------------
echo "IP Configuration"
#------------------------------------------
...
        interface "ALA-1-2"
            address 10.10.4.3/24 broadcast host-ones
            no port
            no arp-timeout
            no allow-directed-broadcasts
            icmp
                mask-reply
                redirects 100 10
                unreachables 100 10
                ttl-expired 100 10
            exit
            qos 1
            ingress
                no filter
            exit
            egress
                no filter
            exit
            no mac
            no cflowd
            no shutdown
        exit
        interface "ALA-1-3"
...
#------------------------------------------
A:ALA-7>config>router# 

To delete a network policy, enter the following command:

config>qos# no network network-policy-id

An existing network policy can be copied to a new policy ID value or overwrite an existing policy ID. The overwrite option must be specified or an error occurs if the destination policy ID exists.

config>qos# copy network source-policy-id dest-policy-id [overwrite]

The following output displays the copied policies:

A:ALA-12>config>qos# info detail
---------------------------------------------
...
        network 1 create
            description "Default network QoS policy."
            scope template
            ingress
                default-action fc be profile out
                dscp be fc be profile out
                dscp ef fc ef profile in
                dscp cs1 fc l2 profile in
                dscp nc1 fc h1 profile in
                dscp nc2 fc nc profile in
                dscp af11 fc af profile in
                dscp af12 fc af profile out
                dscp af13 fc af profile out
                dscp af21 fc l1 profile in
                dscp af22 fc l1 profile out
...
        network 600 create
            description "Default network QoS policy."
            scope template
            ingress
                default-action fc be profile out
                dscp be fc be profile out
                dscp ef fc ef profile in
                dscp cs1 fc l2 profile in
                dscp nc1 fc h1 profile in
                dscp nc2 fc nc profile in
                dscp af11 fc af profile in
                dscp af12 fc af profile out
                dscp af13 fc af profile out
                dscp af21 fc l1 profile in
                dscp af22 fc l1 profile out
...
        network 700 create
            description "Default network QoS policy."
            scope template
            ingress
                default-action fc be profile out
                dscp be fc be profile out
                dscp ef fc ef profile in
                dscp cs1 fc l2 profile in
                dscp nc1 fc h1 profile in
                dscp nc2 fc nc profile in
                dscp af11 fc af profile in
                dscp af12 fc af profile out
                dscp af13 fc af profile out
                dscp af21 fc l1 profile in
                dscp af22 fc l1 profile out
...
---------------------------------------------
A:ALA-12>config>qos# 

Existing policies, except the default policies and entries in the CLI, can be changed. The changes are applied immediately to all interfaces where the policy is applied. To prevent configuration errors, use the copy command to make a duplicate of the original policy in a work area, make the edits, then overwrite the original policy.