manualshive.com logo in svg

Nortel 5510, Инструкция по эксплуатации

Поделиться
Скачать
Nortel 5510 Скачать руководство пользователя страница 51

Filters and QoS Configuration for ERS 5500 
Technical Configuration Guide   

   

  

v2.0 

              

 

 

 NN48500-559   

 
 

___________________________________________________________________________________________________________________________ 

Nortel Confidential Information   Copyright © 2008 Nortel Networks. All Rights Reserved. 

 
 

 

 

 

 

External Distribution

 

 

 

 

                              50

 

12.3 Configuration Example – IP ACL, DHCP Snooping, 

ARP Inspection, BPDU Filtering, and Source Guard 

 

Figure 4: IP ACL, DHCP Snooping, ARP Inspection, and Source Guard 

Overall, we wish to accomplish the following in regards to VLAN 110: 

•

 

Only allow ICMP and DHCP traffic to the DHCP server (172.30.30.50) and deny all other 
traffic to the 172.x.x.x network 

•

 

For the 10.x.x.x network, only allow access to the local network (10.62.32.0/24) and to 
the 10.10.30/0/24 network for full access to the internet 

•

 

Enable DHCP Snooping, ARP-Inspection, and  

In regards to VLAN 220, we wish to accomplish the following: 

•

 

Allow full access to the core network 172.0.0.0/8 and 10.0.0.0/8 

•

 

Only allow only ICMP, HTTP and HTTPS traffic to the internet 

12.3.1 ERS5500 Configuration 

12.3.1.1  Create VLAN’s and Add Port Members 

ERS5500:  Step 1 – Add VLANs 110, 220, and 700  

5500(config)#

vlan create 700 name core type port 

5500(config)#

vlan create 110 type port 

5500(config)#

vlan create 220 type port 

5500(config)#

vlan members remove 1 3-6,8-10,23 

5500(config)#

vlan ports 23 tagging tagall 

5500(config)#

vlan members 110 3-6 

5500(config)#

vlan members 220 8-10 

5500(config)#

vlan members 700 23

 

12.3.1.2  Add IP Address and Enable OSPF 

ERS5500:  Step 1 – Add IP address to VLAN 110 and enable OSPF with interface type of 
passive 

Содержание 5510

Страница 1: ...10 5520 5530 Engineering Filters and QOS Configuration for Ethernet Routing Switch 5500 Technical Configuration Guide Enterprise Solutions Engineering Document Date April 01 2008 Document Number NN48500 559 Document Version 2 0 ...

Страница 2: ...ers innovative technology solutions encompassing end to end broadband Voice over IP multimedia services and applications and wireless broadband designed to help people solve the world s greatest challenges Nortel does business in more than 150 countries For more information visit Nortel on the Web at www nortel com Copyright 2008 Nortel Networks All Rights Reserved While the information in this do...

Страница 3: ...______________________ Nortel Confidential Information Copyright 2008 Nortel Networks All Rights Reserved External Distribution 2 Abstract This technical configuration guide provides an overview on how to configure QoS and Filters on the Ethernet Routing Switch 5500 with software release 5 1 The configuration examples are all in reference to the Nortel Networks Command Line Interface NNCLI ...

Страница 4: ...TERFACE SHAPER 22 6 DEFAULT NORTEL CLASS OF SERVICE 24 7 QOS ACCESS LISTS ACL 25 7 1 ACL CONFIGURATION 25 8 IP SECURITY FEATURES 30 8 1 DHCP SNOOPING 30 8 2 DYNAMIC ARP INSPECTION 30 8 3 IP SOURCE GUARD 31 9 BPDU FILTERING 32 9 1 BPDU FILTERING CONFIGURATION 32 10 QOS INTERFACE APPLICATIONS 33 10 1 ARP SPOOFING 34 10 2 DHCP ATTACKS 35 10 3 DOS 36 10 4 BPDU BLOCKING 37 11 CONFIGURATION STEPS POLICY...

Страница 5: ... Figures Figure 1 QoS System Diagram 6 Figure 2 QoS Flow Chart 9 Figure 3 Arp Spoofing Example 34 Figure 4 IP ACL DHCP Snooping ARP Inspection and Source Guard 50 Figure 5 L2 Classification Based on MAC Address Example 62 Figure 6 DSCP Mapping via Un restricted Port Role 66 List of Tables Table 1 Default QoS Action 7 Table 2 Example of Valid Port Ranges 11 Table 3 Default Policy Drop Action 12 Tab...

Страница 6: ...ns used in this document Symbols Tip Highlights a configuration or technical tip L Note Highlights important information to the reader 1 Warning Highlights important information about an action that may result in equipment damage configuration or data loss Text Bold text indicates emphasis Italic text in a Courier New font indicates text the user must enter or select in a menu item button or comma...

Страница 7: ...riate egress queue Figure 1 QoS System Diagram Role Combination A role combination is a grouping of one or more ports capabilities and interface classifications against which a policy is applied The capabilities presently supported on the Ethernet Routing Switch 5500 include ingress IP and Layer 2 classification The Ethernet Routing Switch 5500 supports the following interface classes that can be ...

Страница 8: ...about the origin of the incoming traffic You may assign an action to set the DSCP or not to set the DSCP it s up to you This allows you to manipulate the DSCP value based upon the filter criteria and not upon the point of origin The following table displays a summary of the role combination capabilities Table 1 Default QoS Action Type of Filter Action Trusted Untrusted Unrestricted DSCP Does not c...

Страница 9: ... certain classification criteria various actions can be initiated In profile actions metered traffic within specific bandwidth limits o Drop o Update DSCP o Update 802 1p o Drop precedence choice of low drop high drop or use egress map Out of profile actions metered traffic exceeding bandwidth limits o Drop o Update DSCP o Set drop precedence Non Match actions non metered traffic o Drop o Update D...

Страница 10: ... basis Or you can group a number of Classifiers into a Classifier Block and then add the Classifier Block to a Policy on a per port basis The Ethernet Routing Switch 5500 supports up to 114 Classifiers per port for a total of greater than 40K Classifiers in a fully configured stack Figure 2 QoS Flow Chart Role Combination Application QoS Devices Interface Configuration Role Combination Interface C...

Страница 11: ...rofile packets Associating a block of classifiers with a policy indicating that statistics are to be maintained could consume all counting resources for a single interface with one policy To avoid exhausting the number of counters available per interface one may select aggregate classifier tracking instead of individual classifier tracking when creating the policy By specifying aggregate classifie...

Страница 12: ...nge support is limited to a certain extent however because ranges are represented as a bitmask within the overall classification mask and not with explicit minimum and maximum values A range must thus be specified by indicating which bits in the given field e g Layer 4 source port are ignored i e set to 0 Taking into account this limitation the following rules are used to determine valid range val...

Страница 13: ...en a policy references a classifier block and members of the referenced block identify their own action or meter criteria action and meter data must not be specified by the policy The actions applied to packets include those actions defined from user defined policies and those actions defined from system default policies The user defined actions always carry a higher precedence than the system def...

Страница 14: ...t similar to stop on match you will have to create a new action with a drop action of dontDrop JDM or disable CLI Statistics accumulation support a limited number of counters are available for tracking statistics Specifically 32 counters are available per port for tracking matching no metering specified in profile metering specified traffic statistics A total of 63 counters are available per port ...

Страница 15: ...o any port Note that the switch must be rebooted if any changes are made Table 4 Ethernet Routing Switch 5500 Resource Sharing Setting Description Regular 1 port may use up to 16 of the buffers for a group of 12 ports Large 1 port may use up to 33 of the buffers for a group of 12 ports Maximum 1 port may use 100 of the buffers for a group of 12 ports Resource Sharing Commands 5520 24T PWR config q...

Страница 16: ...you have 5 or more ports connected per group of 12 ports Egress CoS Queuing The following charts describe each possible egress CoS queuing setting The mapping of 802 1p priority to egress CoS queue dequeuing algorithm and queue weight is given Additionally the memory and maximum number of packets which can be buffered per egress CoS queue and resource sharing settings is shown Table 5 Ethernet Rou...

Страница 17: ...B 31232B 92800B 2 6 6 12 20 61 1 18432B 31232B 86400B 0 7 3 12 20 56 36864B 51200B 163840B 7 1 Strict 100 24 33 107 33792B 49152B 151040B 6 2 52 22 32 99 31744B 47104B 137472B 5 3 24 20 31 90 26624B 43008B 124160B 4 4 14 17 28 81 3 21504B 37376B 111360B 2 5 7 14 24 73 1 18432B 34304B 98560B 6 CoS 0 6 Weighted Round Robin 3 12 22 64 46080B 64000B 199680B 7 1 Strict 100 30 42 131 41984B 59904B 18176...

Страница 18: ... 1 2 Weighted Round Robin 100 40 53 172 7 6 5 4 131072B 262144B 786432B 1 CoS 3 1 Strict 100 86 172 518 Egress CoS Queuing CLI Commands 5520 24T PWR config show qos queue set assignment The show qos queue set assignment command displays in the CLI the 802 1p priority to egress CoS and QoS queue mapping for CoS setting 1 8 This command is in the CLI priv exec mode 5520 24T PWR config show qos queue...

Страница 19: ...ss CoS and QoS queue set The default CoS QoS queue mode is 8 This command is in the CLI priv exec mode 5520 24T PWR config show qos agent The show qos agent command displays the current attributes for egress CoS and QoS queue mode resource sharing mode and QoS NVRAM commit delay This command is in the CLI priv exec mode 5520 24T PWR config qos agent nvram delay The qos agent nvram delay command wi...

Страница 20: ...ucket sizes are supported on the ERS5530 only via the 10 GigE interface The token bucket allows a committed burst to occur up to the token bucket size For traffic metering an in profile and an out of profile action is configured and is expressed as an id You can use one of the default actions or create a new action prior to configuring a meter To view the action id s please use the command shown b...

Страница 21: ...8 10 GigE 5530 5 2 Policing Traffic When configuring traffic policing the committed rate burst rate and burst duration can be configured using the following command 5530 24TFD config qos meter 1 55000 committed rate 64 10230000 Kbits sec max burst rate 64 4294967295 Kbits sec max burst duration 1 4294967295 Milliseconds in profile action 1 55000 out profile action 1 1 9 55000 QoS parameters Parame...

Страница 22: ...o it does not matter what value you enter for the maximum burst rate as long as it is larger than the committed rate Example Let s assume you wish to set the committed rate to 10M and set the committed burst bucket size to 128K We also wish to mark all in profile traffic to Bronze and drop all out of profile traffic To accomplish this please use the following commands 1 Calculate the duration expr...

Страница 23: ... shape rate burst rate and burst duration can be configured using the following command 5530 24TFD config interface fastEthernet all 5530 24TFD config if qos if shaper port port shape rate 64 10230000 Kbits sec max burst rate 64 4294967295 Kbits sec max burst duration 1 4294967295 milliseconds QoS interface shaping parameters Parameter Description portlist Ports to configure shaping parameters WOR...

Страница 24: ... s assume you wish to set the committed rate to 40M and set the bucket size to 4K for port 8 To accomplish this please use the following commands 1 Calculate the duration expressed in milliseconds Using the actual bucket size from table 7 and a maximum burst rate of 50M Duration bucketSize 8 max burst rate committed rate Duration 4 096 8 50 000 000 40 000 000 Duration 3 2768 ms Rounded down the du...

Страница 25: ...wing table shows the default Nortel Class of Service marking Table 9 Default Nortel CoS Markings DSCP Hex Decimal TOS Binary NNSC PHB 0x0 0 0x0 000000 00 CS0 0x0 0 0x0 000000 00 Standard DE 0x8 8 0x20 001000 00 CS1 0xA 10 0x28 001010 00 Bronze AF11 0x10 16 0x40 010000 00 CS2 0x12 18 0x48 010010 00 Silver AF21 0x18 24 0x60 011000 00 CS3 0x1A 26 0x68 011010 00 Gold AF31 0x20 32 0x80 100000 00 CS4 0x...

Страница 26: ... subsequent precedence values for the ACL s You cannot assign traffic meters IP and L2 ACL s cannot be combined If you wish to combine L2 and L3 policies must be used ACL s cannot be modified you must first remove the ACL assign configuration at a port level then delete the ACL or ACL s you wish to modify and reconfigure the ACL or ACL s ACL s can be enabled or disabled However you cannot update o...

Страница 27: ... 1 3 ACL Assign Configuration Once you have completed the ACL configuration the ACL name is then assigned at a port level using the following command 5500 config qos acl assign port port or port s acl type ip l2 name acl name 7 1 4 ACL Configuration Example 7 1 4 1 Configuration Assuming we wish to configure the following remark host 172 1 1 10 ftp traffic to CoS class of Silver remark host 172 1 ...

Страница 28: ...l 5530H 24TFD show qos ip acl Name host Block tcpcommon Address Type IPv4 Destination Addr Mask Ignore Source Addr Mask 172 1 1 10 32 DSCP Ignore IPv4 Protocol IPv6 Next Header TCP Destination L4 Port Min Ignore Destination L4 Port Max Ignore Source L4 Port Min 21 Source L4 Port Max 21 IPv6 Flow Id Ignore Action Drop No Action Update DSCP 0x12 Action Update 802 1p Priority Ignore Action Set Drop P...

Страница 29: ...e Enabled Classifier Type Block Classifier Name UntrustedClfrs1 Classifier Id 55001 Role Combination allQoSPolicyIfcs Meter Meter Id In Profile Action UntrustedClfrs1 In Profile Action Id 55001 Non Match Action Non Match Action Id Track Statistics Aggregate Precedence 2 Session Id 0 Storage Type Other Id 55002 Policy Name UntrustedClfrs2 State Enabled Classifier Type Block Classifier Name Untruste...

Страница 30: ...CL Assuming we wish to change the http marking from CoS level of Gold to CoS level of Bronze enter the following command shown below From using the show command above we know that port 1 19 as been assigned ACL Assign ID of 1 Hence we need to remove this id first using the following command 5500 config no qos acl assign 1 or if you wish to remove the setting on an individual port we only used one ...

Страница 31: ...he DHCP snooping binding table on untrusted ports to verify the traffic entering a port by comparing the source MAC address against the DHCP lease IP address If there is no match the packet is dropped 8 1 1 DHCP Snooping Configuration To enable DHCP snooping enter the following command assuming we wish to enable DHCP snooping on VLANs 100 and 200 and the uplink port is 1 24 5500 config ip dhcp sno...

Страница 32: ...Guard IP source guard works together with the DHCP snooping binding table by providing security against invalid source IP addresses If enabled the source IP address is checked against the source IP address in the binding table on untrusted ports If the incoming source IP address does not match the IP address in the binding table the packet is dropped Please note that manual static assignment of IP...

Страница 33: ...n addition to BPDU filtering If you select to shut down the port forever manual intervention is required to bring the port back up by disabling and then re enabling the port state BPDU filter is enabled at an interface level using the following commands 5520 1 config if spanning tree bpdu filtering timeout 10 65535 seconds or 0 for infinity 5520 1 config if spanning tree bpdu filtering enable 9 1 ...

Страница 34: ...Spoofing SQLSlam Nachia Xmas TCP SynFinScan TCP FtpPort TCP DnsPort BPDU Blocker When using any of the QoS applications listed above a number of classifiers are required per QoS applications Please refer to table 10 shown below Table 10 QoS Applications Number of Classifiers Used Feature Number of Classifiers ARP Spoofing 5 DHCP Snooping 1 DHCP Spoofing 2 DoS SQLSlam 1 DoS Nachia 1 DoS Xmas 1 DoS ...

Страница 35: ...e to prevent ARP MAC spoofing using off set filters to block any gratuitous ARPs gARP Basically you have to allow broadcast ARP block any ARP messages using the source IP or target IP of the default gateway and then allow ARP reply these filters should not be applied to the router port s only on the user ports In the 4 2 release or higher a new command has been added to prevent ARP Spoofing betwee...

Страница 36: ...nooping QoS Application operates by classifying ports as access untrusted and core trusted and only allowing DHCP requests from the access ports All other types of DHCP messages received on access ports are discarded This prevents rogue DHCP servers from being set up by attackers on access ports and generating DHCP responses that provide the rogue server s address for the default gateway and DNS s...

Страница 37: ...e of 376 byte UDP packets These packets will appear to be originating from seemingly random IP addresses and destined for UDP port 1434 When enabled the DoS SQLSlam QoS Application will drop UDP traffic whose destination port is 1434 with the byte pattern of 0x040101010101 starting at byte 47 of a tagged packet Nachia The W32 Nachi variants W32 Nachi A and W32 Nachi B are worms that spread using t...

Страница 38: ...7 10 4 BPDU Blocking There are certain scenarios in a bridged switched environment when the user may wish to drop incoming BPDUs on a specific interface When enabled the BPDU Blocker QoS Application will drop traffic with a specific multicast destination MAC address Currently targeted BPDU multicast destination addresses are 01 80 c2 00 00 00 and 01 00 0c cc cc cd The following commands are used t...

Страница 39: ...nfiguring a policy an interface group will be assigned to the policy To add a new role combination complete the following steps a Add a new Interface Group ERS5500 48T config qos if group name name class trusted unrestricted untrusted b Assign the physical ports to the Interface Group ERS5500 48T config qos if assign port port name if group name Example ERS5500 48T config qos if group name role_on...

Страница 40: ...a port a Adding IP and L2 Element IP Element To add an IP element enter the following command ERS5500 48T config qos ip element 1 64000 addr type Specify the address type IPv4 IPv6 classifier criteria ds field Specify the DSCP classifier criteria dst ip Specify the destination IP classifier criteria dst port min Specify the L4 destination port minimum value classifier criteria flow id Specify the ...

Страница 41: ...ier 1 64000 set id 1 64000 name name element type ip l2 element id 1 64000 Where element id IP element or L2 element ID Example Adding an IP element to a classifier ERS5500 48T config qos classifier 1 set id 1 name class_1 element type ip element id 1 Adding an IP element and a L2 element to a classifier ERS5500 48T config qos classifier 2 set id 2 name class_2 element type ip element id 2 ERS5500...

Страница 42: ...0 Priority 7 Low Drop ReadOnl 9 Null_Action DPass Ignore Ignore Low Drop ReadOnl 64001 UntrustedClfrs1 DPass Ing 1p Ignore Low Drop Other 64002 UntrustedClfrs2 DPass 0x0 Priority 0 High Drop Other QoS Meter Command Parameters Parameters and variables Description metid Enter an integer to specify the QoS meter range is 1 to 64000 name metname Specify name for meter maximum is 16 alphanumeric charac...

Страница 43: ... 1 64000 in profile action 1 64000 non match action 1 64000 precedence 3 10 track statistics individual aggregate NOTE Instead of clfr id you can also enter the classifier or classifier block name by using clfr name b To assign a Classifier to a new Policy with a meter enter the following command ERS5500 48T config qos policy 1 64000 name name if group if group name clfr type block classifier clas...

Страница 44: ...__ _____ ______ ____________ ___________ _________ _______ 1 Drop_Traffic Yes Ignore Ignore High Drop ReadOnl 2 Standard_Service No 0x0 Priority 0 High Drop ReadOnl 3 Bronze_Service No 0xA Priority 2 Low Drop ReadOnl 4 Silver_Service No 0x12 Priority 3 Low Drop ReadOnl 5 Gold_Service No 0x1A Priority 4 Low Drop ReadOnl 6 Platinum_Service No 0x22 Priority 5 Low Drop ReadOnl 7 Premium_Service No 0x2...

Страница 45: ...NOTE As all three classifiers use the same mask we will create a classifier block to group all three classifiers L At this time it is only possible to configure traffic meters using policies It is not possible to add traffic meters via ACL s 12 2 1 ERS5500 Configuration Using Policies 12 2 1 1 Configure the Interface Role Combination For this example we will configure a new role combination with p...

Страница 46: ...ure Meters As mentioned in section 5 2 above if we do not configure a maximum duration rate the committed burst will be automatically set to the maximum value For all 10 100 Mbps and 1 GigE Ethernet ports the maximum committed burst is 524 288 bytes Hence it does not matter what value you enter for the max burst rate as long is it is greater than the committed rate ERS5500 Step 1 Create the QoS me...

Страница 47: ...vidual 12 2 2 Verify Operations 12 2 2 1 Verify the Role Combination Step 1 Verify that the if group has been configured correctly ERS5500 24T show qos if group Result Role Interface Capabilities Storage Combination Class Type ________________________________ ____________ ___________________ ___________ allQoSPolicyIfcs Untrusted Input 802 Input IP ReadOnly unrestricted Unrestricted Input 802 Inpu...

Страница 48: ...rt Min 69 Destination L4 Port Max 69 Source L4 Port Min Ignore Source L4 Port Max Ignore Session Id 0 Storage Type NonVolatile Id 3 Address Type IPv4 Destination Addr Mask Ignore Source Addr Mask Ignore DSCP Ignore IPv6 Flow Id Ignore IPv4 Protocol IPv6 Next Header UDP Destination L4 Port Min 137 Destination L4 Port Max 137 Source L4 Port Min Ignore Source L4 Port Max Ignore Session Id 0 Storage T...

Страница 49: ...ession Id 0 Storage Type NonVolatile Id 3 Name m3 Commit Rate 1000 Kbps Commit Burst 524288 Bytes In Profile Action Standard_Service Out Profile Action Drop_Traffic Session Id 0 Storage Type NonVolatile Step 3 Verify that the Classifier Block with the correct classifier and meter number ERS5500 24T show qos classifier block Result Id 1 Block Name b1 Block Number 1 Classifier Name c1 Classifier Set...

Страница 50: ...rtel Networks All Rights Reserved External Distribution 49 12 2 3 1 Verify Policy Configuration Step 1 Verify that the QoS Policy ERS5500 24T show qos policy Result Policy Name policy1 State Enabled Classifier Type Block Classifier Name b1 Classifier Id 1 Role Combination q2 Meter Meter Id In Profile Action In Profile Action Id Non Match Action Standard_Service Non Match Action Id 2 Track Statisti...

Страница 51: ...ly allow access to the local network 10 62 32 0 24 and to the 10 10 30 0 24 network for full access to the internet Enable DHCP Snooping ARP Inspection and In regards to VLAN 220 we wish to accomplish the following Allow full access to the core network 172 0 0 0 8 and 10 0 0 0 8 Only allow only ICMP HTTP and HTTPS traffic to the internet 12 3 1 ERS5500 Configuration 12 3 1 1 Create VLAN s and Add ...

Страница 52: ... 5500 config if exit ERS5500 Step 3 Add IP address to VLAN 700 and enable OSPF 5500 config interface vlan 700 5500 config if ip address 10 95 101 3 255 255 255 0 5500 config if ip ospf enable 5500 config if exit 12 3 1 3 Enable IP Routing and OSPF Globally ERS5500 Step 1 Enable IP routing and OSPF Globally 5500 config ip routing 5500 config router ospf enable 12 3 1 4 Enable DHCP Relay ERS5500 Ste...

Страница 53: ... for VLAN s 110 and 220 and enable DHCP Snooping globally 5500 config ip dhcp snooping vlan 110 5500 config ip dhcp snooping vlan 220 5500 config ip dhcp snooping enable ERS5500 Step 1 Enable ARP Inspection for VLAN s 110 and 220 5500 config ip arp inspection vlan 110 5500 config ip arp inspection vlan 220 12 3 1 7 Enable IP Source Guard ERS5500 Step 1 Enable IP Source Guard on access port members...

Страница 54: ...protocol 17 refers to UDP 12 3 1 9 Create ACL s for VLAN 220 Port Members ERS5500 Step 1 Create IP ACL s pertaining to VLAN 220 VLAN port members 5500 config qos ip acl name two dst ip 10 0 0 0 8 block b3 5500 config qos ip acl name two dst ip 172 0 0 0 8 block b3 5500 config qos ip acl name two protocol 6 dst port min 80 dst port max 80 block b4 5500 config qos ip acl name two protocol 6 dst port...

Страница 55: ... the following command assuming we have port member on ports 6 and 9 ERS5500 24T show ip dhcp snooping binding Result MAC IP Lease sec VID Port 00 50 8b e1 58 e8 10 62 32 10 691200 110 6 00 02 a5 e9 00 28 10 13 196 10 691200 220 9 Total Entries 2 12 3 2 2 Verify ARP Inspection Step 1 Verify that ARP Inspection is enabled for VLAN s 110 and 220 ERS5500 24T show ip arp inspection vlan Result ARP VLA...

Страница 56: ...tion Step 1 To view the IP ACL configuration enter the following command ERS5500 24T show qos ip acl Result Id 1 Name one Block Address Type IPv4 Destination Addr Mask 172 30 30 50 32 Source Addr Mask Ignore DSCP Ignore IPv4 Protocol IPv6 Next Header ICMP Destination L4 Port Min Ignore Destination L4 Port Max Ignore Source L4 Port Min Ignore Source L4 Port Max Ignore IPv6 Flow Id Ignore Action Dro...

Страница 57: ...ation Addr Mask 10 62 32 0 24 Source Addr Mask Ignore DSCP Ignore IPv4 Protocol IPv6 Next Header Ignore Destination L4 Port Min Ignore Destination L4 Port Max Ignore Source L4 Port Min Ignore Source L4 Port Max Ignore IPv6 Flow Id Ignore Action Drop No Action Update DSCP Ignore Action Update 802 1p Priority Ignore Action Set Drop Precedence Low Drop Type Access List Storage Type NonVolatile Id 5 N...

Страница 58: ...ow Id Ignore Action Drop No Action Update DSCP Ignore Action Update 802 1p Priority Ignore Action Set Drop Precedence Low Drop Type Access List Storage Type NonVolatile Id 8 Name two Block b3 Address Type IPv4 Destination Addr Mask 10 0 0 0 8 Source Addr Mask Ignore DSCP Ignore IPv4 Protocol IPv6 Next Header Ignore Destination L4 Port Min Ignore Destination L4 Port Max Ignore Source L4 Port Min Ig...

Страница 59: ...ss Type IPv4 Destination Addr Mask Ignore Source Addr Mask Ignore DSCP Ignore IPv4 Protocol IPv6 Next Header TCP Destination L4 Port Min 443 Destination L4 Port Max 443 Source L4 Port Min Ignore Source L4 Port Max Ignore IPv6 Flow Id Ignore Action Drop No Action Update DSCP Ignore Action Update 802 1p Priority Ignore Action Set Drop Precedence Low Drop Type Access List Storage Type NonVolatile Id ...

Страница 60: ...7 with CoS level of Gold UDP dst port 2000 2047 with CoS level of Silver As mentioned in section 3 3 a port range must start with an even minimum number while the maximum number rightmost consecutive 0 s are replaced with 1 s The table shown below displays the valid ranges that can be configured Table 9 Port Range Protocol Port or Port Range Min Max Range Binary Value Valid Ranges Port Min 2n 1 TC...

Страница 61: ... max 127 ERS5500 Step 1 Create IP elements for UDP port range 2000 2027 5500 config qos ip element 3 protocol 17 dst port min 2000 dst port max 2015 5500 config qos ip element 4 protocol 17 dst port min 2016 dst port max 2047 12 4 1 3 Configure Classifiers one for each of the IP elements configured above ERS5500 Step 1 Create the an IP Classifier for each IP element created above 5500 config qos c...

Страница 62: ...ig qos ip acl name range protocol 6 dst port min 96 dst port max 127 update dscp 26 ERS5500 Step 2 Create IP ACL s for UDP port range 2000 2047 to remark traffic to CoS level of Silver DSCP decimal 18 5500 config qos ip acl name range protocol 17 dst port min 2000 dst port max 2015 update dscp 18 5500 config qos ip acl name range protocol 17 dst port min 2016 dst port max 2047 update dscp 18 ERS55...

Страница 63: ...re the Interface Role Combination ERS5500 Step 1 Create the Interface Role Combination and name is vlan_110 ERS5500 24T config qos if group name vlan_110 class unrestricted ERS5500 24T config qos if assign port 1 3 4 name vlan_110 12 5 1 2 Add new L2 element ERS5500 Step 1 Add an L2 element for VLAN 110 and specify MAC address 5500 config qos l2 element 1 src mac 00 00 0a 00 00 00 src mac mask ff ...

Страница 64: ... match action 3 precedence 11 12 5 2 ERS5500 Configuration Using IP ACL s 12 5 2 1 Create L2 ACL s for MAC Address Range ERS5500 Step 1 Create L2 ACL s for MAC address range 00 00 01 00 00 00 to 00 00 01 00 00 ff 5500 config qos l2 acl name vlan_110 src mac 00 00 0a 00 00 00 src mac mask fff fff f00 ethertype 0x800 update dscp 10 ERS5500 Step 2 Pass all other traffic with standard CoS 5500 config ...

Страница 65: ...omplish these tasks is to Create a Role Combination for port 1 3 Create the first classifiers element with host 1 s IP address and VLAN 110 and add to Classifier Block 1 with an in profile action of Gold Service Create a second classifier element with host 2 s IP address and VLAN 120 and add to Classifier Block 1 with an in profile action of Silver Service Create a Policy with Classifier block 1 a...

Страница 66: ... element 1 5500 config qos classifier 1 set id 1 name c1 element type ip element id 1 5500 config qos classifier 2 set id 1 name c1 element type l2 element id 1 ERS5500 Step 2 The next two commands add the second classifier with IP element 1 and L2 element 2 5500 config qos classifier 3 set id 2 name c2 element type ip element id 1 5500 config qos classifier 4 set id 2 name c2 element type l2 elem...

Страница 67: ...onfigure the ERS5500 to support internal QoS mapping for various DSCP values Figure 6 DSCP Mapping via Un restricted Port Role For this example assume we wish to accomplish the following in regarded to the untagged VLAN 5 ingress port members Set a port role of un restricted with port members 3 to 6 Select queue set 8 with 8 queues For ingress port members 3 5 we wish to map the following DSCP val...

Страница 68: ...cl name pbit drop action disable ERS5500 Step 2 Assign the IP ACL s to ports 3 5 5500 config qos acl assign port 3 5 acl type ip name pbit 12 7 3 Policy Configuration 12 7 3 1 IP Element Configuration ERS5500 Step 1 Create IP Classifiers 5500 config qos ip element 1 ds field 18 5500 config qos ip element 2 ds field 26 5500 config qos ip element 3 ds field 34 12 7 3 2 Configure Classifier and Class...

Страница 69: ...play the queue mapping pertaining to the ACL configuration from above Step 1 Use the following command to view the internal mapping of p bit to queue for queue set 8 note results are only shown for queue set 8 ERS5500 24T show qos queue set assignment Result Queue Set 8 802 1p Priority Queue _______________ _____ 0 8 1 7 2 6 3 5 4 4 5 3 6 1 7 2 Step 2 Use the following command to display queue set...

Страница 70: ... Shaping on Port 8 As mentioned in section 5 3 if you do not specify maximum burst duration the maximum bucket size will automatically be configured For a 10 100 Mbps or 1 GigE port the value will be 524 288 bytes Hence it does not matter what value you enter as the max burst rate as long as it is greater than the shaped rate ERS5500 Step 1 Configure port 8 with a committed shape rate of 40 Mbps a...

Страница 71: ...___________ Nortel Confidential Information Copyright 2008 Nortel Networks All Rights Reserved External Distribution 70 13 Software Baseline All configuration examples are based on software release 5 1 14 Reference Documentation Document Title Publication Number Description Configuration Quality of Service NN47200 504 217466 C Nortel Ethernet Routing Switch 5500 Series updated for software release...

Страница 72: ...f you purchased a Nortel Networks service program contact Nortel Technical Support To obtain contact information online go to www nortel com contactus From the Technical Support page you can open a Customer Service Request online or find the telephone number for the nearest Technical Solutions Center If you are not connected to the Internet call 1 800 4NORTEL 1 800 466 7835 to learn the telephone ...

Отзывы:

Нет отзывов

Бренды по названию

Популярные бренды

Загрузить еще бренды