QoS Deployment Scenarios

The QoS solution is extremely useful when organizations run into network congestion, or when they want to prioritize some network traffic over other traffic. Although this important feature can be deployed in many ways, this section covers two design scenarios for the ease of understanding:

• QoS for VoIP traffic
• QoS for the remote-access VPN tunnels

Note

The design scenarios discussed in this section should be used solely to enforce learning. They should be used for reference purposes only.

 

QoS for VoIP Traffic

SecureMe's information technology (IT) group is responsible for providing network services to its internal users. The IT group hosts an e-mail server and uses Cisco IP Phones for telecommunications. SecureMe management has some specific requirements that the IT group is obliged to meet:

• Full Internet web access to the internal clients. They should get bandwidth based on best effort and should be restricted to 56 kbps.
• For VoIP calls, there should not be any network-related delays.
• Do not allow Internet e-mail users to fully utilize the bandwidth when they download their e-mail using POP3. They should be restricted to have up to 56 kbps bandwidth. Additionally, restrict users to 56 kbps when they upload their e-mail via SMTP.
• Log all the system-generated syslog messages to a server.

Figure 12-6 shows SecureMe's topology that will be used to meet the network requirements.

Figure 12-6. SecureMe's VoIP and E-Mail QoS Policy

The administrator has put together the following list to meet the requirements:

• The administrator has set up five class maps to identify traffic.
• A class map called mail-pop is configured to classify all the packet sources from the mail server to the e-mail users when users download their emails using POP3.
• The second class map, called mail-smtp, identifies SMTP traffic from the e-mail users to the e-mail server when they upload their e-mails. The email server is translated to 209.165.200.231.
• The third class map, called web, classifies the web traffic destined to the Internet. The internal hosts are translated to the public interface's IP address.
• The last two class maps, voip-sig and voip-rtp, identify VoIP traffic.
• All class maps except for mail-smtp are linked to a policy map called voip-qos-policy, whereas the mail-smtp class is mapped to a policy map called SMTP-policy.

The voip-qos-policy policy map is applied to the outside interface and the SMTP-policy policy map is applied to the inside interface. Example 12-10 shows the relevant configuration of SecureMe's ASA to achieve the previously listed requirements.

Example 12-10. ASA's Full Configuration Showing QoS for VoIP

SecureMe# show run

ASA Version 7.0(1)

! ip address on the outside interface

interface GigabitEthernet0/0

 nameif outside

 security-level 0

 ip address 209.165.200.225 255.255.255.224

! ip address on the inside interface

interface GigabitEthernet0/1

 nameif inside

 security-level 100

 ip address 192.168.10.1 255.255.255.0

!

hostname SecureMe

!Access-list to classify Mail-traffic. SecureMe uses SMTP to upload emails

access-list Mail-ACL-in extended permit tcp any host 209.165.200.231 eq smtp

!Access-list to classify Mail-traffic. SecureMe uses POP3 to download emails

access-list Mail-ACL-out extended permit tcp host 209.165.200.231 eq pop3 any

!Access-list to classify Web-traffic to the internet.

access-list web-out extended permit tcp host 209.165.200.225 any eq www

!Syslog Server information to log the dropped packets.

logging enable

logging trap informational

logging host inside 192.168.10.101

!NAT configuration to allow inside hosts to get Internet connectivity

global (outside) 1 interface

nat (inside) 1 192.168.10.0 255.255.255.0

!Static address translation for the Mail-Server

static (inside,outside) 209.165.200.231 192.168.10.11 netmask 255.255.255.255

!

route outside 0.0.0.0 0.0.0.0 209.165.200.230 1

!Class-map to classify Mail traffic in the outbound direction

class-map mail-pop

 match access-list Mail-ACL-out

!Class-map to classify Mail traffic in the inbound direction

class-map mail-smtp

 match access-list Mail-ACL-in

!Class-map to classify Web traffic in the outbound direction

class-map web

 match access-list web-out

!Class-maps to classify VoIP traffic

class-map voip-sig

 match dscp af31

class-map voip-rtp

 match dscp ef

! Policy-map to define rules applied on traffic-class

policy-map voip-mail-qos-policy

! POP mail is rate-limited to 56kbps

 class mail-pop

 police 56000 10500

! VoIP signal is prioritized

 class voip-sig

 priority

! VoIP data is prioritized

 class voip-rtp

 priority

! Web-mail is rate-limited to 56kbps

class web

 police 56000 10500

! Policy-map to define rules applied on inbound mail (SMTP)

policy-map SMTP-policy

! SMTP mail is rate-limited to 56kbps

 class mail-smtp

 police 56000 10500

! Inspection Policies

policy-map global_policy

 class inspection_default

 inspect ctiqbe

 inspect http



 inspect xdmcp

 inspect icmp

! Global Policy  applied for traffic inspection

service-policy global_policy global

! QoS policy is applied to the outside interface

service-policy voip-mail-qos-policy interface outside

! QoS policy is applied to the inside interface

service-policy SMTP-policy interface inside



! Priority Queue is setup on the outside interface for QoS efficiency

priority-queue outside

 tx-ring-limit 100

 queue-limit 200

 

QoS for the Remote-Access VPN Tunnels

Figure 12-7 shows network topology for SecureMe's London's office. It has a Cisco ASA that it uses to provide VPN services for remote users. These users use the security appliance to connect to a file server to access their home directories. SecureMe does not want its broadband VPN users to fully utilize the bandwidth for its office. Therefore, it is interested in using QoS for the VPN tunnels to restrict the users to 256 kbps. SecureMe also hosts a web server at this location. However, it does not want to restrict the Internet web clients when they connect to the web server.

Figure 12-7. SecureMe Network Using QoS for VPN Tunnels

Note

Refer to Chapter 16, "Remote Access VPNs," for detailed VPN configuration examples.

Example 12-11 shows the running configuration of the security appliance in London. A class map called VPN-traffic is configured to match all the packets destined to the VPN group called SecureMeGroup. To provide Internet users access to the web server, another class map called web is set up. The traffic is matched against an ACL that is configured to identify TCP port 80 packets. Both of these classes are linked to a policy map called VPN-Policy, where the VPN traffic is rate-limited to 256 kbps for normal traffic with a burst rate of 48000 bytes. The security appliance is also configured to prioritize web traffic passing through it. The policy is then applied to the outside interface.

Example 12-11. Full Configuration of the ASA in Chicago Using QoS

London# show running

! ip address on the outside interface

interface GigabitEthernet0/0

 nameif outside

 security-level 0

 ip address 209.165.201.1 255.255.255.224

! ip address on the inside interface

interface GigabitEthernet0/1

 nameif inside

 security-level 100

 ip address 192.168.30.1 255.255.255.0

!

hostname London

!ACL to classify Web-traffic

access-list HTTP_ACL extended permit tcp host 209.165.201.2 eq www any

!ACL to bypass address translation for the traffic destined to the VPN clients

access-list nonat extended permit ip 192.168.30.0 255.255.255.0 192.168.50.0

255.255.255.0

!NAT 0 to bypass traffic identified in ACL nonat

nat (inside) 0 access-list nonat

!Static address translation for the web server

static (inside,outside) 209.165.201.2 192.168.30.10 netmask 255.255.255.255

! Local pool of addresses to be assigned to the VPN clients

ip local pool vpnpool 192.168.50.1-192.168.50.199

! sysopt to bypass traffic filters

sysopt connection permit-ipsec

! Transform set to specify encryption and hashing algorithm

! Crypto map configuration

crypto ipsec transform-set myset esp-aes-256 esp-sha-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map IPSec_map 10 ipsec-isakmp dynamic dynmap

crypto map IPSec_map interface outside

! isakmp configuration

isakmp enable outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption aes-256

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

! Remote Access tunnel-group configuration

tunnel-group SecureMeGroup type ipsec-ra

tunnel-group SecureMeGroup general-attributes

 address-pool vpnpool

tunnel-group SecureMeGroup ipsec-attributes

 pre-shared-key *

! Class-map to classify VPN packets

class-map VPN-traffic

 match flow ip destination-address

 match tunnel-group SecureMeGroup

!Class-map to classify Web traffic

class-map web

 match access-list HTTP_ACL

! Policy-map to define rules applied on traffic-class

policy-map VPN-Policy

 class VPN-traffic

 police 256000 48000

 class web

 priority

! Inspection Policies

policy-map global_policy

 class inspection_default

 inspect ctiqbe

 inspect http



 inspect xdmcp

 inspect icmp

! Global Policy  applied for traffic inspection

service-policy global_policy global

! Priority Queue is setup on the outside interface for QoS efficiency

priority-queue outside

 tx-ring-limit 100

 queue-limit 200

! QoS policy is applied to the outside interface

service-policy VPN-Policy interface outside