Page 2
Marks w ithout the express written permission of Avaya or the applicable third party. Avaya i s a regi s tered trademark of Avaya Inc.
Page 3
Filt Abstract This technical configuration guide provides an overview on how to configure QoS and Filters on the Ethernet Routing Switch 5500 with soft ware releas e 5.1. The configuration examples are all in reference to the A vaya Command Line Interface (A CLI).
Queue Sets ..........................16 Traffic Meter and Shaping .......................21 Actual Bucket Size ......................22 Policing Traffic ........................22 Interface Shaper ........................24 Default Avaya Class of Service....................26 QoS Access Li sts (ACL) ......................27 ACL Configuration......................27 IP Security Features ........................32 DHCP Snooping ........................32 Dynamic ARP Inspection ....................33 IP Sourc e Guard ........................33...
Page 5
Table 7: Actual Bucket Size in Bytes ....................22 Table 8: Met er Bucket Size and Duration ....................24 Table 9: Default Avaya CoS Markings ....................26 Table 10: QoS Applications – Number of Classifiers Used ..............35 Filters and QOS Configuration for Ethernet Routing Switch 5500...
Filt Document Updates Added ACL, DHCP Snooping, APP Inspection, BPDU Filtering and IP Source Guard. Conventions This section describes the text, image, and command conventions used in this document. Symbols: Tip – Highlights a configuration or technical tip.
Filt 1. Overview: Ethernet Routing Switch 5500 QoS and Filtering The Ethernet Routing Switch 5500 supports QoS and filter configuration via WEB, CLI, and Device Manager with no support for COPS at this time. As shown in the diagram below, the following functional...
Filt is not remark ed by default. However, a policy can still be applied to a trusted port to remark if required. Not e that only the 802.1p user priority value associated with „well-k nown‟ DS CP values are remapped by the default trusted polices. The „well-know‟ DSCP values can be viewed by using the ACLI command „show qos eqressmap‟.
Page 9
Filt IP Classifier Elements Source IP v4/ v6 host or subnet Destination IP v4/ v6 host or subnet IP v4/ v6 DSCP value IP v4 Protocol type, IP v6 next-header IP v4/ v6 Layer 4 (UDP/ TCP ) Source port – can be range of ports IP v4/ v6 Layer 4 (UDP/ TCP ) Destination port –...
Filt 2. QoS Flow Chart The following flowchart displays the various steps required in setting up a QoS policy. You basically now need to create a Classifier with each Classifier made up of one IP Classifier Element, or one L2 Classifier Element or one IP and one L2 Classifier Element.
Filt 3. Filter Functionality 3.1 Overall Classification Functionality Classification with the Ethernet Routing Switch 5500 has some fundamental classification limitations, imposed by hardware, that affect classification overall. The foremost limitation is relat ed to the concept, introduced by the lat est classification hardware and the support ing data model, of “classification masks”.
Filt a) IP Classifier #1: src IP = 10.1.1.0/24 b) IP Classifier #2: src IP = 10.20.0.0/16 c) IP Classifier #3: src IP = 172.1.1.0/24 d) IP Classifier #4: src IP = 10.22.0.0/16 e) IP Classifier #5: src IP = 10.1.2.0/24, dst IP = 192.1.1. 0/24 IP Classifier #6: src = 10.1.10.0/24...
Filt Table 2: Example of Valid Port Ranges Minimum Value (must Maximum Value Binary Value be even number) 1, 3, 7, 15, 31, 63, 127, 255, 511, 1025, 2047, 4095, 8191, 16355, 32762, or 65535 Min = 10 Max = 11...
Filt 3.4 Policies Packets received on an interfac e are matched against all policies associated with that interface. Henc e, all policies are applied to the packet. Policy precedence – the precedence attribute is used to specify the evaluation order of policies that apply to the same interfaces.
Filt Table 3: Default Policy Drop Action Name Drop Update DSCP User Priority Drop Precedence Drop_Traffic drop Ignore Ignore highDropPrec Don‟t Drop Standard_Service 0x00 Priority 0 highDropPrec Don‟t Drop Bronze_Service 0x0a Priority 2 lowDropPrec Don‟t Drop Silver_Service 0x12 Priority 3 lowDropPrec Don‟t Drop...
Filt 4. Queue Sets Prior to soft ware releas e 4.0, the Ethernet Routing Switch 5500 support ed a single queue set with eight queues, one absolut e queue and seven WRR queues. With the introduction of software release 4.0, eight different queue sets where made available. Each queue set has different characteristics in regards to number of queues and service weights allowing the user to select a queue set based on the user‟s particular needs.
Filt If you are using your 5520 for big file trans fers (like backup of servers) If you are using (the AppleTalk Filing Protocol) AFP, use large or maximum resource sharing (AFP use a fix windows size set to 65,535K).You should use the large resource sharing setting: If you are using your 5520 for high bandwidth application such as video.
Page 20
Filt The qos queue-s et-assignment queue-set <1-8> 1p <0-7> queue <1-8> command gives the us er the ability to specify the queue to associate an 802.1p priority. This command is in the CLI priv- exec mode. 5520-24T-PWR(config)# default qos agent queue-set The default qos agent queue-set command will default the egress CoS and QoS queue set.
Table 6: Meter and Shaping Range and Granularity Product Meter/Shaper Range Granularity Bucket Size ERS 5510 1 Mbps to 1023 Mbps 1 Mbps 8 buckets ERS 5520 1 Mbps to 1023 Mbps...
Filt 5.1 Actual Bucket Size When configuring a meter or shape rate, a fixed token bucket is also configured which is derived from the committed rate, burst rate, and burst duration configured. If a burst duration is not configured, the largest bucket size is automatically selected which would be 512K for a 10/100 Mbps or 1 GigE port.
Page 23
Filt in-profile-action-name Specify the in-profile action name. <WORD> out-profile-action Specify the out-of-profile action ID; range is 1, 9 to 55000. <1,9-55000> When configuring a meter, please note the following: The maximum burst rat e cannot be configured the same as the committed or metered rat e. You...
Filt The following table displays all various bucket size and duration values available using the committed and maximum burst values used in this example. Table 8: Meter Bucket Size and Duration Value to enter Bucket Size Max burst rate...
Page 25
Filt Bucket sizes in bytes are 4K, 8K, 16k, 32K, 64K, 128K, 256K, and 512K For the 10 GigE module only, available for the Ethernet Routing Switch 5530, it supports bucket sizes of 4K, 8K, 16K, 32K, 64K, 128K, 256K, 512K, 1024K, 2048K, 4096K, and 8192K.
Filt 6. Default Avaya Class of Service The following table shows the default A vay a Class of Service marking. Table 9: Default Avaya CoS Markings DSCP Binary NNS C Decimal 000000 00 Standard 000000 00 0x20 001000 00...
Filt 7. QoS Access Lists (ACL) As of software release 5.0, the ERS 55xx can be configured using access lists (ACL). You can choose to use policies and/or ACLs to configure the ERS 5500 switch. Up to a maximum of 15 precedence levels are supported using policies whereas ACL‟s allows up to a maximum of 8 precedence levels.
Page 28
Filt 7.1.2 L2-ACL Configuration L2 ACLs are added using the following command: 5500 (config)# qos l 2-acl name <1..16 character string> ? block Specify the label to identify access-list elements that are of the same block drop-action Specify the drop action...
Page 29
Filt 3. Protocol 6 refer to TCP traffic 4. The DS CP value are entered in decimal; please refer to section 6 for details The following table displays the various protocol numbers: Protocol Number Protocol ICMP IGMP RSVP 7.1.4.2...
Page 30
Filt Name: host Block: Address Type: IPv4 Destination Addr/Mask: Ignore Source Addr/Mask: Ignore DSCP: Ignore IPv4 Protocol / IPv6 Next Header: Ignore Destination L4 Port Min: Ignore Destination L4 Port Max: Ignore Source L4 Port Min: Ignore Source L4 Port Max: Ignore...
Filt 8. IP Security Features This section covers the security features DHCP Snooping, ARP -Inspection, and IP Source Guard. DHCP Snooping and A RP-Inspection where added in the 5.0 software release while IP Source Guard was added in the 5.1 soft ware release. If you are using a software release prior to 5.0, please see the next section.
Filt 8.2 Dynamic ARP Inspection Dynamic ARP Inspection verifies the ARP packets to prevent man -in-the-middle (MITM) types of attacks. Without dynamic ARP inspection, a malicious user can attack hosts in a local subnet by poisoning the ARP cache of hosts connected to this subnet by intercepting traffic intended for other hosts on the subnet.
Filt 9. BPDU Filtering BPDU filt ering is a feat ure that when enabled at a port level, will either shutdow n a port for a specific time period or forever when it rec eives a Spanning Tree BPDU. For all user access ports, it is recommended to enable Spanning Tree Fast Start in addition to BPDU filtering.
Filt 10. QoS Interface Applications In the 4.2 software release or higher, several new QoS applications designed to enhance security have been added to the switch. These QoS security applications target several of the most common denial of service (DoS ) launched against networks today. The following items have been added:...
Filt 10.1 ARP Spoofing Figure 3: Arp Spoofing Example Considering Figure 3 above, host 4 wishes to perform an ARP spoofing man -in-the-middle (MITM) attack. When hosts 2 or 3 wish to communicat e with the router, they will send an ARP request for the rout er‟s MAC address.
Filt 10.2 DHCP Attacks Figure 4: DHCP Attack Example There are two types of attacks that can occur with DHCP: An attacker could request multiple IP addresses from a DHCP server by spoofing its source MAC address. This can be achieved by using a tool such as gobbler: http://www.networkpenet...
Filt 5530-24TFD(config)# interface fastEthernet all 5530-24TFD(config-if)# qos dhcp spoofing port 2-10 dhcp-server 172.30.30.50 10.3 DoS The following command is used to enable the various DoS QoS Applications 5530-24TFD(config)# interface fastEthernet all 5530-24TFD(config-if)# qos dos <nachi a|sql slam |tcp-dnsport|tcp-ftpport|tcp- synfinscan|xmas> port <port #> enable...
Filt The TCP DnsPort QoS Application is similar to the TCP FtpPort application but for DNS port 53. When enabled, this application will drop TCP traffic with the TCP SYN flag set and a source port of 53 with a destination port less than or equal to 1024.BP DU...
Filt 11. Configuration Steps – Policy Configuration 11.1 Role Combination A role combination is formed by assigning one or more physical ports to the role an d by designating the interface class (Trusted, Untrusted, Un-restricted) for the role and associated ports. By default, when using the WEB interface, all ports on the Ethernet Routing Switch 5500 are assigned to the default interface group named „allBayStacklfcs‟...
Filt 11.2 Classification Classification consists of adding the following items: Add IP or L2 or both classifier elements Add a classifier. As mentioned above in the overview section, a classifier can be made up of one of the following items:...
Page 42
Filt NOTE: If you wish to combine an IP element and a L2 element for a classifier, the L2 element‟s EtherType must set configured as 0x0800. The following is an example of a L2 element to match VLAN 1:...
Filt 11.3 Meters To add a meter, enter the following command: ERS5500-48T(config)# qos meter <1-64000> nam e <name> committed-rate <1000-1023000 Kbit/ sec> max-burst-rate <1-4294967295> max-burst-duration <1-4294967295> in-profile- action <1-64000> out-profile-action <1-64000> To view the action number, enter the following command:...
Filt Example: The following example creat es a meter wit h a CIR of 10 Mbps, burst rate of 20 Mbps for 13 msec with an in profile action of Silver Service and an out profile action of drop traffic .
Filt 12. Configuration Examples 12.1 Pre-defined Values QoS Action Prior to adding a new meter or when configuring a policy, an in-profile and out-profile action is added. The action itself is referenced to by a numeric number. You can use any of the default actions or if you wish, you can creat e a new action prior to configuring a meter or adding a new policy.
Filt 12.2 Configuration Example 1 – Traffic Meter Using Policies Figure 5: Traffic Meter Example The following CLI commands show how to configure a QoS Policy using a Classifier-block with three classifiers and traffic meters. Overall, in this example, we will configure the following:...
Page 47
Filt 12.2.1.2 Configure the IP elements Configure three IP elements for UDP destination ports 80, 69, and 137. ERS5500 Step 1 – Create the IP elements ERS5500-24T(config)# qos ip-element 1 addr-type ipv4 protocol 17 dst-port-min 80 dst- port-max 80...
Page 48
Filt ERS5500 Step 1 – Create the classifier block ERS5500-24T(config)# qos classifier-block 1 block-number 1 name b1 set-id 1 meter 1 ERS5500-24T(config)# qos classifier-block 2 block-number 1 name b1 set-id 2 meter 2 ERS5500-24T(config)# qos classifier-block 3 block-number 1 name b1 set-id 3 meter 3 12.2.1.6 Configure the Policy...
Page 49
Filt Address Type: IPv4 Destination Addr/Mask: Ignore Source Addr/Mask: Ignore DSCP: Ignore IPv6 Flow Id: Ignore IPv4 Protocol / IPv6 Next Header: Destination L4 Port Min: Destination L4 Port Max: Source L4 Port Min: Ignore Source L4 Port Max: Ignore...
Filt 12.3 Configuration Example – IP ACL, DHCP Snooping, ARP Inspection, BPDU Filtering, and Source Guard Figure 4: IP ACL, DHCP Snooping, ARP Inspection, and Source Guard Overall, we wish to accomplish the following in regards to VLAN 110: Only allow ICMP and DHCP traffic to the DHCP server (172.30.30.50) and deny all other traffic to...
Page 53
Filt 12.3.1.2 Add IP Addre ss and Enable OSPF ERS5500: Step 1 – Add IP address to VLAN 110 and enable OSPF with interface type of passive 5500(config)# interface vlan 110 5500(config-if)# ip address 10.62.32.1 255.255.255.0 5500(config-if)# ip ospf network passive...
Page 54
Filt 5500(config-if)# spanning-tree bpdu-filtering timeout 0 5500(config-if)# spanning-tree bpdu-filtering enable 5500(config-if)# exit ERS5500: Step 2 – Enable Rate Limiting to 10% of total traffic for both broadca st and multicast traffic interface fastEthernet all 5500(config)# 5500(config-if)# rate-limit port both 10...
Page 55
Filt qos ip-acl name one dst-ip 10.62.32.0/24 block b1 5500(config)# qos ip-acl name one dst-ip 10.0.0.0/8 drop-action enable block b2 5500(config)# qos ip-acl name one dst-ip 172.0.0.0/8 drop-action enable block 5500(config)# qos ip-acl name one drop-action disable 5500(config)# ERS5500: Step 2 – Assign the IP-ACL’ s to ports 3-6...
Page 56
Filt Enabled Disabled Step 2 – Verify all the access port are configured for „untrusted‟ – this is the default setting show ip dhcp-snooping interface 3-6,8-10 ERS5500-24T# Result: DHCP Port Snooping ---- -------- Untrusted Untrusted Untrusted Untrusted Untrusted Untrusted Untrusted Step 3 –...
Page 57
Filt Untrusted Untrusted Untrusted Untrusted 12.3.2.3 Verify IP Source Guard Step 1 – To view the IP Source Guard binding, enter the following command, assuming we have port member on ports 6 and 9 show ip source binding ERS5500-24T#...
Page 58
Filt Source L4 Port Max: Ignore IPv6 Flow Id: Ignore Action Drop: Action Update DSCP: Ignore Action Update 802.1p Priority: Ignore Action Set Drop Precedence: Low Drop Type: Access List Storage Type: NonVolatile Id: 3 Name: Block: Address Type: IPv4 Destination Addr/Mask: 10.10.30.0/24...
Filt IPv6 Flow Id: Ignore Action Drop: Action Update DSCP: Ignore Action Update 802.1p Priority: Ignore Action Set Drop Precedence: Low Drop Type: Access List Storage Type: NonVolatile Step 2 – To view the IP A CL assignment, enter the following command:...
Page 62
Filt 000 to 2003 000 to 2007 2016-2047 Min = 11111100000 Max Port Range: 2016-2047 Ma x = 11111111111 Other valid ranges: 2016 to 2016 2016 to 2017 2016 to 2019 2016 to 2023 2016 to 2031 12.4.1 Configuration – Using Policies 12.4.1.1 Configure the Interface Role Combination...
Page 63
Filt 12.4.1.4 Configure the Policies Create the policies with the classifiers created above. Please refer to table 3 in reference to the policy action. ERS5500 Step 1 – Create the policy 5500(config)# qos policy 1 name range_tcp_1 if -group ifx clfr-type classifier clfr-id...
Filt 12.5 Configuration Example 4 – L2 Classification Based on MAC Address In this configuration example, we wish to set the service class for any MAC address from 00:00: 0A:00:00: 00 to 00: 00:0A:00:00:ff to a Service Class of G old and all other traffic with a Service Class of Bronze.
Page 65
Filt 12.5.1.4 Create Policy Create the policies with the classifiers created above. Please refer to table 3 in reference to the policy action. ERS5500 Step 1 – Add policy for L2 cla ssi fier created above and apply it to role combination...
Filt 12.6 Configuration Example 5 – L2 and L3 Classification In this configuration example, the Ethernet Routing Switch is used as L2 switch with two VLANs providing L2 privat e VLAN services. Both VLAN‟s have the same over-lapping IP addresses where workstation 1 and 2 are us ed to provide high-touch services.
Page 67
Filt ERS5500: Step 2 – Add L2 elements for VLAN 110 and 120 5500(config)# qos l2-element 1 vlan-min 110 vlan-max 110 vlan-tag tagged ethertype 0x800 5500(config)# qos l2-element 1 vlan-min 120 vlan-max 120 vlan-tag tagged ethertype 0x800 12.6.1.3 Configure Classifier and Classi fier Blocks The following steps add two classifiers, one with IP element 1 and L2 element 1 and the second with IP element 1 and L2 element 2.
Filt 12.7 Configuration Example 6 - QoS Marking with Port Role Combination set for Un-restricted using ACL’s With a port role combination of un-restricted, the DS CP value is passed as-is and is not looked at by the ERS 5500 internal QoS mapping. This does not apply to the p-bit which is looked at, honoured, and mapped according to the QoS priority mapping table.
Page 69
Filt 12.7.1.3 Create New Unrestricted Interface Role ERS5500: Step 1 – Add new unrestricted interface role with port members 3-6 5500(config)# qos if-group name unrestricted class unrestricted 5500(config)# qos if-assign port 3-6 name unrestricted 12.7.2 ACL Configuration 12.7.2.1 Create ACL’ s to Remark DS CP ERS5500: Step 1 –...
Filt Weighted Round Robin Relative 43008 Weighted Round Robin Relative 39936 Weighted Round Robin Relative 36864 Weighted Round Robin Relative 33792 Weighted Round Robin Relative 30720 12.8 Configuration Example 7 – Interface Shaping In this configuration example, we wish to add port shaping to port 8 and set the shaped rate to 40 Mbps .
Filt 13. Software Baseline All configuration examples are based on software release 5.1. 14. Reference Documentation Publication Document Title Description Number Configuration - Quality of NN47200-504 A vaya Ethernet Routing Switch 5500 Series Service (217466-C) updated for software release 5.1...
Filt 15. Customer service Visit the Avaya Web site to access the complete range of services and support that A vaya provides. Go www.avaya.com or go to one of the pages listed in the following sections. 15.1 Getting technical documentation To download and print selected technical publications and release notes directly from the Internet, go to www.avaya.com/support.
Need help?
Do you have a question about the ERS 5510 and is the answer not in the manual?
Questions and answers