-
Cisco SCE8000 10GBE Software Configuration Guide, Release 3.7.x
-
About this Guide
-
Cisco Service Control Overview
-
Command Line Interface
-
Basic Cisco SCE8000 Platform Operations
-
Utilities
-
Configuring the Management Interface and Security
-
Global Configuration
-
Configuring the Line Interface
-
Configuring the Connection
-
Raw Data Formatting: The RDR Formatter and NetFlow Exporting
-
Managing Subscribers
-
Redundancy and Fail-Over
-
Identifying and Preventing Distributed-Denial-Of-Service Attacks
-
Managing the SCMP
-
Intelligent Traffic Mirroring
-
Cisco Service Control MIBs
-
Monitoring SCE Platform Utilization
-
SCE8000 Licensing Information
-
Feedback
Table Of Contents
Information About Line Interfaces
Flow Control and Bandwidth Considerations
How to Configure the Ten Gigabit Ethernet Line Interfaces
Changing the Traffic Direction on the Ten Gigabit Ethernet Line Interfaces
How to Specify the Traffic Direction on Link 1
Configuring the 6to4 Environment
Configuring the VLAN Environment
Configuring the MPLS Environment
Configuring the L2TP Environment
Displaying the Tunneling Configuration
How to Display the 6to4 Configuration
How to Display the DS-Lite Configuration
How to Display the IPinIP Configuration
How to Display the Logged-In VPNs
How to Display the Asymmetric L2 Support Mode
Displaying VPN-related Mappings
Configuring Traffic Rules and Counters
What are Traffic Rules and Counters?
How to Create a Traffic Counter
How to Delete a Traffic Counter
How to Delete all Existing Traffic Counters
How to Create a Traffic Rule for IPv4 Addresses
How to Create a Traffic Rule for IPv6 Addresses
How to Delete All Traffic Rules
How to Delete All Flow Control Traffic Rules
Managing Traffic Rules and Counters
How to View a Specified Traffic Rule
How to View a Specified Traffic Counter
How to View All Traffic Counters
How to Reset a Specified Traffic Counter
How to Reset All Traffic Counters
How to Display the DSCP Marking Configuration
About Counting Dropped Packets
Disabling the Hardware Packet Drop
Configuring Line Interfaces
Revised: November 28, 2012, OL-24150-06Introduction
This chapter describes how to configure the physical line interfaces (ports) as well as how to configure those interfaces for tunneling, DSCP marking, and traffic rules.
•
Configuring Traffic Rules and Counters
Line Interfaces
•
•
•
The Line Interfaces (Subscriber and Network) are used to connect the SCE platform to the network. See the description of network topologies in the "Cisco SCE8000 Topology and Topology-Related Parameters" chapter of the Cisco SCE8000 10GBE Installation and Configuration Guide.
Information About Line Interfaces
The Cisco SCE 8000 10GBE line interfaces are found on the 1-port Ten Gigabit Ethernet SPAs installed in subslots 0 through 3 of slot 3. Each 1-port Ten Gigabit Ethernet SPA provides one 10GBE port, which interfaces with either subscriber or network traffic. These interfaces can be individually configured using CLI commands in this section.
Flow Control and Bandwidth Considerations
Note
Maximum Packet Size
The MTU value for the Cisco SCE8000 traffic processing is 9238 bytes. However, in the current version, packets larger than 1600 bytes are bypassed and are not handled by the service control application.
How to Configure the Ten Gigabit Ethernet Line Interfaces
The 10GBE line interfaces are configured in TenGigabitEthernet mode.
Step 1
Enters Global Configuration mode.
Step 2
Enters Interface Configuration mode for the selected 10 GBE interface.
Step 3
Exits to global configuration mode, from which you can access a different Ten Gigabit Ethernet interface.
Changing the Traffic Direction on the Ten Gigabit Ethernet Line Interfaces
The hardware design of the SCE8000 10G platform is such that the traffic coming in and out of SPAs 0 and 2 is limited to a total of 16Gbps in each direction, as is the traffic coming in and out of SPAs 1 and 3. Since by default, in 10GBE installations, SPAs 0 and 2 are subscriber-side ports, and SPAs 1 and 3 are network-side ports, this effectively limits total traffic in each direction (upstream and downstream) to 16Gbps. Therefore, a site that has a total of more than 16Gbps of traffic in one direction (upstream or downstream), will exceed this limit and suffer packet loss.
You can use this command to swap the roles of the ports on link 1, which will switch part of the high-volume traffic to the opposite pair of SPAs and prevent either pair of SPAs from exceeding the 16Gbps limit.
Limitations
•
Only one interface on the link is explicitly configured. The corresponding interface is automatically set to the opposite traffic side.
•
•
How to Specify the Traffic Direction on Link 1
Step 1
Enters Global Configuration mode.
Step 2
interface TenGigabitEthernet 3/3/0 and press Enter.Enters Interface Configuration mode for the selected 10 GBE interface.
Step 3
The traffic side is set to the specified direction for the interface you are configuring and also automatically to the opposite direction for the corresponding interface.
Tunneling Protocols
•
Tunneling technology is used across various telecommunications segments to solve a wide variety of networking problems. The SCE platform is designed to recognize and process various tunneling protocols in several ways. The SCE platform is able to either ignore the tunneling protocols (skip the header) or treat the tunneling information as subscriber information (classify). A special case of classification by tunneling information is VPN with private IP support.
Only 6to4, 6rd, and DS-Lite tunnels are supported for IPv6 traffic. There is no skip command for IPv6 tunnels.
Table 7-1 shows the support for the various tunneling protocols (the default behavior for each protocol is in bold):
When the tunneling information is ignored, the subscriber identification is the subscriber IP of the IP packet carried inside the tunnel.
Asymmetric Tunneling
Some tunneling modes are symmetric and some are asymmetric (see Table 7-1). Any time that one of the asymmetric tunneling modes is enabled, the entire system is automatically set to asymmetric flow open mode. In this mode, flows are opened earlier than in symmetric flow open mode, and the first packet of each direction of the flow (upstream and downstream) reaches the software. This is required to support redirect and block operations over asymmetric layer 2 protocols. However, it also has some impact on both performance and capacity, so that a certain performance degradation should be expected in any asymmetric mode.
It is also possible to explicitly configure the system to treat all flows as having asymmetric layer 2 characteristics (including Ethernet, VLAN, MPLS, and L2TP), for the purpose of packet injection (such as block flow and redirect flow operations).
To view the effective flow open mode, use the show interface linecard 0 flow-open-mode command.
Note
L2TP
L2TP is an IP-based tunneling protocol, therefore the system must be specifically configured to recognize the L2TP flows, given the UDP port used for L2TP. The SCE platform can then skip the external IP, UDP, and L2TP headers, reaching the internal IP, which is the actual subscriber traffic. If L2TP is not configured, the system treats the external IP header as the subscriber traffic, thus all the flows in the tunnel are seen as a single flow.
VLAN
A single VLAN tag is supported per packet (no QinQ support).
Subscriber classification by VLAN tag is supported only in symmetric VLAN environments, that is, in environments where the upstream and downstream tags of a flow are identical.
Tunneling IPv6 Traffic
The following tunnels are supported for IPv6 traffic:
•
Tunneling can be done in two modes:
–
In the IPv6 mode, you can configure the IPv6 hash or the IPv4 hash. When the IPv6 hash is configured, the IPv6 traffic is handled by the traffic processor card configured to handle the IPv6 traffic based on the IPv6 hash. When the IPv4 hash is configured, the IPv6 traffic is handled by the traffic processor card configured to handle the IPv6 traffic based on the IPv4 IP hash.
–
•
DS-Lite is a light-weight dual stack that is used when only public IPv6 addresses and private IPv4 addresses can be assigned. The extension header is supported on the DS-Lite tunnels.
When DS-Lite is enabled, the IPv6 traffic is handled as TCP/UDP by the traffic processor configured to handle the IPv6 traffic. If DS-Lite is disabled, the IPv6 traffic is bypassed as non-TCP/UDP by the traffic processor configured to handle the IPv6 traffic.
Some of the tunneling protocols can be configured in both modes, but some of the protocols works in tunneled mode only. For example, the 6to4 tunneling protocol is supported in both the modes.
The following tunnels are not supported for IPv6 traffic:
•
•
•
•
Selecting the Tunneling Mode
•
•
•
•
Use these commands to configure tunneling:
•
•
•
•
•
•
•
•
•
Configuring the 6to4 Tunnels
Before configuring the 6to4 tunnels or 6rd tunnels, verify whether you have configured the IPv6 environment and the 6to4 environment.
6to4 tunneling is applicable only when at least one traffic processor card is configured to handle IPv6 traffic. For details on configuring the traffic processor cards, see the "Configuring the IPv6 Environment" section.
You must also configure the 6to4 environment to use the 6to4 tunnels. For details on configuring the 6to4 environment, see the "Configuring the 6to4 Environment" section.
Caution
Enabling 6to4 Tunneling
By default, IP tunnel recognition is disabled. Use the following steps to enable 6to4 tunnels:
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter ip-tunnel 6to4 and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Disabling 6to4 Tunneling
Use these steps to disable 6to4 tunneling:
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#>prompt, enter no ip-tunnel 6to4 and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Configuring DS-Lite Tunnels
Before configuring the DS-Lite tunnels, verify whether you have configured the IPv6 environment.
DS-Lite tunneling is applicable only when at least one traffic processor card is configured to handle IPv6 traffic. For details on configuring the traffic processor cards, see the "Configuring the IPv6 Environment" section.
Caution
Enabling DS-Lite Tunneling
By default, IP tunnel recognition is disabled. Use the following steps to enable the recognition of DS-Lite tunnels:
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter ip-tunnel DS-Lite and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Disabling DS-Lite Tunneling
Use these steps to disable DS-Lite tunneling:
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter no ip-tunnel DS-Lite and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Enabling DS-Lite Extension Header Support
Use the following steps to enable the DS-Lite extension header support:
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter ip-tunnel DS-Lite and press Enter.
Step 3
From the SCE(config if)#> prompt, enter ip-tunnel DS-Lite Extention-Header-Support and press Enter.
Step 4
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Disabling DS-Lite Extension Header Support
Use these steps to disable DS-Lite extension header support:
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter no ip-tunnel DS-Lite Extention-Header-Support and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Configuring L2TP Tunnels
Caution
Enabling the L2TP Tunneling
By default, IP tunnel recognition is disabled. Use this command to configure recognition of L2TP tunnels and skipping into the internal IP packet.
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter ip-tunnel l2tp skip and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Disabling the L2TP Tunneling
Disables all IP tunnels except IPinIP and GRE.
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter no ip-tunnel l2tp skip and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Configuring GRE Tunneling
GRE tunneling is an IP-based tunneling protocol; therefore the system must be specifically configured to recognize the flows inside the tunnel. The SCE platform will then skip the external IP header, reaching the internal IP, which is the actual subscriber traffic. When GRE skip is disabled, the system treats the external IP header as the subscriber traffic, resulting in all GRE traffic being reported as generic IP.
Guidelines for configuring GRE tunnels:
•
•
•
Caution
Fragmentation
Fragmentation should be avoided whenever possible. If it is not possible to avoid fragmentation, it is recommended to opt for internal fragmentation. If that is also not possible, the SCE platform can be operated under conditions of external fragmentation.
Enabling GRE Tunneling
By default, IP tunnel recognition is disabled. Use this command to configure recognition of GRE tunnels and skipping into the internal IP packet.
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter ip-tunnel gre skip and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Disabling GRE Tunneling
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter no ip-tunnel gre skip and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Configuring IPinIP Tunneling
IPinIP is an IP-based tunneling protocol; therefore the system must be specifically configured to recognize the flows inside the tunnel. The SCE platform will then skip the external IP header, reaching the internal IP, which is the actual subscriber traffic. When IPinIP skip is disabled, the system treats the external IP header as the subscriber traffic, resulting in all IPinIP traffic being reported as generic IP.
Guidelines for configuring IPinIP tunnels:
•
•
•
Caution
Fragmentation
Fragmentation should be avoided whenever possible. If it is not possible to avoid fragmentation, it is recommended to opt for internal fragmentation. If that is also not possible, the SCE platform can be operated under conditions of external fragmentation
Enabling IPinIP Tunneling
By default, IP tunnel recognition is disabled. Use this command to configure recognition of IPinIP tunnels and skipping into the internal IP packet.
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter ip-tunnel IPinIP skip and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Disabling IPinIP Tunneling
Step 1
From the SCE(config if)#> prompt, enter shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, enter no ip-tunnel IPinIP skip and press Enter.
Step 3
From the SCE(config if)#> prompt, enter no shutdown and press Enter.
Configuring DSCP Marking
DSCP marking modifies the DSCP bits of the IPv4 header. In GRE and IPinIP tunnels there are at least two IP headers. By default, DSCP marking is performed only on the external IP header (Figure 7-1). You can configure whether DSCP marking will be performed in the internal or external header.
Figure 7-1 DSCP Marking for IPinIP or GRE Tunnels
Note
Configuring DSCP Marking on the Internal IP Header
Use this command to configure the SCE platform to mark the DSCP bits of the internal IP header. This command takes effect only when the relevant tunneling mode (GRE skip or IPinIP skip) is enabled.
Step 1
From the SCE(config if)#> prompt, type shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, type ip-tunnel (GRE|IPinIP) DSCP-marking-skip and press Enter.
Enables DSCP marking on the internal IP header of IPinIP traffic.
Step 3
From the SCE(config if)#> prompt, type no shutdown and press Enter.
Configuring DSCP Marking on the External IP Header
To perform DSCP marking on the external IP header, use the following command:
Step 1
From the SCE(config if)#> prompt, type shutdown and press Enter.
Step 2
From the SCE(config if)#> prompt, type no ip-tunnel (GRE|IPinIP) DSCP-marking-skip and press Enter.
Enables DSCP marking on the external IP header of IPinIP traffic.
Step 3
From the SCE(config if)#> prompt, type no shutdown and press Enter.
Configuring the 6to4 Environment
Note
Configure the 6to4 environment after you configure the IPv6 environment. To configure the 6to4 environment, complete the following procedure:
Step 1
SCE8000# configure
Step 2
From the Global Configuration prompt, enter debug const-db name seCommonConstDb.box.isIPv6to4IPv6Mode value true and press Enter.
Step 3
From the Global Configuration prompt, enter debug const-db name seCommonConstDb.box.isIPv6to4IPv6Hash value true and press Enter.
Step 4
SCE8000#> copy running-config startup-config
Step 5
After Cisco SCE 8000 restarts, you can use the following configuration and show commands to configure the 6to4 and 6rd tunnels:
•
•
•
Configuring the VLAN Environment
Note
Use this command to configure the VLAN environment.
•
Options
There are three options:
•
•
•
Symmetric environment refers to an environment in which the same VLAN tags are used for carrying a transaction in the upstream and downstream directions
Setting the mode to classify means that VPN and flow classification will use the VLAN tag. This is the only mode that supports private IP addresses. Using VLAN classification is mutually exclusive with other tunnel-based classification or IP tunnels.
An a-symmetric environment is an environment in which the VLAN tags might not be the same in the upstream and downstream directions of the same flow.
The SCE platform is configured by default to work in symmetric environments. A specific command should be used to allow correct operation of the SCE platform in asymmetric environments and instruct it to take into consideration that the upstream and downstream of each flow has potentially different VLAN tags.
Note
From the SCE(config if)# prompt, type:
vlan {symmetric classify | symmetric skip |a-symmetric skip}
Configures the VLAN environment.
Specify the desired VLAN mode.
Configuring the VLAN Environment: Example
The following example selects VLAN-based classification.
SCE(config if)#vlan symmetric classifyConfiguring the MPLS Environment
Use this command to set the MPLS environment.
Options
The following options are available:
•
•
Use the VPN keyword when the labels are mandatory in the traffic, otherwise use traffic-engineering (default).
Note that using the VPN value incurs a performance penalty.
From the SCE(config if)# prompt, type:
mpls {traffic-engineering skip|vpn skip}
Sets the MPLS environment.
Specify the desired MPLS mode.
Configuring the L2TP Environment
•
External Fragmentation in the L2TP Environment
If external fragmentation exists in the L2TP environment, it is required to configure a quick-forwarding-ignore traffic rule (see Configuring Traffic Rules and Counters) that bypasses all IP traffic targeted to either the LNS or LAC IP address. This will make sure that any packets not having the L2TP port indication (i.e. non-first fragments) will not require handling by the traffic processors.
In addition, to prevent reordering of L2TP tunneled fragments, it is advised to define a quick-forwarding traffic rule for all the L2TP traffic. This can be done based on the IP ranges in use by the internal IPs in the tunnel (as allocated by the LNS), or simply for all the traffic passing through the SCE platform.
Note
Options
The following option is available:
•
Default port# = 1701
From the SCE(config if)# prompt, type:
Asymmetric L2 Support
You should enable asymmetric layer 2 support in cases where the following conditions apply for any flows:
•
•
Note
From the SCE(config if)# prompt, type:
Displaying the Tunneling Configuration
From the SCE# prompt, type:
show interface linecard 0 (MPLS|VLAN|L2TP|IP-tunnel)
Displays the current configuration for the specified tunnel option.
How to Display the 6to4 Configuration
From the SCE# prompt, type:
show interface linecard 0 IP-tunnel 6to4
Displays the current configuration for the 6to4 tunnel option.
How to Display the DS-Lite Configuration
From the SCE# prompt, type:
show interface linecard 0 IP-tunnel DS-Lite
Displays the current configuration for the DS-Lite tunnel option.
How to Display the IPinIP Configuration
From the SCE# prompt, type:
show interface linecard 0 ip-tunnel IPinIP
Displays the current configuration for the specified tunnel option.
How to Display the Logged-In VPNs
Options
The following options are available
•
•
From the SCE> prompt, type:
show interface linecard 0 VPN {name vpn-name | all-names}
Displays the logged-in VPNs.
How to Display the Asymmetric L2 Support Mode
From the SCE# prompt, type:
show interface linecard 0 asymmetric-L2-support
Displays asymmetric L2 support mode.
Managed VPNs
A managed VPN is a named entity, introduced similarly to the same way that a subscriber is introduced, and containing VPN mappings.
A managed VPN contains a single VLAN mapping. A VPN-based subscriber contains a set of mappings of the form: IP@VpnName, where IP can be either a single IP address or a range of addresses.
Managed VPN entities can be configured only via the SM. The SCE platform CLI can be used to view VPN-related information, but not to configure the VPNs.
Private IP Addresses
Private IP addresses are supported only in the following mode, as this mode provides information regarding the higher-level entity (VLAN or VPN) to which the IP addresses of the flow belong:
•
Capacity
The system supports:
•
•
Limitations for VPN mode
Mutually exclusive system modes
When the system is working in VPN mode, the following modes are not supported:
•
•
Subscriber-related limitations
•
•
TCP-related requirements
•
VPN configuration requirements
•
Monitoring VPN Support
The SCE platform CLI allows you to do the following:
•
•
Displaying VPN-related Mappings
Use the following Viewer commands to display subscriber mappings. These commands display the following information:
•
•
•
•
How to Display Mappings for a Specified VPN
•
Options
The following option is available:
•
From the SCE> prompt, type:
Displaying Mappings for a Specified VPN: Examples
The following example illustrates the output of this command for a VLAN-based VPN.
SCE> show interface linecard 0 VPN name vpn3VPN name: Vpn3VLAN: 2Number of subscriber mappings: 0Explicitly introduced VPNThe following example illustrates the output of this command for an automatically created VLAN VPN.
SCE> show interface linecard 0 VPN name 2VPN name: 2VLAN: 2Number of subscriber mappings: 1Automatically created VPNHow to Display a Listing of all VPNs
Use this command to display a listing of all currently logged-in VPNs.
From the SCE> prompt, type:
show interface linecard 0 VPN all-names
Displays a listing of all currently logged-in VPNs.
Displaying a Listing of All VPNs: Example
SCE> show interface linecard 0 VPN all-namesHow to Display Subscriber Mappings for an IP range on a Specified VPN
•
Options
The following options are available:
•
•
From the SCE> prompt, type:
Displaying Subscribers Mapped to a IP range on a Specified VPN: Example
SCE> show interface linecard 0 subscriber mapping included-in IP 10.0.0.0/0 VPN vpn1 Subscribers with IP mappings included in IP range '10.0.0.0/0'@vpn1: Subscriber 'Sub10', mapping '10.1.4.150/32@vpn1'. Subscriber 'Sub10', mapping '10.1.4.149/32@vpn1'. Subscriber 'Sub10', mapping '10.1.4.145/32@vpn1'. Subscriber 'Sub11', mapping '10.1.4.146/32@vpn1'. Total 2 subscribers found, with 4 matching mappingsHow to Display the Number of Subscribers Mapped to an IP range on a Specified VPN
•
Options
The following options are available:
•
•
Use the `amount `keyword to display the number of subscribers rather than a listing of subscriber names.
From the SCE> prompt, type:
show interface linecard 0 subscriber amount mapping included-in IP ip-range VPN vpn-name
Displays the number of subscribers mapped to an IP range on a specified VPN.
Displaying the Number of Subscribers Mapped to range on a Specified VPN: Example
SCE> show interface linecard 0 subscriber amount mapping included-in IP 0.0.0.0/0 VPN vpn1 There are 2 subscribers with 4 IP mappings included in IP range '0.0.0.0/0'.Configuring Traffic Rules and Counters
•
Traffic Rules and Counters
•
What are Traffic Rules and Counters?
Traffic rules and counters may be configured by the user. This functionality enables the user to define specific operations on the traffic flowing through the SCE Platform, such as blocking or ignoring certain flows or counting certain packets. The configuration of traffic rules and counters is independent of the application loaded by the SCE platform, and thus is preserved when the application being run by the SCE platform is changed.
Possible uses for traffic rules and counters include:
•
•
Possible examples include ignoring traffic from a certain IP range known to require no service, or traffic from a certain protocol.
•
Possible examples include performing ingress source address filtering (dropping packets originating from a subscriber port whose IP address does not belong to any defined subscriber-side subnet), or blocking specific ports.
It should be noted that using traffic rules and counters does not affect performance. It is possible to define the maximum number of both traffic rules and counters without causing any degradation in the SCE platform performance.
Traffic Rules
A traffic rule specifies that a defined action should be taken on packets processed by the SCE Platform that meet certain criteria. The maximum number of rules for the Cisco SCE8000 is 64, which includes not only traffic rules configured via the SCE platform CLI, but also any additional rules configured by external management systems, such as SCA BB. Each rule is given a name when it is defined, which is then used when referring to the rule.
Packets are selected according to user-defined criteria, which may be a combination of the following:
•
•
•
•
The possible actions are:
•
•
•
•
•
The Block and Ignore actions affect only those packets that are not a part of an existing flow.
Note that Block and Ignore are mutually exclusive. However, blocked or ignored packets can also be counted.
It is possible for a single packet to match more that one rule (The simplest way to cause this is to configure two identical rules with different names). When this happens, the system operates as follows:
•
–
–
•
Traffic Counters
Traffic counters count the traffic as specified by the traffic rules. The maximum number of counters is 32. Each counter is given a name when it is defined, which is then used when referring to the counter.
A traffic counter can be configured in one of two ways:
•
•
Configuring Traffic Counters
A traffic counter must be created before it can be referenced in a traffic rule. Use the following commands to create and delete traffic counters.
•
•
•
How to Create a Traffic Counter
Options
The following options are available:
•
•
•
From the SCE(config if)# prompt, type:
traffic-counter name name count-bytes|count-packets
Adds a traffic counter with the specified name and counting mode.
How to Delete a Traffic Counter
From the SCE(config if)# prompt, type:
no traffic-counter name name
Deletes a traffic counter.
Note that a traffic counter cannot be deleted if it is used by any existing traffic rule.
How to Delete all Existing Traffic Counters
From the SCE(config if)# prompt, type:
no traffic-counter all
Removes all traffic counters.
Note that a traffic counter cannot be deleted if it is used by any existing traffic rule.
Configuring Traffic Rules
Use the following commands to create and delete traffic rules.
•
•
•
•
How to Create a Traffic Rule for IPv4 Addresses
Options
The following options are available:
IP specification:
all|([all-but] (ip-address|ip-range))•
•
•
protocol:
Any one of the following protocols:
TCP/UDP/ICMP/IGRP/EIGRP/IS-IS/OSPF/allport specification:
all|([all-but] (port#|port-range)•
•
•
•
id specification:
all|([all-but] tunnel id)•
•
Use the traffic-rule tunnel-id-mode command.
Note that the VLAN tag itself is a 12-bit value, and therefore aliasing of the lower 8 bits can occur, depending on the VLAN tags used.
direction:
Any of the following:
upstream/downstream/bothtraffic-counter:
Either of the following:
•
•
action: (not required if the action is count only)
One of the following:
•
•
•
•
•
From the SCE(config if)# prompt, type:
Configuring Traffic Rules: Examples
Example 1
This example creates the following traffic rule:
•
•
•
•
•
•
SCE(config if)# traffic-rule name rule1 IP-addresses subscriber-side all network-side 10.10.10.10 protocol all direction both traffic-counter name counter1Example 2
This example creates the following traffic rule:
•
•
•
•
•
•
•
•
•
The first command enables tunnel id mode.
SCE(config if)#traffic-rule tunnel-id-mode SCE(config if)# traffic-rule name rule2 IP-addresses subscriber-side all network-side all-but 10.10.10.0/24 protocol tcp ports subscriber-side 100:200 network-side all tunnel-id all direction downstream traffic-counter name counter2 action blockExample 3
This example creates the following traffic rule:
•
•
•
•
•
•
•
SCE(config if)# traffic-rule name rule3 IP-addresses all protocol IS-IS direction upstream traffic-counter none action ignoreExample 4
The following example illustrates how to configure a traffic rule that will be used as a recording rule using the flow-capture option. All flows that match this rule will be recorded when the flow capture process is in operation.
1.
2.
3.
4.
5.
6.
7.
SCE>enable 10 Password:<cisco> SCE#configure SCE(config)#interface linecard 0 SCE(config if)#traffic-rule name FlowCaptureRule ip-addresses subscriber-side all network-side all protocol 250 direction both traffic-counter name counter2 action flow-capture SCE(config if)#How to Create a Traffic Rule for IPv6 Addresses
Options
The following options are available:
IP specification:
all|(ip-address|ip-prefix)•
•
protocol:
One of the following protocols:
TCP/UDP/allport specification:
port•
•
•
direction:
Any of the following:
upstream/downstream/bothtraffic-counter:
Either of the following:
•
•
action: (not required if the action is count only)
One of the following:
•
•
•
From the SCE(config if)# prompt, type:
Example for Configuring a Traffic Rule
This example creates a traffic rule called rule2:
•
•
•
•
•
•
•
The actions that are performed are counting and blocking.
SCE> enable 10Password:<cisco>SCE # configSCE(config)# interface linecard 0SCE(config if)# traffic-rule name rule2 ipv6 ip-addresses subscriber-side all network-side all protocol tcp tunnel-id all direction downstream traffic-counter name counter2 action blockSCE(config if)
How to Delete a Traffic Rule
From the SCE(config if)# prompt, enter:
How to Delete All Traffic Rules
From the SCE(config if)# prompt, enter:
How to Delete All Flow Control Traffic Rules
From the SCE(config if)# prompt, enter:
Managing Traffic Rules and Counters
Use these commands to display existing traffic rule configuration, as well as traffic counter configuration (packets/bytes and the name of the rule using the counter) and traffic counter value.
You can also reset a specific counter or all counters.
•
•
•
•
•
•
How to View a Specified Traffic Rule
From the SCE# prompt, enter:
show interface linecard 0 traffic-rule name rule-name
Displays the configuration of the specified traffic rule.
How to View All Traffic Rules
From the SCE# prompt, enter:
show interface linecard 0 traffic-rule all
Displays the configuration of all existing traffic rules.
How to View a Specified Traffic Counter
From the SCE# prompt, type:
show interface linecard 0 traffic-counter name counter-name
Displays the value of the specified counter and lists the traffic rules that use it.
Viewing a Traffic Counter: Example
The following example displays information for the traffic counter "cnt".
SCE# show interface linecard 0 traffic-counter name cnt Counter 'cnt' value: 0 packets. Rules using it: None.How to View All Traffic Counters
From the SCE# prompt, enter:
show interface linecard 0 traffic-counter all
Displays the value of the each counter and lists the traffic rules that use it.
Viewing the Traffic Counters: Example
The following example displays information for all existing traffic counters.
SCE# show interface linecard 0 traffic-counter all Counter 'cnt' value: 0 packets. Rules using it: None. Counter 'cnt2' value: 0 packets. Rules using it: Rule2. 2 counters listed out of 32 available.How to Reset a Specified Traffic Counter
From the SCE# prompt, enter:
clear interface linecard 0 traffic-counter name counter-name
Resets the specified traffic counter.
How to Reset All Traffic Counters
From the SCE# prompt, enter:
DSCP Marking
DSCP marking is used in IP networks as a means to signal the priority of a packet. The Cisco Service Control solution supports the DSCP classification on a per-service, per-package level via the SCA BB application. The SCE platform DSCP marking feature enables marking the DSCP field in the IP header of each packet according to the policy configured via the SCA BB console. The actual DSCP value set in the IP header is determined according to the value defined in a configurable DSCP translation table.
Note
DSCP marking configuration is performed via the SCA BB console, The SCE platform CLI allows you to view the state of DSCP marking (enabled or disabled) for each interface and to display the DSCP translation table.
For information on configuring DSCP marking, please refer to the Cisco Service Control Application for Broadband User Guide.
Note
How to Display the DSCP Marking Configuration
Use this command to display the state of DSCP marking (enabled or disabled) per interface and the DSCP translation table.
From the SCE> prompt, enter:
show interface linecard 0 ToS-marking
Displays the state of DSCP marking (enabled or disabled) per interface and the DSCP translation table.
Counting Dropped Packets
•
•
About Counting Dropped Packets
By default, the SCE platform hardware drops WRED packets (packets that are marked to be dropped due to BW control criteria). However, this presents a problem for the user who needs to know the number of dropped packets per service. To be able to count dropped packets per service, the traffic processor must see all dropped packets for all flows. However, if the hardware is dropping red packets, the traffic processor will not be able to count all dropped packets and the user will not get proper values on the relevant MIB counters (tpTotalNumWredDiscardedPackets).
Note
The user can disable the drop-wred-packets-by-hardware mode. This allows the application to access existing per-flow counters. The application can then retrieve the number of dropped packets for every flow and provide the user with better visibility into the exact number of dropped packets and their distribution.
Note that counting all dropped packets has a considerable effect on system performance, and therefore, by default, the drop-wred-packets-by-hardware mode is enabled.
Disabling the Hardware Packet Drop
Use the following command to disable the drop-wred-packets-by-hardware mode, enabling the software to count all dropped packets.
By default hardware packet drop is enabled.
Note
From the SCE(config if)# prompt, type:
no accelerate-packet-drops
Disables hardware packet drop.
accelerate-packet-drops
Enables hardware packet drop.
