-
Cisco IOS XE Quality of Service Solutions Configuration Guide, Release 2
-
Quality of Service Overview
- Part 1: Classification
- Part 2: Congestion Management
- Part 3: Congestion Avoidance
- Part 4: Policing and Shaping
- Part 5: Link Efficiency Mechanisms
- Part 6: Quality of Service Solutions
- Part 7: Modular Quality of Service Command-Line Interface
-
Table Of Contents
Low Latency Queueing (LLQ) for IPsec Encryption Engines
Benefits of the Low Latency Queueing (LLQ) for Encryption Engines
Supported Standards, MIBs, and RFCs
Configuring Class Policy in the Policy Map
Configuring Class Policy for a Priority Queue
Configuring Class Policy Using a Specified Bandwidth
Configuring the Class-Default Class Policy
Verifying Configuration of Policy Maps and Their Classes
Monitoring and Maintaining LLQ for IPsec Encryption Engines
LLQ for IPsec Encryption Engines Example
Low Latency Queueing (LLQ) for IPsec Encryption Engines
Feature History
Cisco IOS XE Release 2.1
This feature was introduced on Cisco ASR 1000 Series Routers.
This feature module describes the Low Latency Queueing (LLQ) for IPsec encryption engines feature and includes the following sections:
•
Supported Standards, MIBs, and RFCs
•
Feature Overview
Low Latency Queueing (LLQ) for IPsec encryption engines helps reduce packet latency by introducing the concept of queueing before crypto engines. Prior to this, the crypto processing engine gave data traffic and voice traffic equal status. Administrators now designate voice traffic as priority. Data packets arriving at a router interface are directed into a data packet inbound queue for crypto engine processing. This queue is called the best effort queue. Voice packets arriving on a router interface are directed into a priority packet inbound queue for crypto engine processing. This queue is called the priority queue. The crypto engine undertakes packet processing in a favorable ratio for voice packets. Voice packets are guaranteed a minimum processing bandwidth on the crypto engine.
Benefits of the Low Latency Queueing (LLQ) for Encryption Engines
The Low Latency Queueing (LLQ) for IPsec encryption engines feature guarantees a certain level of crypto engine processing time for priority designated traffic.
Better Voice Performance
Voice packets can be identified as priority, allowing the crypto engine to guarantee a certain percentage of processing bandwidth. This feature impacts the end user experience by assuring voice quality if voice traffic is directed onto a congested network.
Improved Latency and Jitters
Predictability is a critical component of network performance. The Low Latency Queueing (LLQ) for IPsec encryption engines feature delivers network traffic predictability relating to VPN. With this feature disabled, an end user employing an IP phone over VPN might experience jitter or latency, both symptoms of overall network latency and congestion. With this feature enabled, these undesirable characteristics are dissipated.
Restrictions
•
•
•
•
•
•
•
Related Documents
•
•
Supported Standards, MIBs, and RFCs
Standards
No new or modified standards are supported by this feature.
MIBs
No new or modified standards are supported by this feature.
To locate and download MIBs for selected platforms, Cisco IOS XE Software releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
No new or modified RFCs are supported by this feature.
Prerequisites
To use this feature, you should be familiar with the following:
•
•
•
Configuration Tasks
To configure LLQ for IPsec encryption engines, perform the tasks described in the following sections.
•
•
•
•
•
•
•
Note
Defining Class Maps
To create a class map containing match criteria against which a packet is checked to determine if it belongs to a class, use the following commands beginning in global configuration mode:
Configuring Class Policy in the Policy Map
To configure a policy map and create class policies that make up the service policy, begin with the policy-map command to specify the policy map name. Then use one or more of the following commands to configure the policy for a standard class or the default class:
•
•
•
•
For each class that you define, you can use one or more of the commands listed to configure the class policy. For example, you might specify bandwidth for one class and both bandwidth and queue limit for another class.
The default class of the policy map (commonly known as the class-default class) is the class to which traffic is directed if that traffic does not satisfy the match criteria of the other classes defined in the policy map.
You can configure class policies for as many classes as are defined on the router, up to the maximum of 64. However, the total amount of bandwidth allocated for all classes in a policy map must not exceed the minimum committed information rate (CIR) configured for the virtual circuit (VC) minus any bandwidth reserved by the frame-relay voice bandwidth and frame-relay ip rtp priority commands. If the minimum CIR is not configured, the bandwidth defaults to one half of the CIR. If all of the bandwidth is not allocated, the remaining bandwidth is allocated proportionally among the classes on the basis of their configured bandwidth.
To configure class policies in a policy map, perform the tasks described in the following sections. The task in the first section is required; the tasks in the remaining sections are optional.
Configuring Class Policy for a Priority Queue
To configure a policy map and give priority to a class within the policy map, use the following commands beginning in global configuration mode:
Configuring Class Policy Using a Specified Bandwidth
To configure a policy map and create class policies that make up the service policy, use the following commands beginning in global configuration mode:
To configure more than one class in the same policy map, repeat Step 2 and Step 3.
Configuring the Class-Default Class Policy
The class-default class is used to classify traffic that does not fall into one of the defined classes. Even though the class-default class is predefined when you create the policy map, you still have to configure it. If a default class is not configured, then traffic that does not match any of the configured classes is given best-effort treatment, which means that the network will deliver the traffic if it can, without any assurance of reliability, delay prevention, or throughput.
To configure a policy map and the class-default class, use the following commands beginning in global configuration mode:
Attaching the Service Policy
To attach a service policy to the output interface and enable LLQ for IPsec encryption engines, use the following command in global configuration mode:
Verifying Configuration of Policy Maps and Their Classes
To display the contents of a specific policy map or all policy maps configured on an interface, use the following commands in EXEC mode, as needed:
Monitoring and Maintaining LLQ for IPsec Encryption Engines
To monitor and maintain LLQ for IPsec encryption engines, use the following command in EXEC mode:
Step 1
Router# show crypto eng qos
Displays quality of service queueing statistics for LLQ for IPsec encryption engines.
For a more detailed list of commands that can be used to monitor LLQ for IPsec encryption engines, see the "Verifying Configuration of Policy Maps and Their Classes" section.
Configuration Examples
This section provides the following configuration example:
•
LLQ for IPsec Encryption Engines Example
In the following example, a strict priority queue with a guaranteed allowed bandwidth of 50 kbps is reserved for traffic that is sent from the source address 10.10.10.10 to the destination address 10.10.10.20, in the range of ports 16384 through 20000 and 53000 through 56000.
First, the following commands configure access list 102 to match the desired voice traffic:
Router(config)# access-list 102 permit udp host 10.10.10.10 host 10.10.10.20 range 16384 20000Router(config)# access-list 102 permit udp host 10.10.10.10 host 10.10.10.20 range 53000 56000Next, the class map voice is defined, and the policy map called policy1 is created; a strict priority queue for the class voice is reserved, a bandwidth of 20 kbps is configured for the class bar, and the default class is configured for WFQ. The service-policy command then attaches the policy map to the fas0/0.
Router(config)# class-map voiceRouter(config-cmap)# match access-group 102Router(config-cmap)# exitRouter(config)# policy-map policy1Router(config-pmap)# class voiceRouter(config-pmap-c)# priority 50Router (config-cmap-c)# exitRouter(config-pmap)# class barRouter(config-pmap-c)# bandwidth 20Router(config-cmap-c)# exitRouter(config-pmap)# class class-defaultRouter(config-pmap-c)# fair-queueRouter(config-cmap-c)# exitRouter(config-cmap)# exitRouter(config)# interface fastethernet0/0/0Router(config-if)# service-policy output policy1CCDE, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0812R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007-2009 Cisco Systems, Inc. All rights reserved.
