The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Feature History
|
|
Cisco IOS XE Release 2.1 |
This feature was introduced on Cisco ASR 1000 Series Routers. |
This feature module describes the LLQ for IPsec encryption engines feature and includes the following sections:
•Supported Standards, MIBs, and RFCs
•Monitoring and Maintaining LLQ for IPsec Encryption Engines
LLQ for IPsec encryption engines helps reduce packet latency by introducing the concept of queueing before crypto engines. Prior to this, the crypto processing engine gave data traffic and voice traffic equal status. Administrators now designate voice traffic as priority. Data packets arriving at a router interface are directed into a data packet inbound queue for crypto engine processing. This queue is called the best effort queue. Voice packets arriving on a router interface are directed into a priority packet inbound queue for crypto engine processing. This queue is called the priority queue. The crypto engine undertakes packet processing in a favorable ratio for voice packets. Voice packets are guaranteed a minimum processing bandwidth on the crypto engine.
The LLQ for IPsec encryption engines feature guarantees a certain level of crypto engine processing time for priority designated traffic.
Better Voice Performance
Voice packets can be identified as priority, allowing the crypto engine to guarantee a certain percentage of processing bandwidth. This feature impacts the end user experience by assuring voice quality if voice traffic is directed onto a congested network.
Improved Latency and Jitters
Predictability is a critical component of network performance. The LLQ for IPsec encryption engines feature delivers network traffic predictability relating to VPN. With this feature disabled, an end user employing an IP phone over VPN might experience jitter or latency, both symptoms of overall network latency and congestion. With this feature enabled, these undesirable characteristics are dissipated.
•No per-tunnel QoS policy. An interface QoS policy represents all tunnels.
•Assume the same IP precedence/DSCP marking for inbound and outbound voice packets.
•Assume that the IP precedence/DSCP marking for voice packets is done at the source.
•Limited match criteria for voice traffic in the interface QoS policy.
•Assume that call admission control is enforced within the enterprise.
•No strict error checking when aggregate policy's bandwidth exceeds crypto engine bandwidth. Only a warning is displayed, but configuration is allowed.
•Assume that voice packets are either all encrypted or unencrypted.
•Cisco IOS Quality of Service Solutions Command Reference
•"Applying QoS Features Using the MQC" module
Standards
No new or modified standards are supported by this feature.
MIBs
No new or modified standards are supported by this feature.
To locate and download MIBs for selected platforms, Cisco IOS XE Software releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
No new or modified RFCs are supported by this feature.
To use this feature, you should be familiar with the following:
•Access control lists
•Bandwidth management
•CBWFQ
To configure LLQ for IPsec encryption engines, perform the tasks described in the following sections.
•Defining Class Maps (required)
•Configuring Class Policy in the Policy Map (required)
•Configuring Class Policy for a Priority Queue (required)
•Configuring Class Policy Using a Specified Bandwidth (optional)
•Configuring the Class-Default Class Policy (optional)
•Attaching the Service Policy (required)
•Verifying Configuration of Policy Maps and Their Classes (optional)
To configure a policy map and create class policies that make up the service policy, begin with the policy-map command to specify the policy map name. Then use one or more of the following commands to configure the policy for a standard class or the default class:
•priority
•bandwidth
•queue-limit or random-detect
•fair-queue (for class-default class only)
For each class that you define, you can use one or more of the commands listed to configure the class policy. For example, you might specify bandwidth for one class and both bandwidth and queue limit for another class.
The default class of the policy map (commonly known as the class-default class) is the class to which traffic is directed if that traffic does not satisfy the match criteria of the other classes defined in the policy map.
You can configure class policies for as many classes as are defined on the router, up to the maximum of 64. However, the total amount of bandwidth allocated for all classes in a policy map must not exceed the minimum committed information rate (CIR) configured for the virtual circuit (VC) minus any bandwidth reserved by the frame-relay voice bandwidth and frame-relay ip rtp priority commands. If the minimum CIR is not configured, the bandwidth defaults to one half of the CIR. If all of the bandwidth is not allocated, the remaining bandwidth is allocated proportionally among the classes on the basis of their configured bandwidth.
|
|
|
---|---|---|
Step 1 |
Router(config)# policy-map policy-map |
Specifies the name of the policy map to be created or modified. |
Step 2 |
Router(config-cmap)# class class-name |
Specifies the name of a class to be created and included in the service policy. |
Step 3 |
Router(config-pmap-c)# bandwidth bandwidth-kbps |
Specifies the amount of bandwidth to be assigned to the class, in kbps, or as a percentage of the available bandwidth. Bandwidth must be specified in kbps or as a percentage consistently across classes. (Bandwidth of the priority queue must be specified in kbps.) Note To configure more than one class in the same policy map, repeat Step 2 and Step 3. |
|
|
|
---|---|---|
Step 1 |
Router# show crypto eng qos |
Displays quality of service queueing statistics for LLQ for IPsec encryption engines. |
This section provides the following configuration example:
•LLQ for IPsec Encryption Engines Example
In the following example, a strict priority queue with a guaranteed allowed bandwidth of 50 kbps is reserved for traffic that is sent from the source address 10.10.10.10 to the destination address 10.10.10.20, in the range of ports 16384 through 20000 and 53000 through 56000.
First, the following commands configure access list 102 to match the desired voice traffic:
Router(config)# access-list 102 permit udp host 10.10.10.10 host 10.10.10.20 range 16384 20000
Router(config)# access-list 102 permit udp host 10.10.10.10 host 10.10.10.20 range 53000 56000
Next, the class map voice is defined, and the policy map called policy1 is created; a strict priority queue for the class voice is reserved, a bandwidth of 20 kbps is configured for the class bar, and the default class is configured for WFQ. The service-policy command then attaches the policy map to the fas0/0.
Router(config)# class-map voice
Router(config-cmap)# match access-group 102
Router(config-cmap)# exit
Router(config)# policy-map policy1
Router(config-pmap)# class voice
Router(config-pmap-c)# priority 50
Router (config-cmap-c)# exit
Router(config-pmap)# class bar
Router(config-pmap-c)# bandwidth 20
Router(config-cmap-c)# exit
Router(config-pmap)# class class-default
Router(config-pmap-c)# fair-queue
Router(config-cmap-c)# exit
Router(config-cmap)# exit
Router(config)# interface fastethernet0/0/0
Router(config-if)# service-policy output policy1