QoS Configuration on Huawei S5700: MQC and ACL-based Simplified Traffic Policy

Configuration Roadmap

Figure 1-1 MQC configuration

As shown in Figure 1-1, MQC configuration includes the following steps:

1. Configure traffic classifiers. A traffic classifier defines a group of matching rules for classifying packets.
   Run the traffic classifier classifier-name [ operator { and | or } ] command to create a traffic classifier and enter the traffic classifier view. In the traffic classifier view, run if-match commands to define matching rules. An example is as follows:

   <HUAWEI> system-view 
   [HUAWEI] traffic classifier c1              //Create traffic classifier c1 and enter the traffic classifier view.
   [HUAWEI-classifier-c1] if-match vlan-id 10    //Match packets with the VLAN ID 10 in the traffic classifier.
   [HUAWEI-classifier-c1] quit                    //Return to the system view.

2. Configure traffic behaviors. A traffic behavior defines actions to be taken for a type of packets, such as packet filtering, redirection, traffic policing, and traffic statistics collection.

   Run the traffic behavior behavior-name command to create a traffic behavior and enter the traffic behavior view. In the traffic behavior view, define actions such as deny, permit, redirect, car, and remark. An example is as follows:

   [HUAWEI] traffic behavior b1              //Create traffic behavior b1 and enter the traffic behavior view.
   [HUAWEI-behavior-b1] statistic enable       //Define the action of traffic statistics collection in the traffic behavior.
   [HUAWEI-behavior-b1] quit                    //Return to the system view.

3. Configure traffic policies. A traffic policy binds traffic classifiers and traffic behaviors, so actions defined in traffic behaviors are taken on classified packets.
   Run the traffic policy policy-name command to create a traffic policy and enter the traffic policy view. Then run the classifier classifier-name behavior behavior-name command to bind traffic classifiers to traffic behaviors. An example is as follows:

   [HUAWEI] traffic policy p1                              //Create traffic policy p1 and enter the traffic policy view.
   [HUAWEI-trafficpolicy-p1] classifier c1 behavior b1       //Bind traffic classifier c1 to traffic behavior b1.
   [HUAWEI-trafficpolicy-p1] quit                              //Return to the system view.

   Each traffic policy can be bound to one or more pairs of traffic classifiers and traffic behaviors.

   In a traffic policy, a traffic classifier can be bound to only one traffic behavior, but a traffic behavior can be bound to one or more traffic classifiers.

4. Apply a traffic policy. Apply a traffic policy to the system, an interface, or a VLAN. After the traffic policy is applied, the device performs the action defined in the traffic behavior on the packets that match traffic classification rules on the system, on an interface, or in a VLAN.
   Run the traffic-policy policy-name { inbound | outbound } command in the interface view or VLAN view to apply a traffic policy to an interface or a VLAN. Alternatively, run the traffic-policy policy-name global { inbound | outbound } [ slot slot-id ] command in the system view to apply the traffic policy to the system. An example is as follows:

   [HUAWEI] interface GigabitEthernet0/0/1                    //Enter the interface view.
   [HUAWEI-GigabitEthernet0/0/1] traffic-policy p1 inbound       //Apply the traffic policy p1.
   [HUAWEI-GigabitEthernet0/0/1] quit                              //Return to the system view.

   Only one traffic policy can be applied in one direction on the system, on each interface, or in each VLAN. When you run the traffic-policy command in the system view, interface view, or VLAN view to apply a traffic policy, you need to specify inbound or outbound to implement policy control on incoming packets (packets sent by the device) or outgoing packets (packets received by the device).

   Traffic policies can be applied to physical interfaces, Ethernet sub-interfaces, Eth-Trunk interfaces, Eth-Trunk sub-interfaces, port groups, and VLANIF interfaces.

Matching Rules in a Traffic Classifier

You can run the if-match command to configure matching rules for a traffic classifier. A traffic classifier can define multiple matching rules.

Common matching rules include the MAC address, 802.1p priority, EXP priority, IP precedence, DSCP priority, VLAN ID, ACL, ACL6, all packets, outbound interface, inbound interface, flow ID, and VXLAN Network Identifier (VNI) of Virtual eXtensible Local Area Network (VXLAN) packets.

Actions in a Traffic Behavior

Multiple actions can be defined in each traffic behavior, and each action corresponds to a specific QoS service. Non-conflicting actions can be defined in the same traffic behavior and take effect simultaneously.

Supported QoS Services

You can configure QoS services by binding matching rules to actions. MQC supports more matching rules and actions than ACL-based simplified traffic policies. Therefore, MQC supports more QoS service configurations.

• ACL rules can be defined in both MQC and ACL-based simplified traffic policies.
• Both MQC and ACL-based simplified traffic policies support packet filtering, packet priority re-marking, VLAN ID re-marking, destination MAC address re-marking, redirection, traffic statistics collection, traffic policing, and flow mirroring.
• Only ACL-based simplified traffic policies support packet filtering, redirection, and re-marking for packets matching user ACLs.
• Only MQC supports matching rules based on the VLAN ID, IP precedence, DSCP priority, 802.1p priority, EXP priority, flow ID, application name, destination MAC address, source MAC address, inbound interface, outbound interface, and protocol type field in the Ethernet frame header.
• Only MQC supports actions such as flow ID re-marking, hierarchical traffic policing, disabling MAC address learning, selective QinQ, and canceling the deny rule in an ACL or ACL6.

Configuration Flexibility

An ACL-based simplified traffic policy can match only a single ACL or both Layer 2 and Layer 3 ACLs, and perform packet filtering, re-marking, redirection, traffic statistics collection, or flow mirroring on packets matching specified conditions. In most cases, to perform different actions on the same type of packets, you need to configure an ACL-based simplified traffic policy for each action. For example, to perform traffic policing and traffic statistics collection on incoming packets that match ACL 3000 globally, run the traffic-limit inbound acl 3000 cir cir-value and traffic-statistic inbound acl 3000 commands in the system view. However, in the scenario where ACL-based traffic policing is configured, you can directly specify remark-8021p or remark-dscp to enable the device to re-mark 802.1p or DSCP priorities of packets, without configuring an ACL-based simplified traffic policy for each action.

Configuration Simplicity

ACL-based simplified traffic policies are easier to configure than MQC. To configure an ACL-based simplified traffic policy, you only need to run one command such as traffic-limit, traffic-filter, or traffic-redirect in the system or interface view and reference an existing ACL in the command. To configure MQC, you must configure a traffic classifier, configure a traffic behavior, configure a traffic policy, and apply the traffic policy.

Examples

In the following examples, network interconnection is implemented by default, and only QoS-related configurations are provided.

Example 1: Restricting Mutual Access Between Different Network Segments

Service requirements: GE0/0/1, GE0/0/2, and GE0/0/3 of the device are connected to network segment A (192.168.1.1/24), network segment B (192.168.2.1/24), and network segment C (192.168.3.1/24), respectively. The three network segments communicate with each other through the device. It is required that the host on network segment A be allowed to access the host on network segment B, but the host on network segment A not be allowed to access the host on network segment C.

# 
acl number 3001                                                                 
 rule 5 deny ip source 192.168.1.1 0.0.0.255 destination 192.168.3.1 0.0.0.255
 rule 10 permit ip source 192.168.1.1 0.0.0.255 destination 192.168.2.1 0.0.0.255  
# 
traffic classifier c1 operator or
 if-match acl 3001                                                                    
#
traffic behavior b1 
 permit
# 
traffic policy p1 match-order config
 classifier c1 behavior b1 
# 
interface GigabitEthernet0/0/1  
 traffic-policy p1 inbound 
#

# 
acl number 3001                                                                 
 rule 5 deny ip source 192.168.1.1 0.0.0.255 destination 192.168.3.1 0.0.0.255
 rule 10 permit ip source 192.168.1.1 0.0.0.255 destination 192.168.2.1 0.0.0.255  
# 
interface GigabitEthernet0/0/1  
 traffic-filter inbound acl 3001 
#

Conclusion: In this example, service requirements are simple, so ACL-based simplified traffic policies are recommended.

Example 2: Configuring Traffic Policing and Re-marking Priorities for Different Service Packets

#
traffic classifier c1 operator or
 if-match vlan-id 120
traffic classifier c2 operator or
 if-match vlan-id 110
traffic classifier c3 operator or
 if-match vlan-id 100
#
traffic behavior b1
 car cir 2000 pir 10000 cbs 250000 pbs 1250000 green pass yellow pass red discard //Use the default configuration for red, yellow, and green packets. Green and yellow packets are allowed to pass through, and red packets are discarded. The same below.
 remark dscp ef
 statistic enable
traffic behavior b2
 car cir 4000 pir 10000 cbs 500000 pbs 1250000 green pass yellow pass red discard
 remark dscp af33
 statistic enable
traffic behavior b3
 car cir 4000 pir 10000 cbs 500000 pbs 1250000 green pass yellow pass red discard
 remark dscp af13
 statistic enable
#
traffic policy p1 match-order config
 classifier c1 behavior b1
 classifier c2 behavior b2
 classifier c3 behavior b3
#
interface GigabitEthernet0/0/1
 traffic-policy p1 inbound
#

# 
acl number 4001                                                                                                                     
 rule 5 permit vlan-id 120                                                                                                          
acl number 4002                                                                                                                     
 rule 5 permit vlan-id 110
acl number 4003                                                                                                          
 rule 5 permit vlan-id 100                                                                                                         
#
interface GigabitEthernet0/0/1  
 traffic-limit inbound acl 4001 cir 2000 pir 10000 cbs 250000 pbs 1250000                                                           
 traffic-remark inbound acl 4001 dscp ef                                                                                            
 traffic-statistic inbound acl 4001                                                                                                 
 traffic-limit inbound acl 4002 cir 4000 pir 10000 cbs 500000 pbs 1250000                                                           
 traffic-remark inbound acl 4002 dscp af33                                                                                          
 traffic-statistic inbound acl 4002                                                                                                 
 traffic-limit inbound acl 4003 cir 4000 pir 10000 cbs 500000 pbs 1250000                                                           
 traffic-remark inbound acl 4003 dscp af13                                                                                          
 traffic-statistic inbound acl 4003                                                                                                 
#

Conclusion: In this example, the MQC configuration logic is clear, so that you can add or modify matching rules and actions based on the MQC configuration logic. In addition, you do not need to configure ACLs. ACL-based simplified traffic policies are easy to understand and configure for users who are familiar with ACLs.