Enterprise QoS Solution Reference Network Design Guide

Chapter 2 Campus QoS Design
Call Signaling Ports
Version 3.3
Enterprise QoS Solution Reference Network Design Guide
QoS Design Overview
Cisco does not recommend policing all traffic to 5 Mbps and automatically dropping the excess. If that
was the case, there would be no need to deploy FastEthernet or GigabitEthernet switch ports to endpoint
devices because even 10-BaseT Ethernet switch ports have more uplink capacity than a 5 Mbps
policer-enforced limit. Such an approach would also penalize legitimate traffic that did exceed 5 Mbps
on a FastEthernet switch port.
A less severe approach is to couple access layer policers with hardware/software (campus/WAN/VPN)
queuing polices, with both sets of policies provisioning for a less-than Best-Effort Scavenger class.
With this method, access layer policers mark down out-of-profile traffic to DSCP CS1 (Scavenger) and
then all congestion management policies (whether in Catalyst hardware or in IOS software) provision a
less-than Best-Effort service for any traffic marked to CS1 during periods of congestion.
This method works for both legitimate traffic exceeding the access layer policer’s watermark and also
for illegitimate excess traffic as a result of a DoS or worm attack.
In the former case, for example, assume that the PC generates over 5 Mbps of traffic, perhaps because
of a large file transfer or backup. Congestion under normal operating conditions is rarely if ever
experienced because there is generally abundant capacity to carry the traffic within the campus. This is
usually true because the uplinks to the distribution and core layers of the campus network are typically
GigabitEthernet and require 1000 Mbps of traffic from the access layer switch to congest. If the traffic
is destined to the far side of a WAN/VPN link, which is rarely over 5 Mbps in speed, dropping occurs
even without the access layer policer, because of the campus/WAN speed mismatch and resulting
bottleneck. TCP’s sliding windows mechanism eventually finds an optimal speed (under 5 Mbps) for the
file transfer. Thus, access layer policers that mark down out-of-profile traffic to Scavenger (CS1) do not
affect legitimate traffic, aside from the obvious remarking. No reordering or dropping occurs on such
flows as a result of these policers that would not have occurred in any event.
In the case of illegitimate excess traffic, the effect of access layer policers on traffic caused by DoS or
worm attacks is quite different. As many hosts become infected and traffic volumes multiply, congestion
may be experienced in the campus up-links due to the aggregate traffic volume. For example, if just 11
end-user PCs on a single access-layer switch begin spawning worm flows to their maximum FastEthernet
link capacities, the GigabitEthernet up-link to the distribution layer switch will congest, and
queuing/reordering will engage. At such a point, VoIP and critical data applications, and even Best Effort
applications, gain priority over worm-generated traffic. Scavenger traffic is dropped the most
aggressively, while network devices remain accessible for the administration of patches/plugs/ACLs
required to fully neutralize the specific attack.
WAN links are also protected. VoIP, critical data and even Best Effort flows continue to receive priority
over any traffic marked down to Scavenger/CS1. This is a huge advantage, because WAN links are
generally the first to be overwhelmed by DoS/worm attacks. Access layer policers thus significantly
mitigate network traffic generated by DoS or worm attacks.
You should recognize the distinction between mitigating an attack and preventing it entirely. The
strategy presented here does not guarantee that no Denial of Service or worm attacks will ever happen,
but serves only to reduce the risk and impact that such attacks have on the campus network infrastructure
and then, by extension, the WAN/VPN network infrastructure. Furthermore, while this strategy reduces
the collateral damage to the network infrastructure caused by DoS/worm attacks, it may not mitigate
other specific objectives of such worms, such as reconnaissance and vulnerability exploitation. Hence,
a comprehensive approach much be used to address DoS/worm attacks, involving a holistic integration
of security technologies with Quality of Service technologies.
In this design chapter, only Skinny Call Control Protocol (SCCP) ports (TCP Ports 2000–2002) are used
to identify call signaling protocols to keep the examples relatively simple.
2-5