In the previous video, we introduced the MQC,
see the modular quality of service CLI
that can be used to actually implement
control plan policing.
The first step of that is our class map,
and that's what this video is all about.
[MUSIC PLAYING]
So let's together strategize on some types of traffic
as we identify and create class maps that we want to go ahead
and first identify.
So, it's the three-step step process with MQC,
is to identify the traffic with the class map,
and that usually involves and access control
list to identify the traffic, and then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
list to identify the traffic, and then
we'll move onto a policy map, and apply it
with a service policy.
So, let's strategize for a moment
on some types of traffic, as an example,
that we can identify with the class map,
that we can then subsequently follow up
with restricting or policing in a policy map.
So, to pull this off, let's go ahead and create some class
maps, and I'll walk you through how to do that.
And let's have our class maps call
on some Access Control Lists, some extended ACLs that are
actually doing the matching.
And for the access control list, let's match on-- let's go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and pick ICMP.
And I'll provide some examples of how
we could match on various types of ICMP traffic.
And let's create an access control list
that looks for IPsec traffic--
and again, we'll provide some examples there--
and then maybe some management traffic, and that
could include things such as SSH traffic
for TCP port 22, and NTP, and other traffic
that we'd expect to have from a management station going
to the router.
And let's also create an access control
list that can match on our routing protocols.
So, our routing protocols may be OSPF, or IS-IS, or EIGRP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, our routing protocols may be OSPF, or IS-IS, or EIGRP.
And so what we're going to do is we can create individual class
maps that call on an ACL, and we can
have individual ACLs that would match on these respective types
of protocols.
So, it's a two-step process for identifying the traffic.
We'll create ACLs that match on the certain types of traffic,
and then we'll create class maps that call on those ACLs.
And here's what I propose we do is we go through this together.
I'd like to you go ahead and walk through each of the steps,
and then before we're finished with this entire set of videos,
I'll go ahead and present a hands-on lab
that you can do by clicking on the link for the virtual lab, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that you can do by clicking on the link for the virtual lab,
and then you can go ahead and practice it all from soup
to dessert using the techniques that we've done right here.
So, let's go to the CLI.
Let's create some access control lists.
We'll include them as class maps,
and that will be our first step in the modular quality
framework, and that is identifying the traffic that we
want to manipulate or control.
So, to make this less of a typing exercise and more
of an educational exercise, I've got
a little document with some basic ACLs
already set up that we're going to use
for this identifying the traffic that we want to control. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for this identifying the traffic that we want to control.
So, these access control lists will go inside of a class map,
and I'll walk you through both of those steps right now.
So let me go ahead and bring up Notepad here in the foreground.
So let me make this a little bit bigger
to make it easier to read.
I'll do a font, and let's go ahead and go to 16.
Fantastic little easier to read.
So this first part is going to take the configuration mode,
and we're creating an extended access
list that's going to match a permit for ICMP
from anywhere to anywhere if it's an echo reply,
or TTL exceeded, or ICMP unreachable, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or TTL exceeded, or ICMP unreachable,
or an echo request, and that's going to be
our first ACL called ICMP-ACL.
Then we'll make another one called
IPsec-ACL, and that's going to match on ESP,
which is protocol 50.
It's IPsec's protocol.
And it's also going to match on UDP any any equal isakmp,
and isakmp is UDP port 500.
That's used for IKE phase one.
And again, these are just examples
of what we could do to match on certain traffic
that we can then include as part of a class map.
If we scroll down a little bit further, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we scroll down a little bit further,
here we have a couple more.
We have an access list called Mgmt-ACL.
That's looking for NTP traffic, it's
looking for TCP traffic destined to port 22, which
would be SSH traffic, and then we have one for routing ACL,
and that is looking for BGP, and it's
looking for 224.0.0.5, 224.0.0.6, 224.0.0.10,
which are routing protocols that are
using those multicast local addresses.
And then we have 224.0.0.13, which is PIM--
protocol independent multicast-- and then
we have one that's looking for a IGMP, going from anywhere WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we have one that's looking for a IGMP, going from anywhere
to anywhere.
That would include IGMP version one, two, and three.
So, let's create these access control lists,
and then we can call on those access control lists
as part of our class maps.
Copy those, and let's do this on R1.
So, we'll get R1, I'll right click,
and that's just created those four access control lists.
If we do a do show access-lists, there they are.
One looking for ICMP traffic, one
looking for IPsec, one looking for management traffic, one
looking for our routing protocols.
Great.
So, we have four access control lists. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, we have four access control lists.
So, our next step is to create class maps, four class maps,
that each call on those respective ACLs,
and here's how to do that.
We'll go back to our Notepad document
and scroll down just a little bit.
And what we're doing here is we're creating four class maps.
The syntax is class-map space.
If you don't include match-any, it's
going to default to match-all.
And what that means is that, in this class
map, the conditions below, if you say match all,
they all have to match.
Now, in our examples here, we only
have one condition, and that is just this one ACL. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have one condition, and that is just this one ACL.
And in that ACL, we have lots of details,
but the match-any or match-all, if you only
have one entry in this class map, it means the same thing,
because there's only a single entry there.
So, this example, I'm saying match-any in case
we add additional access control lists
that can then become part of the parent class map
that they're part of.
So, this first class map called ICMP-Class
is including that ACL, and if it matches in that ACL,
it would be a hit, a yes, regarding this class map.
And then we have a class map that's called IPsec-Class, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we have a class map that's called IPsec-Class,
it calls and that ACL.
The Mgmt-Class calls on that ACL.
The Routing-Class calls on that ACL.
So, what I'll do is I'll highlight those, right click,
put those in my clipboard here, and go back
to the router, right click, and paste them in.
So, now we have four class maps that
are calling on for access control lists,
and that is step number one of the modular quality of service
CLI, and that is to identify the traffic
that we want to manipulate.
Now, the next step, once we have these class maps, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, the next step, once we have these class maps,
is we can specify what we want to do when we see that traffic.
And that part of the story with controlling
what we want to do when we see that traffic
is the story about the policy maps, which is step two,
and it's the topic for our very next video.
So, I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.