The diff-serve model that we just got done talking about involves a series of
independent devices that are all configured to deliver a certain level of
service to our traffic. So if we have, for example, a voiceover IP packet come
through, then we might want to reserve 10% of the network bandwidth for that
voiceover IP stream as well as any other voiceover IP streams that happen to be
present. And so that's well and good other than we need to make sure that all
of these independent devices are properly configured. Now yes, we could have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of these independent devices are properly configured. Now yes, we could have
software that tries to standardize this and push configurations out at the same
time. I mean there are ways that we can configure this potentially as a system,
but strictly speaking from a diff-serve perspective, we have a little bit of a
problem to address even when configuration is synchronized. And that is
that as this packet traverses the network, we need to understand that this is a
voiceover IP packet. Remember that int-serve model, if we had been using int- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
voiceover IP packet. Remember that int-serve model, if we had been using int-
serve,
we could have reserved an entire traffic stream, or at least enough bandwidth
for
this traffic stream throughout the entire network, and that way the network
knows
that this traffic stream is coming, it can recognize it and treat it
accordingly.
But with diff-serve because each one of these devices is independent, it needs
to
perform its own policy enforcement. Again, in this case, reserving 10% of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
perform its own policy enforcement. Again, in this case, reserving 10% of
bandwidth
and potentially putting that voiceover IP packet into a priority queue and all
things we're going to be talking about here as we move forward. And so the
question is how does it know whether a packet is a voiceover IP packet? This is
the big problem. We need to recognize that this came from a phone and so maybe
there's a phone directly connected to this first hop and so we say, "Okay, well
traffic coming from the phone must be voiceover IP." But then how does the next
device handle this? We need to be able to look at a packet and know what it is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
device handle this? We need to be able to look at a packet and know what it is.
And yeah, we could unpack the entire packet and look at all of the metadata in
here and all the ones and zeros and try to figure out that this is a voiceover
IP
packet but this is going to require a whole lot of processing power in order
to try to figure out and ultimately we don't want to perform guesswork in any
sense. We'd rather just explicitly know what types of traffic we're supposed to
treat certain ways. And keep in mind that even though voiceover IP is an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
treat certain ways. And keep in mind that even though voiceover IP is an
important part of a QOS deployment, it's not the only traffic stream that we
want
to be able to recognize and enforce policy against. We might have other
traffic streams that are going to be given 40% of the bandwidth or whatever
the situation is. And so we need a way to identify this packet and so this is
going to lead us to that conversation of classification which is ultimately WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to lead us to that conversation of classification which is ultimately
going to rely on marking. Now we might use the formal terms classification and
marking. Ultimately classification is just that conversation of identification.
How do I know what type of packet this is? That's the question we're trying to
answer. And so yeah, there's a lot of different ways we can do that but in our
case we're going to use marking which is sometimes referred to as tagging. We WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
case we're going to use marking which is sometimes referred to as tagging. We
're
going to insert a tag into the packet that performs the identification of that
packet. So that's why classification and marking as a term are usually stated
together. So now what we're going to do is we're going to take this packet and
because this is a voiceover IP packet we're going to put a tag inside of this
packet. So it's going to include this tag sort of like how we include a VLAN
tag
into an ethernet header. We're going to insert this a tag into either the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
into an ethernet header. We're going to insert this a tag into either the
ethernet header or potentially the IPv4 or IPv6 header either way. We have
options for both of these. And so this tag is going to perform the
identification
that says hey this is a voiceover IP packet. So our phone that's going to send
this packet is going to insert the tag on for the sake of the rest of the
network.
That way the network doesn't have to try to figure out what type of packet this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That way the network doesn't have to try to figure out what type of packet this
is it can just look at the tag. So what exactly is this tag? Well the tag is a
numerical value and the meaning of the tag is up to us. We've just mentioned
this
word policy. If I want a router to exert a particular policy enforce a
particular policy on a packet well I can look at the tag and that tag can have
meaning to me but it's not maybe a value that necessarily has meaning to others WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
meaning to me but it's not maybe a value that necessarily has meaning to others
.
I have to decide what the value of this particular numerical tag is supposed to
represent. So what numbers mean what? Well to some extent that's up to us. We
can
assign a value let's say 5 and we can map that to voiceover IP and we could
take something like a value of 2 and map that to bulk traffic. These numerical
values can have significance within the network without necessarily meaning the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
values can have significance within the network without necessarily meaning the
same thing from every network to every network. Now there is some amount of
industry standardization to suggest for example that a tag of 5 is going to
represent voiceover IP. We'll find a lot of ideas out there about how exactly
we
should be tagging traffic so that there is a little bit of standardization. But
it's not something that is required. I could in my network make it so that we
've
got a tag of 2 representing bulk traffic but in your network a tag of 2 might WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
got a tag of 2 representing bulk traffic but in your network a tag of 2 might
represent video traffic. Is that best practice? Well again there's the
industry has been standardizing on this for a long time as far as which values
should represent what. But the only place is that it's going to ultimately be
dictated for us is something like this where a Cisco phone is always going to
tag its voiceover IP packets with a tag of 5. So if there's an end device that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tag its voiceover IP packets with a tag of 5. So if there's an end device that
sort of enforces the meaning of a particular tag then we should use that
tag. Otherwise to some extent it's up to us. Now later on we're going to talk
about the concept of per-hot behaviors. These are essentially ways that the
industry has said hey if you want a traffic to be treated a particular way
like this specific way a high priority a low priority a higher drop priority
those kinds of things then they have set aside specific values to mean that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those kinds of things then they have set aside specific values to mean that.
And
that's important because if I'm a consultant and I sit down at your in your
network and I'm trying to help fix your QOS issues if you are using the
industry standard recommendations for your tags then I can help troubleshoot
that a lot more. If you just are saying well you know I can use whatever tag I
want and so yeah I'll use 5 for voiceover IP but I'm going to set by default
everything to use a tag of 1 and I'm going to set video to 0 and all of these
things that we don't really see a lot of it's going to be a lot harder for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
things that we don't really see a lot of it's going to be a lot harder for
someone like me as a consultant to troubleshoot and if you ever leave your
company has to hire somebody else they're going to look at it and say what was
this person thinking with deploying video with a tag of 0 for example. So
that's why it's important for us to look at the tags that are recommended and
again we are going to look at that here inside of this skill as far as which
tags mean what kinds of things. But understand that we define the policy we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are the ones who have to say because of this tag now we're going to enforce a
specific policy. Cisco routers are not built in such a way that you know if we
receive a tag of 2 for example that's going to treat it automatically in a
particular fashion we still have to define that policy even for voiceover IP
traffic. Now this classification concept is kind of interesting and raises a
big
concern because now we have to worry about what the downstream device is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
concern because now we have to worry about what the downstream device is.
It's great if we have a switch and I'm connecting to a phone and this phone is
tagging its traffic with again a value of 5. So the phone is tagging its
traffic
and now because of this I place this onto this link with a very high priority.
It's high priority we have bandwidth reservations we have all kinds of things
going on here when your tag is 5 because 5 means voiceover IP. So that's great WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going on here when your tag is 5 because 5 means voiceover IP. So that's great
except what happens if I also have a user with a laptop and this user is
smart enough with networking to understand that tags of 5 are usually
treated pretty well. Well because this is now a little bit of a malicious user
here maybe not necessarily a hacker but somebody who's not really thinking
about the good of the network what if they start tagging their traffic with 5 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
about the good of the network what if they start tagging their traffic with 5
as well because they want their traffic to be treated with a higher
priority level and maybe that's the best case scenario the worst case scenario
is
it could be somebody who's trying to cause damage to my network and they want
to split this bandwidth and take up all the phone bandwidth something along
those
lines. So this is going to lead us to a conversation about trust and
specifically
what we're going to call the trust boundary. So the trust boundary basically WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what we're going to call the trust boundary. So the trust boundary basically
answers the question of who do we trust and the short answer is we want to
trust
our network devices and we want to not trust end user devices. So here's what
this looks like. We might draw the we are going to draw a trust boundary here
to say that we are not going to trust anything down here so this is the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to say that we are not going to trust anything down here so this is the
untrusted domain but we are going to include the phone in here because this
is part of the trusted domain. I want to trust the phone and I know it's a
phone
because I have CDP going I can tell it's a phone it's maybe it's a Cisco phone
and so I can trust the tags that I'm receiving from it but I'm not going to
trust the tags that receive from these other devices. When we receive a packet
on an untrusted interface we are going to wipe the tag. This is the behavior WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on an untrusted interface we are going to wipe the tag. This is the behavior
that
we're looking for. So this tag of five enters into the untrusted domain or
enters into the trusted domain from the untrusted domain and the switch is
going
to wipe it and set that tag to zero. This way regardless of this person's
intentions they cannot insert their packets into the cues that are designed
for voice over IP traffic. Now one other thing in all of this is we might find WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for voice over IP traffic. Now one other thing in all of this is we might find
that we have laptops or PCs for that matter that connect into our phones.
The phones are designed for this they have a little tiny switch inside of the
phone so that we can bring traffic in and then send it upstream. It makes it so
we don't have to make two runs one to the phone and one to the PC. So that's
great and all except again look at the trust boundary we want to make sure that
this is part of that untrusted domain. So what does that mean? Well what that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this is part of that untrusted domain. So what does that mean? Well what that
means is the phone is going to receive a packet and it's going to participate
in
this trust model and it's going to wipe those tags as they come in. So the tags
the classification the marking is going to be under our control. We want to
make
sure that only our devices are performing tagging that we only trust our own
devices and that's going to enable every device hop by hop to look very simply
at what that packet is based on the marking and then it can classify that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at what that packet is based on the marking and then it can classify that
packet know that for example it's a voice over IP packet and then we can
enforce the proper policy against it.