1 / 12

JANET-BMAS

JANET-BMAS. Cisco NBAR. Cisco NBAR. Ben Horner George Neisser Ben.Horner@mcc.ac.uk George.Neisser@mcc.ac.uk. Introduction. BMAS To keep abreast of the latest developments, technologies and standards in bandwidth management To trial and evaluate products

mcconkey
Download Presentation

JANET-BMAS

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. JANET-BMAS Cisco NBAR

  2. Cisco NBAR Ben Horner George Neisser Ben.Horner@mcc.ac.uk George.Neisser@mcc.ac.uk

  3. Introduction • BMAS • To keep abreast of the latest developments, technologies and standards in bandwidth management • To trial and evaluate products • To assess their usefulness and applicability within UK education • To produce advisory materials, usage guidelines and recommendations • BMAS web site: http://www.bmas.ja.net/ • To collaborate with organisations • NBAR • What can it do? • How is it applied? • BMAS Results • What can’t it do?

  4. What is NBAR? • Cisco: • Intelligent classification engine used with Quality of Service (QoS) class-based features • Protocol Discovery analyses application traffic patterns in real time and identifies which traffic is running on the network • Capable of classifying applications that have: • Statically assigned TCP and UDP port numbers • Non-TCP and non-UDP IP protocols • Dynamically assigned TCP and UDP port numbers during connection establishment • Classification based on deep packet inspection: NBAR can look deeper into the packet to identify applications • HTTP traffic by URL, host name or MIME type using regular expressions (*, ?, [ ]), Citrix ICA traffic, RTP Payload type classification • Currently supports 88 protocols/applications

  5. S D S D What can NBAR do? LOCAL CAMPUS Bottleneck causes traffic to back up into queues that are all given best effort NBAR can stop KaZaA and give priority to the video conference traffic 2Mb/s WAN INTERNET Key: HTTP KaZaA Video Conference

  6. Applying NBAR • Get the latest IOS and PDLMs • Enable NBAR on your interfaces • Collect and analyse results • Decide upon and create classes • Decide upon and create policies • Apply policies to interfaces • Collect and analyse results • Modify classes and policies appropriately

  7. Example Router# conf t Router(config)# ip cef Router(config)# int eth0/0 Router(config-if)# ip nbar protocol-discovery Router(config-if)# exit Router(config)# int se0/0 Router(config-if)# ip nbar protocol-discovery Router# show ip nbar protocol discovery int eth0/0 top 3 FastEthernet0/0 Input Output Protocol Packet Count Packet Count Byte Count Byte Count 5 minute bit rate (bps) 5 minute bit rate (bps) ------------------------ ------------------------ ------------------------ ftp 64175242 45153848 89351513113 2484576000 1073000 28000 http 58194017 32519125 82356099996 1958417833 924000 22000 netshow 161827 76694 211785210 4328663 0 0 unknown 151860 24174 103546921 1594651 0 0 Total 123055877 77838212 172435146582 4477038399 1997000 50000

  8. Example continued… Router(config)# class-map match-any streams Router(config-cmap)# match protocol rtp Router(config-cmap)# match protocol rtsp Router(config-cmap)# match protocol netshow Router(config-cmap)# match ip dscp ef Router(config-cmap)# exit Router(config)# policy-map dscp_mark Router(config-pmap)# class streams Router(config-pmap-c)# set ip dscp ef Router(config-pmap-c)# exit Router(config-pmap)# exit Router(config)# policy-map apply_qos Router(config-pmap)# class streams Router(config-pmap-c)# bandwidth 600 Router(config-pmap-c)# exit Router(config-pmap)# class class-default Router(config-pmap-c)# fair-queue Router(config-pmap-c)# exit Router(config-pmap)# exit Router(config)# int eth0/0 Router(config-if)# service-policy input dscp_mark Router(config-if)# exit Router(config)# int se0/0 Router(config-if)# service-policy output apply_qos Router(config-if)# exit Router(config)# exit Router# show running-config class-map match-any streams match protocol rtp match protocol rtspplayer match protocol netshow match ip dscp ef ! ! policy-map input_mark class stream set ip dscp ef policy-map apply_qos class stream bandwidth 600 class class-default fair-queue

  9. Example continued… Router# show policy-map int eth0/0 Ethernet0/0 Service-policy input: dscp_mark Class-map: stream (match-any) 130521 packets, 97066868 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: protocol rtp 0 packets, 0 bytes 5 minute rate 0 bps Match: protocol rtspplayer 117857 packets, 79344153 bytes 5 minute rate 0 bps Match: protocol netshow 12664 packets, 17722715 bytes 5 minute rate 0 bps Match: ip dscp ef 0 packets, 0 bytes 5 minute rate 0 bps QoS Set dscp ef Packets marked 130521 Class-map: class-default (match-any) 175792 packets, 231418813 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any

  10. BMAS NBAR Results

  11. What can’t NBAR do? • It’s not a magic wand • It doesn’t recognise everything (but what does?) • Requires the very latest IOS and PDLMs to be fully effective • You can create your own PDLMs(ish) ip nbar custom lunar_light 8 ascii Moonbeam tcp range 2000 2999 • NBAR is quite crude. Queues and drops rather than shapes. • It will add a CPU overhead • NBAR is not particularly easy to configure/get right • It probably will improve as it becomes a more accepted method of bandwidth management

  12. Further Information • Cisco presentations and documentation • NBAR Overview (12.2T) • http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide09186a0080087cd0.html • Code Red virus blocking: • http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00800fc176.shtml • Nimda virus blocking • http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_tech_note09186a0080110d17.shtml • Many NBAR presentations and papers • http://www.cisco.com/warp/public/732/Tech/qos/nbar/ • NBAR Protocol Discovery MIB • www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t15/ftpdmib.htm • BMAS website • http://www.bmas.ja.net • Contact me • ben.horner@mcc.ac.uk Thank you

More Related