I really need some research :S
Anyway thanks a lot.

Rack20R1#traceroute
Protocol [ip]:
Target IP address: 255.255.255.255
Source address: 173.20.12.1
Numeric display [n]:
Timeout in seconds [3]:
Probe count [3]: 1000
Minimum Time to Live [1]:
Maximum Time to Live [30]:
Port Number [33434]: 33434
Loose, Strict, Record, Timestamp, Verbose[none]:
Type escape sequence to abort.
Tracing the route to 255.255.255.255

Apparently this was filed as a bug and changed. Per the bug toolkit:

CSCin97871 Bug Details
Invalid source address 255.255.255.255 accepted in all IP SLA probes

Symptom:
——-

Operation parameters such as the source-ipaddress and destination-ipaddress
can be configured using an all broadcast address as a valid input.
This is however incorrect as operations cannot currently handle responses
from multiple destinations for a single request.

Conditions:
———

No special conditions exist and all operations that include
source-ipaddress and/or destination-ipaddress accept the erronous input.

Workaround:
———-

Do not configure broadcast addresses for source and destination.

on R3 interace leading to R2
ip directed broadcast
on R3 interface leading to R4
ip multicast helper-map _GrAddr_ _broadcast address of segment between R2-R3_ _ACL_
am i right?

and PIM is enabled on all interfaces,except R3 interface leading to R2.
then how to use multicast-helper to get traffic from SW1 to SW2?

Thanks.

OK we have two directions incoming/outgoing. DSCP tables are for 64 DSCP values, and each cell is displays the number of packets bearing this particular DSCP value. As you see, for DSCP tables we have 16 rows and 4 columns, and the DSCP values are depicted on the left part of the screen.

The same goes to CoS tables, just they have only 8 values (2 rows by
4 columns)

Now if you mark packets on ingress, you will be able to see the new
marking only on the egress port (where the packets get switched too). This is not like 3550, where you can monitor specific DSCP values ingress on each port.

This method would work with any switch supporting RSPAN VLANs. AFAIK 3500XL/2900XL do not support RSPAN functionality, so you won’t be able to use this trick there.

Well they invented IPv6 just so that you won’t need to do any NAT

Actually, even NAT-PT is considered as a historic transition mechanism, because of it’s poor scalability and application layer issues.

If you want access restrictions use IPv6 firewalls, and if you use site-local IPv6 addressing either deploy a global IPv6 addressing or use application level proxies..

Remember, NAT is a hack, and you’d better avoid it at any cost

Thanks for this, I was wondering however if there is any way to do simple IPv6 to IPv6 NAT or PAT?

Currently a lot of businesses use private addressing for the security aspect of it, so the internet cannot directly access their devices - is there any way to do this in IPv6 or do you require the use of firewalls / ACL’s?

Thanks

Best regards!

Is this explained somewhere in cisco DocCD ?

Thanks,
Navid

A/ “normal” interpretation :
- source
- destination

B/ as a “prefix-list”
- address
- mask

C/ as a “who/what”
- who advertises this subnet
- what subnet is concerned

Interpretation B will be used in a route-map used :
- for redistribution betwen 2 IGPs
- for a “distribute-list ROUTE_MAP in” for BGP

Interpretation C will be used in a route-map used :
- for a “distribute-list ROUTE_MAP in” for an IGP

Is this correct ?
Is there a logic / a reason behind this behavior ?

Thanks,
Navid

How does the IOS know if this extended ACL should be interpreted as :

- a “normal” ACL (i.e. source/destination pair)
- or like a prefix-list (i.e. address/mask pair) ?

Thanks,
NAvid

I had not been able to identify why. Any hint ?

Thanks,
Navid

Petr can you please comment on if we can use uplink port for marking as Pete said!

Thanks

Thanks
BTW, a good short and nice recap of the QoS!
thanks for contribution…

Pushkar Bhatkoti

Which begs a question; as quoted by yourself in this article “The biggest obstacle is absence of any good information source on the 3750/3560 switches QoS, besides the Cisco Documentation site, which has really poor documents regarding both models.”

The question I have is, how do you go about finding the true facts of these things? I can spend days reading through Cisco docs, all contradicting themselves and at the end, be none the wiser - what’s the trick?

Big thanks again, look forward to the next article.

Regards,
Steve

Thanks

Just be careful form the voice guys, they may make the phone calls and may disturb you.!

Cheers

Regrettably, I have not found a working link from the UniverCD to it. Cisco has been moving stuff off the UniverCD so it is becoming increasingly unreliable.

I’m hoping they’ll be more specific than “all control traffic” because if you consult ten different web sites, you’ll get eleven different answers as to what represents a comprehensive list.

Correct, since IP packets will be marked based on the default CoS value assigned to the port.

AFAIR, there is no command to monitor queue usage on 3550; you can just monitor the classification/marking results on any specific port.

Though you may apply the PPPV on a static access-port it does not make any real sense, due to the fact there is only one VLAN on a port. You may as well just use the regular ingress policer for this task.

Thanks for another great article!
Have some questions though. Under the section 2b in this article, I interpret the way you write as that the dscp-cos and cos-to-queue mappings are related to each other, (that if you’d like to map cos-queue you have to map dscp-cos). But can’t you just re-map cos-to-queue without manipulating dscp-cos, leaving the dscp-cos mapping to its default values? Is there any depedencies between the two to make things work? Or is your intention just to point out _HOW_ to remap dscp-cos, (in this case dscp 56 normally assigned to cos 7, to be cos 4 instead)?

Also, is there a way to monitor the use of the queues/buffers on FE ports in the 3550?

And my last question, when does it make sense to classify packets on a static-access port via the per-port per-VLAN feature? From the DocCD; “It is supported only on an ingress port configured as a trunk or as a static-access port. ” I can see that it makes sense using it on trunk ports.

Thanks in advance.

Sure, using the same techniques as on any switchport. However, an uplink to a router is usually a link towards the network core. Packets that arrive on that link should have been already classified and marked. Therefore, on the uplink ports, QoS marking is usually simply trusted.

Thanks.

I would also like to reiterate Darra’s plea for an article on QoS for the 3560.

Petr, your articles have been exceptional — please keep them coming!

Would you expand on this topic by exploring the complexities that will be encountered when shifting from dual 3550’s to a mixture of dual 3550’s & dual 3560’s.

Best Regards

you forgot “mls qos trust cos” on Fa 0/4. In order to mark packets with the default CoS value, a port should be configured in CoS-trust mode.

Great Article !! This ccie blog has given me me a lot of insights .

I have one question : You say that that the cos value is used to determine a DSCP value and that a COS value also can be set on an access port.
That’s is strange to me because I thought that a COS value is used in trunk headers , so I performed a small test .

R4———–Fa0/4 SW1 Fa0/6———–R6

Config SW1
Current configuration : 122 bytes
!
interface FastEthernet0/4
switchport access vlan 4
switchport mode access
mls qos cos 2
spanning-tree portfast
end

sw4(config-if)#do sho run int fa0/6
Building configuration…

Current configuration : 135 bytes
!
interface FastEthernet0/6
switchport access vlan 4
switchport mode access
service-policy output DSCP
spanning-tree portfast
end

class-map match-all DSCP
match ip dscp cs2
policy-map DSCP
class DSCP
police 8000 8000 exceed-action drop

When I check my cos-dscp value my value of 2 should give me a dscp of 16 so he should police on 8 kbit but he’s not doing this …

What is my mistake ?

gr
wim

Please add a comment or two on Fallback Bridging - as much simple as the technology may be, there are a few real life scenarios where I saw the need for this technology.

Also please add a comment on Multicast Routing from a Catalyst perspective covering Layer 2 and Layer 3 and Inter VLAN multicast routing.

Sincerely,

Rama

As my lab day was wrapping up, the proctor posted the estimated times when the exams would be graded. The oddest part about it was that he had written 2 columns with our names under them. Out of the 6 R&S candidates, 5 were in column 1 and mine in column 2. Since my name was set apart from everyone else, I was extremely worried at this point. This could either mean I passed, failed, or my answers needed more analysis.

Judging by my end result of passing, I can only think that the proctors knew that I had achieved the 80 points, which was why I was segregated from the rest.

Instead of refering to ? as a true/false operator, you could you Cisco’s explanation, which I think is a bit more enlightning:

“? - Matches zero or one occurrence of the pattern. (Precede the question mark with Ctrl-V sequence to prevent it from being interpreted as a help command.) ”

P.S.- Great blog!
“

The AND operation will result in an address that has the “common” up bits in addresses A & B. The XOR operation will result in a wildcard that’ll have bits set to one for the parts of the addresses that are not equal.

Therefore you’ll check an address with the bits that are common between A & B, with a wildcard that tells the router to ignore the bits that are not common (since the XOR operation will only give a 1 result when two bits are different).