iMaster NCE - WAN QoS

Hi,

Today I'll be explaining the role of QoS on Application experience and how it can be applied through iMaster NCE-WAN. On traditional networks, QoS proves to be a key quality assurance technology that delivers integrated voice, video, and data services. In the SD-WAN Solution, QoS is also a key feature for enterprises to meet their multi-business differentiated service demands. The SD-WAN Solution provides diversified QoS functions for overlay and underlay networks, and uses iMaster NCE-WAN to orchestrate the QoS functions, thereby simplifying the QoS configuration and improving QoS usability.

QoS is mainly applied in the following scenarios:

• Multiple applications for a single department

        Enterprise applications have different link requirements and priorities. The experience of important applications should be guaranteed first if the egress link bandwidth is limited. For example, you can configure instant messaging, video, and web page browsing services in descending order of priority. In this way, the instant messaging service of the highest priority will be transmitted even if network congestion occurs. Additionally, other services such as email will not preempt the bandwidth of high-priority services.

To achieve this, configure queue scheduling to place different applications to different queues.

• Multiple departments of an enterprise

        An enterprise usually has multiple departments of different importance. Traffic of each department needs to be isolated, and different bandwidths need to be allocated to each department. The following requirements need to be met:

        −       A specified bandwidth quota is assigned to each department to meet its service requirements.

        −       If some departments do not fully use their bandwidth quotas, the idle bandwidth resources can be used by other departments with insufficient bandwidth.

        −       The bandwidth for Internet access or legacy site access should be separately limited.  

             −       The total egress bandwidth of the physical link is 100 Mbit/s. Department 1 is assigned 40% of the physical link bandwidth, and department 2 is assigned 60% of the physical link bandwidth. The basic bandwidth requirements of each department must be met.

             −       Additionally, the two departments can use idle bandwidth resources of each other.

             −       The ratio of bandwidth resources used for local Internet access and inter-site access is 4:6 for department 1 and 3:7 for department 2. If congestions occur on physical links, the minimum bandwidth is guaranteed based on the bandwidth ratio.

Overall Process

Huawei's SD-WAN Solution supports traffic classification based on the IP quintuple, application group, and DSCP value, and supports three QoS policies, including queue priority–based scheduling, traffic policing, and traffic shaping. The solution also supports hierarchical QoS (HQoS) to implement multi-dimensional bandwidth allocation and DSCP re-marking.

To adapt to different scenarios, two types of QoS policies are provided: overlay network QoS and common QoS (QoS configured based on CPEs at sites). The two types of QoS are implemented in the same manner, and their difference lies in the application scope.

• Queue priority

Configured with different QoS priorities, services are placed into queues of different priorities for forwarding, achieving differentiated QoS. If bandwidth resources are insufficient, the forwarding bandwidth of high-priority services is preferentially guaranteed.

You are advised to configure high queue priorities for key applications that need to be preferentially guaranteed. A CPE automatically sets different queue types for application packets based on the queue priorities configured for these applications. The following table lists the mappings between queue priorities, queue types, and DSCP values.

Each queue type is described as follows:

• Low latency queuing (LLQ): is a special EF queue type. The latency of LLQ queues is lower than that of common EF queues.

• Expedited forwarding (EF): After packets matching certain rules enter EF queues, they are scheduled in Strict Priority (SP) mode. Packets in other queues are scheduled only after all the packets in EF queues are scheduled. In addition, EF queues can use the available bandwidth in AF or BE queues. EF queues are applied to the services requiring a low latency, low drop probability, assured bandwidth, and occupying low bandwidth, for example, voice service.

• Appointed forwarding (AF): AF queues ensure a low drop probability of packets in the scenario where the rate of outgoing service traffic does not exceed the minimum bandwidth. AF queues are applied to heavy service traffic for which bandwidth needs to be ensured.

• Best effort (BE): BE queues are used together with the default class. The remaining packets that do not enter AF or EF queues enter BE queues. BE queues use weighted fair queuing (WFQ) scheduling. The more the queues, the more evenly allocated the bandwidth, and the more the occupied resources. BE queues are applied to the services insensitive to the latency and packet loss, for example, Internet access services.

• Traffic policing

Traffic policing controls traffic by monitoring the bandwidth occupied by service traffic, and discards excess traffic to limit the bandwidth within a proper range, ensuring appropriate bandwidth resource allocation. Huawei's SD-WAN Solution uses the committed access rate (CAR) for traffic policing.

• Traffic shaping

Traffic shaping is a measure to adjust the traffic rate sent from an interface. When the rate of an inbound interface on a downstream device is lower than that of an outbound interface on an upstream device or burst traffic occurs, traffic congestion may occur on the inbound interface of the downstream device. Traffic shaping can be configured on the outbound interface of the upstream device so that outgoing traffic is sent at even rates and congestion is avoided.

• Bandwidth allocation

HQoS implements bandwidth allocation for multi-level queues between VPNs or within a VPN. The bandwidth of a physical link is divided into bandwidths of multiple logical links, and the bandwidth of each logical link is assigned to different VPNs. The bandwidth of a logical link for each VPN can specify bandwidths of the overlay network and the local breakout network. The bandwidth of the overlay network is used for communication between the hub site, aggregation site, and branch site. The bandwidth of the local breakout network is used for local access to the Internet or interconnection between local and legacy sites.

• DSCP re-marking

Set the DSCP priority in the IP header of a packet. This parameter can be set in the following situations:

• Configure the LAN inbound interface re-marking DSCP to change the IP DSCP of the traffic entering the CPE. If the packet enters the overlay tunnel for forwarding, the DSCP value in the outer IP packet header is copied from the DSCP value in the inner IP packet header by default. The final result is that the DSCP values of both the inner and outer IP packet headers are specified re-marked values.

• If the DSCP re-marking function is configured on the WAN interface, the DSCP value in the IP header of a packet sent by the outbound interface on the underlay network is modified. If the IP packet header of the overlay tunnel is added to the packet, only the DSCP value in the outer IP packet header is modified. At last, the DSCP values in inner and outer IP packet headers may be different, and the outer DSCP value is the re-marked value.

• If the DSCP re-marking function is configured on both LAN and WAN interfaces, the DSCP value in the IP header of a packet entering the CPE is modified. If the packet is sent through the outbound interface on the underlay network, the DSCP value in the outer IP packet header is modified again. Finally, for the packet that the IP header is encapsulated in overlay tunnels, the DSCP value in the inner IP packet header is remarked on the LAN interface and the DSCP value in the outer IP packet header is remarked on the WAN interface. For the local breakout packet, the DSCP value in the outer IP packet header is remarked on the WAN interface.

Deployment Solution

HQoS policies can be used to provide differentiated service quality for various applications and guarantee different bandwidths for departments. In the HQoS service model, the following configurations need to be performed: service layer QoS, overlay/local breakout traffic policy, and interface rate limiting. The following table lists the HQoS parameter settings for the VoIP service in VPN 1.

• Intra-VPN QoS policy (HQoS level-1 queue)

An independent QoS traffic policy is configured for each VPN on iMaster NCE-WAN. The policy controls the traffic of various applications on the enterprise intranet of each VPN. iMaster NCE-WAN supports the following traffic policy configurations.

• Create traffic classifiers

When traffic of VPN users needs to be classified (for example, voice, data, office application, and Internet access traffic), a traffic classifier must be created for each type of traffic object. Rules for defining traffic classification objects may be once or a combination of the following:

−       IP quintuple

−       Applications or application groups

−       DSCP values

• Configure QoS traffic policy actions

Create QoS policies, select a corresponding traffic classifier for each policy, and specify the QoS action to be performed for the traffic object corresponding to each policy. Currently, the following traffic actions are supported:

−       Priority and queue scheduling

−       Bandwidth limit: CAR & shaping

−       DSCP remarking

• Inter-VPN QoS policy (HQoS level-2 queue)

All traffic of a VPN is taken as a traffic object and enters into the AF queue for priority scheduling. The features of the AF queue are as follows: The AF queues share the remaining bandwidth on the interface based on the weight. When congestion occurs on the interface, each type of packets can obtain the minimum bandwidth. In this way, when a physical link congestion occurs, each VPN has its own minimum bandwidth guarantee. When the congested link is restored, one VPN can share the extra bandwidth of other VPNs on the physical link. iMaster NCE-WAN provides the following configuration functions:

Bandwidth ratio of the VPN department. The total reference bandwidth is the subscribed bandwidth of the physical link. By default, no bandwidth percentage is specified for each VPN. iMaster NCE-WAN automatically allocates bandwidth evenly to VPNs.

If a VPN department has local breakout Internet traffic, you can also specify the percentage of local breakout traffic in the total VPN bandwidth. The remaining bandwidth is reserved for the traffic between sites over the overlay tunnel in the VPN.

In this manner, the traffic of a VPN is divided into two HQoS parent policy queues based on the breakout traffic and inter-site traffic over the overlay tunnel. As shown in the following figure, VPN 1 has local breakout traffic, accounting for 40%. The total bandwidth of department VPN 1 is 40% of the physical link bandwidth. Therefore, the local breakout traffic is 16% of the total bandwidth.

• Interface bandwidth limit

When the local breakout traffic or tunnel-encapsulated overlay traffic of a user is sent from a physical interface to the underlay network, you can rate-limit the traffic using GTS based on the total bandwidth of the interface. The interface bandwidth corresponds to the subscribed bandwidth purchased by the user from the carrier. On the tenant portal of iMaster NCE-WAN, you must configure the bandwidth for the underlay physical link, which serves as the HQoS benchmark bandwidth and the reference link bandwidth for performance monitoring.

The CPE only performs shaping on the outbound traffic based on the specified uplink bandwidth, but does not limit the bandwidth of inbound traffic based on the specified downlink bandwidth.

I hope it was helpful for you. Please do let me know in comments in case of any questions.