[CCNP][ONT] Configuring NBAR

LAB 구성 방법 :

PC1에서 Virtual PC와 GW1, GW2를 구성한다.

Partner PC2에서는 Virtual PC와 GW3, GW4를 구성하고 설정한다.

 

# PC1을 위한 설정

[localhost]

 

[[3725]]
image = d:\ios\c3725-ipvoice-mz.123-8.T3.bin
ram = 128
ghostios = true
slot1 = NM-4T
idlepc = 0x605b6dcc

 

[[router GW1]]
model = 3725
console = 2001
f0/0 = NIO_gen_eth:\Device\NPF_{D51A237E-ACD8-4D7D-874D-446305EAA024} # VMNet1 connection
f0/1 = GW2 f0/0

 

[[router GW2]]
model = 3725
console = 2002
s1/0 = NIO_udp:11000:121.129.63.2:11001

 

 

# PC2를 위한 설정

[localhost]

 

[[3725]]
image = d:\ios\c3725-ipvoice-mz.123-8.T3.bin
ram = 128
ghostios = true
slot1 = NM-4T
idlepc = 0x605b6dcc

 

[[router GW3]]
model = 3725
console = 2001
f0/0 = GW4 f0/1
s1/0 = NIO_udp:11001:121.129.63.1:11000

 

[[router GW4]]
model = 3725
console = 2002
f0/0 = NIO_gen_eth:\Device\NPF_{D51A237E-ACD8-4D7D-874D-446305EAA024} # VMNet1 connection

 

 

===============================================================================

 

! -- GW1 Basic Router Configuration
! -- Cisco VoIP Gateway Configuration
!
hostname GW1
!
enable secret cisco
!
line console 0
 logging synchronous
 exec-timeout 0
!
line vty 0 4
 login local
 exit
!
username cisco privilege 15 secret cisco
!
no ip domain-lookup
!
ip domain-name voip.com
!
interface loopback 0
 ip address 1.1.1.1 255.255.255.255
!
interface fastethernet0/0
 ip address 10.10.1.1 255.255.255.0
 no shutdown
!
interface fastethernet0/1
 ip address 10.10.2.1 255.255.255.0
 no shutdown
 exit
!
router eigrp 100
 network 10.10.0.0 0.0.255.255
 network 1.1.1.1 0.0.0.0
 no auto-summary
!
end

 

 

 

! -- GW2 Basic Router Configuration
! -- Cisco VoIP Gateway Configuration
!
hostname GW2
!
enable secret cisco
!
line console 0
 logging synchronous
 exec-timeout 0
!
line vty 0 4
 login local
 exit
!
username cisco privilege 15 secret cisco
!
no ip domain-lookup
!
ip domain-name voip.com
!
interface loopback 0
 ip address 2.2.2.2 255.255.255.255
!
interface fastethernet0/0
 ip address 10.10.2.2 255.255.255.0
 no shutdown
!
interface serial 1/0
 ip address 10.10.3.1 255.255.255.0
 no shutdown
 exit
!
router eigrp 100
 network 10.10.0.0 0.0.255.255
 network 2.2.2.2 0.0.0.0
 no auto-summary
!
end

 

 

 

! -- GW3 Basic Router Configuration
! -- Cisco VoIP Gateway Configuration
!
hostname GW3
!
enable secret cisco
!
line console 0
 logging synchronous
 exec-timeout 0
!
line vty 0 4
 login local
 exit
!
username cisco privilege 15 secret cisco
!
no ip domain-lookup
!
ip domain-name voip.com
!
interface loopback 0
 ip address 3.3.3.3 255.255.255.255
!
interface fastethernet0/0
 ip address 10.10.4.2 255.255.255.0
 no shutdown
!
interface serial 1/0
 ip address 10.10.3.2 255.255.255.0
 no shutdown
 exit
!
router eigrp 100
 network 10.10.0.0 0.0.255.255
 network 3.3.3.3 0.0.0.0
 no auto-summary
!
end

 

 

 

! -- GW4 Basic Router Configuration
! -- Cisco VoIP Gateway Configuration
!
hostname GW4
!
enable secret cisco
!
line console 0
 logging synchronous
 exec-timeout 0
!
line vty 0 4
 login local
 exit
!
username cisco privilege 15 secret cisco
!
no ip domain-lookup
!
ip domain-name voip.com
!
interface loopback 0
 ip address 4.4.4.4 255.255.255.255
!
interface fastethernet0/0
 ip address 10.10.5.1 255.255.255.0
 no shutdown
!
interface fastethernet0/1
 ip address 10.10.4.1 255.255.255.0
 no shutdown
 exit
!
router eigrp 100
 network 10.10.0.0 0.0.255.255
 network 4.4.4.4 0.0.0.0
 no auto-summary
!
end

 

 

 

!  The default startup configuration file for Cisco Router and
!  Security Device Manager (SDM)
!  DO NOT modify this file; it is required by SDM as is for factory defaults
!  Version 1.0
!
logging buffered 51200 warnings
!
username cisco privilege 15 secret 0 cisco
!
! 
ip domain-name it10pro.com
!
ip http server
ip http secure-server
ip http authentication local
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
banner login ^
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username "cisco"
with the password "cisco". The default username and password have a privilege level of 15.

Please change these publicly known initial credentials using SDM or the IOS CLI.
Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want to use.

For more information about SDM please follow the instructions in the QUICK START
GUIDE for your router or go to http://www.cisco.com/go/sdm
-----------------------------------------------------------------------
^
!
line con 0
 login local
line vty 0 4
 privilege level 15
 login local
 transport input telnet
 transport input telnet ssh
line vty 5 15
 privilege level 15
 login local
 transport input telnet
 transport input telnet ssh
!
!  End of SDM default config file
end

 

 

!! - NBAR를 이용한 QoS Mark & Configuration

 

! -- Class-mark configuraton
class-map voice-in
   match protocol rtp audio
class-map video-conferencing-in
   match protocol rtp video
class-map interactive-in
   match protocol telnet
!
policy-map class-mark
  class voice-in
    set ip dscp ef
  class video-conferencing-in
    set ip dscp af41
  class interactive-in
    set ip dscp af31
!
interface fa0/0
  service-policy input class-mark

 

 

! -- QoS policy configuration
class-map voice-out
  match ip dscp ef
class-map video-conferencing-out
  match ip dscp af41
class-map interactive-out
  match ip dscp af31
!
policy-map qos-policy
  class voice-out
    priority percent 10
  class video-conferencing-out
    bandwidth remaining percent 20
  class interactive-out
    bandwidth remaining percent 30
  class class-default
    fair-queue
!
interface serial 1/0
 service-policy output qos-policy

 

 

! -- Configuring and Monitoring Protocol Discovery

! -- 지정된 Interface에 NBAR에 정의된 모든 Protocol Traffic을 Discovery하기 위한 구성
!
ip cef
!
interface fastethernet 0/0
 ip nbar protocol-discovery

 

! -- Protocol Discovery가 활성화된 모든 Interface를 위한 통계표시
show ip nbar protoocl-discovery

 

! -- Wireshake를 이용하여 Serial 1/0 Interface를 Capture하신 다음 IP Header에 DSCP값을 체크해보세요.

! -- 당연히 Telnet 접속을 하신 다음에 검사하시면 됩니다.

 

 

! EIGRP Hello에 Marking된 정보...System Lavel 6 으로 할당되었다..

! Differentiated Services Field : 0xc0 (DSCP 0x30 : Class Selector  6 ; ECN: 0x00)

 

 

 

 

! 위에서 Telnet은 Assured Forwarding 31로 Marking했었다... Telnet traffic을 캡쳐해 보자.

! Differentiated Services Field : 0x68 (DSCP 0x1a : Assured Forwarding 31 ; ECN: 0x00)