Working with Roles and Policies

One of the major parts of your Quality of Service configuration is the roles and policy statements you create in the Policy Editor. These roles and policies define how the network devices manage the data that flows through the network.

Understanding QoS Roles and Policies

A QoS policy is a conditional statement that applies a specific QoS action to a packet if the packet satisfies the conditions defined in the policy.

A role contains a group of policies that will be implemented on a specified set of interfaces. Typically, you create separate roles for edge devices and backbone devices. Roles are defined within the context of a specific service template, but you can specify service template overrides for a role. Policies in a role use the service definitions in the associated service template. When a role has a service template override, policies in that role use the overrides.

The device checks the policies in the roles defined on the interface in order of priority until a match is found for the traffic on the interface. At this point, it applies the policy and ignores remaining policies. Each role also includes a default action, which is implemented when no match is found for the traffic on the interface.

Each policy has two parts:

The definition of the type of traffic to which the policy will apply. The type of traffic is defined by its direction and a policy filter. In the filter you can define the source or destination of the traffic, by IP address, subnet, or user group. You can also define the traffic by application or protocol. For signaling policies, you can define the application initiating the QoS request. You can save filter definitions in a Filters library so that they can be reused. For example, if you want to use the same filter definition in different policies, you do not redefine the filter settings each time; you simply choose the same filter. This ensures consistency and reduces errors.
The definition of the policy action that will be applied to the defined traffic type. For provisioning policies, actions can be coloring, scheduling, and policing (rate limits). The coloring and scheduling options are defined in the service template, which is downloaded to every device. This ensures consistent end-to-end handling of packets. You can define rate limits for flows and classes (aggregate flows) and save them in libraries for re-use. For signaling policies, you can define rate limits for RSVP traffic.

With QPM-COPS, you can enable and disable policies without deleting them. However, the status of the policy does not change until you distribute the database.

Note The maximum number of roles and policy statements you can define for a domain depends on your system resources. It is recommended not to overload interfaces with filters. You should define more individual roles containing only policies for one type of interface, since you can combine roles on interfaces when required.

QPM-COPS comes with a set of canned roles, which contain sample policies, filters, and rate limit definitions. You can edit these definitions to suit your requirements.

Note Whenever you make changes to roles and policies, save the changes to the QoS database.

Before You Begin

Before you begin to define roles and policies, make sure that you have selected the appropriate service template for your network. See Choosing a Service Template.

Related Topics

Creating a Role

Create a role when you want to define policies for a specific set of device interfaces.

Procedure

Step 1 Choose Policy Editor in the QPM-COPS menu bar.

Step 2 Choose Role List in the option bar. The Role List page is displayed.

Figure 7-1: Role List Page

Step 3 Create a new role.

a. In the New Role field, enter a role name.

: Role names can be up to 31 alphanumeric characters, including underscores (_) and hyphens (-).

Note Do not use spaces in role names.

b. Click Add.

The Role page opens for the new role. The default action for all traffic that does not match any filter in this role is Best Effort.

Figure 7-2: Role Page

Step 4 To change the default action, choose an option in the Default Action field and click Set Default Action.

Step 5 To view the new role in the Role List page, click Role List in the navigation header at the top of the page.

Creating a Service Template Override

You can create a role that applies override settings in the selected global service template. For example, you may want to increase the reserved bandwidth of a service level for a traffic on a specific set of devices. See Creating a Service Template Override.

Reordering Roles

The order of roles in the role list determines the order in which policies in a role combination are checked on the device. The role list is ordered from higher to lower priority. You can change the order of the roles in the role list.

Note The roles in a role combination are stored in lexicographic order on the device, but are checked in the order they appear in the role list.

Procedure

Step 1 Choose Policy Editor in the QPM-COPS menu bar.

Step 2 Choose Role List in the option bar. The Role List page is displayed as shown in Figure 7-1.

Step 3 In the # column, select the order number next to the role whose order you want to change.

Step 4 Enter the new order number and press Enter. The other roles are renumbered as required and the role list is refreshed according to the new order.

Deleting Roles

You can delete a role with all its policies. Reusable definitions are not deleted from their corresponding libraries.

Procedure

Step 1 Choose Policy Editor in the QPM-COPS menu bar.

Step 2 Choose Role List in the option bar. The Role List page is displayed as shown in Figure 7-1.

Step 3 Select the check boxes next to the roles you want to delete.

Step 4 Click the Delete Selection link. The roles and their policies are deleted.

Creating a Policy

Create a policy when you want to apply a QoS action to a specific type of traffic.

Policy parameters such as type of service and queuing preference are defined according to the settings in the service template selected for the domain. Filters and rate limits can be chosen from libraries, or you can create a new definition.

Procedure

Step 1 Choose Policy Editor in the QPM-COPS menu bar. The Policy Editor opens displaying the Role page as shown in Figure 7-2.

Step 2 If the role to which you want to add a policy is not displayed, in the Go to role dropdown list choose the role. The page refreshes to display the selected role.

Note You can also access the Role page from the Role List page by clicking on a role name.

Step 3 Click the Add PR Policy link or the Add Signaling Policy link according to the type of policy you want to add. The New Policy page appears.

Figure 7-3: New Policy Page

Step 4 Fill in the following fields:

Policy Name---The name of the new policy. Policy names can be up to 31 alphanumeric characters, including underscores (_) and hyphens (-).

Note Do not use spaces in policy names.

Direction---Choose the direction of the traffic to which the policy will apply. Direction can be In, Out, or In and Out.
Status---The status of the new policy. Select to enable. Enabled policies will be downloaded to devices on distribution. Disabled policies will be saved in the database but will not be downloaded to devices.
Filter---Choose a filter from the dropdown list, or click New to create a new filter. Click View/Edit to view and edit the selected filter. See Working with Filters.
Service Type---Choose one of the service types defined in the selected global service template.
Flow Rate Limit---Choose a flow rate limit from the dropdown list, or click New to create a new rate limit. Click View/Edit to view and edit the selected rate limit. See Working with Rate Limits.
Class Rate Limit---Choose a class rate limit from the dropdown list, or click New to create a new rate limit. Click View/Edit to view and edit the selected rate limit. See Working with Rate Limits.
Description---You can add a short description of the policy.

Step 5 Click Save to save the policy.

The Role page reappears with the new policy.

Note New policies will be enabled on the device only after deployment. See "Distributing Policies" for details of the deployment process.

Viewing and Modifying a Policy

You can view and modify policies, and rename policies.

Procedure

Step 1 Choose Policy Editor in the QPM-COPS menu bar. The Policy Editor opens displaying the Role page.

Step 2 If the role you want is not displayed, in the Go to Role list box choose the role. The page refreshes to display the selected role.

Step 3 Click the policy you want to view or modify. The Policy page for the selected policy appears.

Step 4 Edit the fields as described in Creating a Policy.

Step 5 Click Save to save the policy changes, or enter a new name in the Policy Name field and click Save As.

The Role page reappears with the new policy name.

Deleting Policies

Delete policies that are no longer required.

Procedure

Step 1 Choose Policy Editor in the QPM-COPS menu bar. The Policy Editor opens displaying the Role page.

Step 2 If the role you want is not displayed, in the Go to Role list box choose the role. The page refreshes to display the selected role.

Step 3 Select the check boxes next to the policies you want to delete.

Step 4 Click the Delete Selection link.

The Role page reappears without the deleted policies.

Reordering Policies

The order of policies in a role determines the order in which policies within a role in the role combination are checked on the device. You can change the order of the policies in the role.

Procedure

Step 1 Choose Policy Editor in the QPM-COPS menu bar. The Policy Editor opens displaying the Role page.

Step 2 If the role you want is not displayed, in the Go to Role list box choose the role. The page refreshes to display the selected role.

Step 3 In the # column, select the order number next to the policy whose order you want to change.

Step 4 Enter the new order number and press Enter. The other policies are renumbered as required and the Role page is refreshed according to the new order.

Working with Filters

A filter defines the type of traffic to which a policy action will apply. You can filter traffic by source, destination, user group, protocol and application. Filter definitions are stored in a Filters library and can be reused for different policies.

Creating a Filter

Create a filter to define the type of traffic to which policy actions will apply.

Procedure

Step 1 In the Policy page, click New next to the Filter box. The New Filter page appears.

Figure 7-4: New Filter Page

Each section in the Filter page is a complete condition. You can create as many filter conditions as you want in a single filter definition. A packet satisfies the filter if it satisfies all the conditions in the filter.

Step 2 Fill in the fields as described in Table B-7.

Step 3 Click Save to save the new filter. The Policy page reappears displaying the new filter name.

Viewing and Modifying a Filter

You can view and modify filters, and you can rename a filter.

Procedure

Step 1 Open the Filter page in one of the following ways:

In the Policy page, in the Filter field, choose a filter and click View/Edit.
In the Role page, click a filter name.
In the Filters page, click a filter name.

The Filter page opens displaying details of the selected filter.

Step 2 Edit fields as described in Table B-7.

Step 3 Click Save to save changes.

Step 4 To rename the filter, enter a name in the Filter Name box, and click Save As.

Deleting Filters

You can delete filters that are not used in any policy.

Procedure

Step 1 Choose Libraries in the Policy Editor menu options bar. The Libraries page appears.

Step 2 Click Filters. The Filters page appears.

Step 3 Select the check boxes next to the filters you want to delete.

Step 4 Click Delete Selection. The filters are deleted.

Working with Rate Limits

This section describes creating, modifying and deleting flow and class rate limits for provisioning and RSVP policies.

A flow rate limit defines a limit for a single packet for provisioning, or a single RSVP flow. A class rate limit defines the limit for the aggregate provisioning or RSVP traffic. In-profile traffic will be handled according to the service template definitions for the selected service type. Out-of-profile traffic is treated as defined by the Excess property for the selected service type in the service template. When there is no definition for Excess traffic, the out-of-profile traffic will be discarded.

Creating a Rate Limit

Create rate limits as part of your policy action.

Procedure

Step 1 In the Policy page, click New next to the Flow Rate Limit or Class Rate Limit box. The New Rate Limit page opens.

Step 2 Fill in the fields as described in the following tables:

For PR Flow Rate Limits, see Table B-12.
For PR Class Rate Limits, see Table B-13.
For Signaling Flow Rate Limits, see Table B-14.
For Signaling Class Rate Limits, see Table B-15.

Step 3 Click Save to save the new rate limit. The Policy page reappears displaying the new rate limit name.

Viewing and Modifying a Rate Limit

You can view and modify rate limits, and you can rename a rate limit.

Procedure

Step 1 Open the appropriate Rate Limit page in one of the following ways:

In the Policy page, in the Rate Limit field, choose a filter and click View/Edit.
In the Role page, click a rate limit name.
In the appropriate Rate Limits page, click a rate limit name.

The Rate Limit page opens displaying details of the selected rate limit.

Step 2 Edit fields as described in the following tables:

For PR Flow Rate Limits, see Table B-12.
For PR Class Rate Limits, see Table B-13.
For Signaling Flow Rate Limits, see Table B-14.
For Signaling Class Rate Limits, see Table B-15.

Step 3 Click Save to save changes.

Step 4 To rename the rate limit, enter a name in the Rate Limit Name box, and click Save As.

Deleting Rate Limits

You can delete rate limits that are not used in any policy.

Procedure

Step 1 Choose Libraries in the Policy Editor menu options bar. The Libraries page appears.

Step 2 Click the appropriate Rate Limits library. The Rate Limits page appears.

Step 3 Select the check boxes next to the rate limits you want to delete.

Step 4 Click Delete Selection. The rate limits are deleted.

Querying Policies

Querying policies lets you view policies according to specified criteria. You can view policies for different roles, and across managed or virtual device interfaces. For example, you can view policies for coloring mission critical traffic in all roles. This section describes how to query policies.

Procedure

Step 1 Choose Policy Query in the Policy Editor menu options bar. The Policy Query page appears as shown in Figure 7-5.

Figure 7-5: Policy Query Page

Step 2 Choose Policy Query criteria:

a. Choose the type of policy match in the Find policies matching field:

ALL of the criteria below---Policies must match one of the selected values in ALL categories with specified criteria.
ANY of the criteria below---Policies must match one of the selected values in ANY of the categories with specified criteria.

b. Choose matching criteria in the following categories:

Status---Policies are enabled, disabled, or any policy.
Type---RSVP policies, provisioning policies, or any policy.
Role---Lists the roles in the current service template.
Filter---Lists the filters in the current database.
Service---Lists the service types in the current service template.
PR Rate Limits---Lists the PR flow rate limits and PR class rate limits in the current database.
RSVP Rate Limits---Lists the RSVP flow rate limits and RSVP class rate limits in the current database.

When you select multiple values in a list, all policies matching at least one of the values will be found. When no value is selected in a list, policies matching any of the values will be found.

Step 3 Click the Submit Query button. The Policy Query Results page appears displaying details of all matching policies.

Figure 7-6: Policy Query Results Page

Policy Validation

QPM-COPS allows you to create roles and policies for your network traffic without requiring knowledge of the capabilities of your network devices. On deployment, the PDPs download to each device those policies that match the specific device capabilities.

The Policy Validation feature lets you preview how policies would be deployed on your network. You can validate policies on managed devices in your network, or you can define virtual devices, which do not necessarily exist in the network. You can also validate how a specific role would be deployed on its assigned devices.

Note Validation first looks for pending role assignments (not yet committed to devices). If there are no pending role assignments, it uses the roles that have already been discovered on the device.

Policy validation results show which policy and service template definitions match the capabilities of the device and its interfaces.

Policy Validation for Managed Devices

Use Policy Validation on a specific managed device to preview how policies in the assigned role combination for the current service template will be deployed on that device. Policy validation also shows capability mismatches between the device capabilities and policy and service template definitions.

Procedure

Step 1 Choose Validation in the QPM-COPS menu bar. The Policy Validation page appears as shown in Figure 7-7.

Figure 7-7: Policy Validation Page

Step 2 In the Policy Validation for Managed Devices section, validate a device in one of the following ways:

Click the Device Configuration link. The Device List page appears.

Click the Validate Device icon next to the device you want to validate.

The Managed Device Preview page appears. See Managed Device Preview Page.

Enter the device IP address or host name in the text box. Click the Validate button.

The Managed Device Preview page appears. See Managed Device Preview Page.

Note Validation is only performed for roles belonging to the current service template.

Policy Validation for Virtual Devices

Use Policy Validation on a virtual device to preview how policies and service templates for a specified role combination would be deployed on an interface of a specific device configuration. The device might or might not exist on your network.

Tips Use this feature to test "What If" scenarios before adding a new device to your network.

Procedure

Step 1 Choose Validation in the QPM-COPS menu bar. The Policy Validation page appears as shown in Figure 7-7.

Step 2 In the Policy Validation for Virtual Device section, define the virtual device properties by choosing an option from each of the following dropdown lists:

Model---Lists available device models.
OS Version---Lists the available operating systems for the selected device model.
Interface type---Lists the available interface types for the selected device model. If you choose Unknown for a Catalyst device, validation will be performed against the capabilities of a non-gigabit interface.
Card---Lists the available cards for the selected device.
Sub Card---Lists the available subcards for the selected device. Choose Empty if you do not want to specify a subcard. If you choose Other the validation does not relate to the subcard properties.
Sub Card 2---Lists the available options for subcard 2 for the selected device. Choose Empty if you do not want to specify a subcard. If you choose Other the validation does not relate to the subcard properties.

Step 3 Define the role combination for which you want to perform validation:

a. Choose a role in the Add Role dropdown list. The role name appears in the role combination box.

b. Choose additional roles in the Add Role dropdown list. As you add each role, it appears in the role combination box preceded by a plus sign (+).

Note You can enter role names separated by a plus sign (+) directly into the role combination text box.

Step 4 Click the Validate button.

The Virtual Device Preview page appears. See Virtual Device Preview Page.

Policy Validation for Roles

You can validate how policies in a specific role will be deployed on devices with that role or containing that role in a role combination on any of its interfaces.

Note When a device contains the specified role in a role combination, role validation only previews the device if the role has top priority in the role combination for the current service template.

Procedure

Step 1 Choose Validation in the QPM-COPS menu bar. The Policy Validation page appears as shown in Figure 7-7.

Step 2 In the Policy Validation for Role section, choose the role you want to validate in the dropdown list.

Step 3 Click the Validate button. The Role Preview page appears. See Role Preview Page.

Policy Validation Results

Policy validation results are displayed on the following pages:

Managed Device Preview Page

The Managed Device Preview Page displays basic validation information for coloring and limiting actions in the policies in each role combination defined on the selected device's interfaces.

Note Validation is only performed for the roles belonging to the current global service template.

Figure 7-8 shows device preview details for one of the role combinations on the selected device.

Figure 7-8: Managed Device Preview Page

Note A message is displayed at the top of the page if the device does not support COPS-PR or COPS-RSVP.

For each policy the following information is displayed:

Role---The role to which the policy belongs.

Policy---The name of the policy.

Direction---The direction of traffic for which the policy applies---incoming, outgoing, or both.

Applicable in Direction---The direction for which policy coloring and limiting actions are applicable.

Capability Mismatch---Device capability mismatches for coloring and limiting actions. For example, Figure 7-8, shows that there is a capability mismatch for coloring and limiting actions on outgoing interfaces. This means that there are interfaces on the selected device that do not support coloring and limiting actions on outgoing traffic.

For more validation results:

Click the links in the Capability Mismatch column to display the Policy Utilization page. This page displays details of coloring and limiting capability mismatches for each interface. See Policy Utilization Page.
Click the service template name to display the Service Template Preview page in which you can view how service template definitions will be deployed on the device. See Service Template Preview Page.

Virtual Device Preview Page

The Virtual Device Preview page displays basic validation information for coloring and limiting actions in the policies in the specified role combination.

Figure 7-9: Virtual Device Preview Page

The Virtual Device Preview page displays details of the virtual device, and the selected role combination. For each policy in the role combination, the following information is displayed:

Role---The role to which the policy belongs.

Policy---The name of the policy.

Direction---The direction of traffic for which the policy applies, incoming, outgoing, or both.

Applicable in Direction---The direction for which policy coloring and limiting actions are applicable.

Capability Mismatch---Device capability mismatches for coloring and limiting actions. For example, Figure 7-9, shows that there is a capability mismatch for coloring and limiting actions on outgoing interfaces. This means that there are interfaces on the virtual device that do not support coloring and limiting actions on outgoing traffic.

For more validation results:

Click the links in the Capability Mismatch column to display the Policy Utilization page. This page displays details of coloring and limiting capability mismatches for each interface. See Policy Utilization Page.
Click the service template name to display the Service Template Preview page in which you can view how service template definitions will be deployed on the device. See Service Template Preview Page.

Role Preview Page

The Role Preview Page displays information for the devices that have interfaces with the specified role, or with a role combination that includes the specified role as the top priority role.

Figure 7-10: Role Preview Page

The following information is displayed:

Role name.
Current global service template name.
The number of devices for which the validation is effective.

Note Validation is effective for devices on which the specified role is defined as the highest priority role in any of role combination defined on that device.

For each policy in the role, the following information is displayed:

Policy---The name of the policy.
Direction---The direction of traffic for which the policy applies---incoming, outgoing, or both.
# Conflicting Devices for Direction In---The number of devices that have coloring and limiting capability mismatches in the In direction.
# Conflicting Devices for Direction Out---The number of devices that have coloring and limiting capability mismatches in the Out direction.

For more validation results:

Click the links in the # Conflicting Devices columns to display the Policy Utilization page. This page displays details of coloring and limiting capability mismatches for each interface. See Policy Utilization Page.
Click the service template name to display the Service Template Preview page. This page shows how service template definitions will be deployed on the devices for which the role validation is effective. See Service Template Preview Page.

Policy Utilization Page

The Policy Utilization page displays details of the coloring and limiting capability mismatches for each device interface for the selected policy.

Figure 7-11: Policy Utilization Page

This page displays the name or type of device, or the role name for which validation is being performed. Details of the selected policy are also displayed.

The following information is displayed for each interface in the corresponding device(s):

Device Name---The name of the device to which the corresponding interface belongs.
Role Combination---The name of the role combination on the corresponding interface.
Interface Name---The name of the interface.
Applicable in Direction---The direction for which policy coloring and limiting actions are applicable.
Capability Mismatch---Capability mismatches for coloring and limiting actions on the corresponding interface.

In Figure 7-11, all interfaces have a capability mismatch for coloring and limiting actions on outgoing traffic.

Note Some of the displayed interfaces might belong to a devices's internal card. Many of these interfaces do not support any QoS capabilities, and cannot have any discovered roles. When validation is performed on pending roles on these interfaces, the validation results are not meaningful.

Service Template Preview Page

The Service Template Preview page shows how service template definitions will be deployed on the selected device(s).

Figure 7-12: Service Template Preview Page (partial)

The Service Template Preview page displays the following information:

Device name.
Service template name.
Service Definition table as displayed in the Service Template page. See "Working with Service Templates."
Scheduling Preference table, which displays the number of device interfaces that support each queuing method defined in the service template, for each traffic direction.

Note When there are interfaces that do not support any of the defined queuing methods, an additional Error row appears displaying the corresponding number of interfaces. These interfaces will use their default queuing method.

Drop Preference table, which displays the number of device interfaces that support each drop method defined in the service template, for each traffic direction.
RSVP Parameters table, which displays each integrated service definition and the number of interfaces that support tagging, mode type, and resource allocation for each service.
Service Mapping table, which displays the number of interfaces that support each service mapping definition in each direction.

Note 1q1t is not displayed in the service mapping table. For devices that only support 1q1t, such as Cat5K, the # Supporting Interfaces columns will display only zeros.

Weights table as displayed in the Service Template page. See "Working with Service Templates."
Thresholds table as displayed in the Service Template page. See "Working with Service Templates."

For more validation results:

Click a link in a # Supporting Interfaces column to display detailed interface information for Service Template Utilization. See Service Template Utilization Page.

Service Template Utilization Page

The Service Template Utilization page displays details of how the service template definitions are deployed on each of the selected interfaces.

Figure 7-13: Service Template Utilization Page

The Service Template Utilization page displays the selected provisioning parameter that corresponds to the interfaces for which information is displayed.

The Devices Interfaces List displays the following information:

Selected Interfaces---Displays selection check boxes.
Device Name---Name of the device with the corresponding interface.
Role Combination---The role combination for the corresponding interface.
Interface Name---The name of the interface with the selected provisioning parameters.
Scheduling Preference---The name of the queuing method that will be deployed on the corresponding interface. If none of the scheduling preferences defined in the service template match the device capabilities, Error will be displayed. In these cases, the interfaces will use their default queuing method.
Drop Preference---The name of the drop method that will be deployed on the corresponding interface.
Service Mapping---The service mapping for the corresponding interface.

For more validation results:

Select one or more interfaces and click the Selected interfaces complete scheduling capabilities link to display the Interface Capabilities page. See Interface Capabilities Page.

Note Display the Interface Capabilities page to view the default scheduling method for interfaces that do not match the service template scheduling preference.

Interface Capabilities Page

The Interface Capabilities page displays the complete scheduling capabilities for selected interfaces. This page is useful when the Service Template Preview page or Service Template Utilization page has displayed Error for an interface's scheduling preference. This means that there is no match between the service template's scheduling preferences and the interface capabilities. In these cases, the interface uses its default scheduling method, which is displayed in the Interface Capabilities page.

Figure 7-14: Interface Capabilities Page

The Interface Capabilities page displays the name of the role or device for which validation is being performed, and the name of the current service template.

The Provisioning Parameters table displays the following information:

Device Name---Name of the device with the corresponding interface.
Role Combination---The role combination for the corresponding interface.
Interface Name---The name of the interface with the selected provisioning parameters.
Scheduling Preference---The name of the queuing methods configured on the corresponding interface.
Drop Preference---The name of the drop method configured on the corresponding interface.
Service Mapping---The service mapping configured for the corresponding interface.

Table of Contents

Working with Roles and Policies