Detections
Analytics

1.78 CISC-RT-000770

Information

The Cisco P router must be configured to enforce a Quality-of-Service (QoS) policy to provide preferred treatment for mission-critical applications.

GROUP ID: V-216805RULE ID: SV-216805r917442

Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network requires a QoS framework to differentiate traffic and provide a method to manage network congestion. The Differentiated Services Model (DiffServ) is based on per-hop behavior by categorizing traffic into different classes and enabling each node to enforce a forwarding treatment to each packet as dictated by a policy.

Packet markings such as IP Precedence and its successor, Differentiated Services Code Points (DSCP), were defined along with specific per-hop behaviors for key traffic types to enable a scalable QoS solution. DiffServ QoS categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment based on the classification. It is imperative that end-to-end QoS is implemented within the IP core network to provide preferred treatment for mission-critical applications.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure to enforce a QoS policy to provide preferred treatment for mission-critical applications.

Step 1: Configure class-maps to match on DSCP values as shown in the configuration example below.

RP/0/0/CPU0:R2(config-cmap)#class-map match-all C2_VOICERP/0/0/CPU0:R2(config-cmap)#match dscp 47RP/0/0/CPU0:R2(config-cmap)#class-map match-all VOICERP/0/0/CPU0:R2(config-cmap)#match dscp efRP/0/0/CPU0:R2(config-cmap)#class-map match-all VIDEORP/0/0/CPU0:R2(config-cmap)#match dscp af41RP/0/0/CPU0:R2(config-cmap)#class-map match-all CONTROL_PLANERP/0/0/CPU0:R2(config-cmap)#match dscp cs6RP/0/0/CPU0:R2(config-cmap)#class-map match-all PREFERRED_DATARP/0/0/CPU0:R2(config-cmap)#match dscp af33RP/0/0/CPU0:R2(config-cmap)#exit

Step 2: Configure a policy map to be applied to the core-layer-facing interface that reserves the bandwidth for each traffic type as shown in the example below.

RP/0/0/CPU0:R2(config-pmap)#policy-map QOS_POLICYRP/0/0/CPU0:R2(config-pmap)#class C2_VOICERP/0/0/CPU0:R2(config-pmap-c)#bandwidth percent 10RP/0/0/CPU0:R2(config-pmap-c)#class VOICERP/0/0/CPU0:R2(config-pmap-c)#bandwidth percent 15RP/0/0/CPU0:R2(config-pmap-c)#class VIDEORP/0/0/CPU0:R2(config-pmap-c)#bandwidth percent 25RP/0/0/CPU0:R2(config-pmap-c)#class CONTROL_PLANERP/0/0/CPU0:R2(config-pmap-c)#bandwidth percent 10RP/0/0/CPU0:R2(config-pmap-c)#class PREFERRED_DATARP/0/0/CPU0:R2(config-pmap-c)#bandwidth percent 25RP/0/0/CPU0:R2(config-pmap-c)#class class-defaultRP/0/0/CPU0:R2(config-pmap-c)#bandwidth percent 15RP/0/0/CPU0:R2(config-pmap-c)#exit

Step 3: Apply the output service policy to the core-layer-facing interface as shown in the configuration example below.

RP/0/0/CPU0:R2(config)#int g0/0/0/1RP/0/0/CPU0:R2(config-if)#service-policy output QOS_POLICYRP/0/0/CPU0:R2(config-if)#exitRP/0/0/CPU0:R2(config)#int g0/0/0/2
RP/0/0/CPU0:R2(config-if)#service-policy output QOS_POLICYRP/0/0/CPU0:R2(config-if)#end

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(2), CAT|III, CCI|CCI-001095, Rule-ID|SV-216805r917442_rule, STIG-ID|CISC-RT-000770, Vuln-ID|V-216805

Plugin: Cisco

Control ID: c963d97f070f2010b9b72ad451b81e2ed25aa5181eb4391a90fc298bf9f470f4