Detections
Analytics

1.56 CISC-RT-000760

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Cisco PE switch must be configured to enforce a Quality-of-Service (QoS) policy to provide preferred treatment for mission-critical applications.

GROUP ID: V-221129
RULE ID: SV-221129r999738

Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network requires a QoS framework to differentiate traffic and provide a method to manage network congestion. The Differentiated Services Model (DiffServ) is based on per-hop behavior by categorizing traffic into different classes and enabling each node to enforce a forwarding treatment to each packet as dictated by a policy.

Packet markings such as IP Precedence and its successor, Differentiated Services Code Points (DSCP), were defined along with specific per-hop behaviors for key traffic types to enable a scalable QoS solution. DiffServ QoS categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment based on the classification. It is imperative that end-to-end QoS is implemented within the IP core network to provide preferred treatment for mission-critical applications.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure to enforce a QoS policy to provide preferred treatment for mission-critical applications.

Step 1 : Configure class-maps to match on DSCP values as shown in the configuration example below:

SW1(config-cmap)# class-map match-all C2_VOICE
SW1(config-cmap)# match ip dscp 47
SW1(config-cmap)# class-map match-all VOICE
SW1(config-cmap)# match ip dscp ef
SW1(config-cmap)# class-map match-all VIDEO
SW1(config-cmap)# match ip dscp af41
SW1(config-cmap)# class-map match-all CONTROL_PLANE
SW1(config-cmap)# match ip dscp cs6
SW1(config-cmap)# class-map match-all PREFERRED_DATA
SW1(config-cmap)# match ip dscp af33
SW1(config-cmap)# exit

Step 2 : Configure a policy map to be applied to the interfaces that reserves the bandwidth for each traffic type as shown in the example below:

SW1(config)# policy-map QOS_POLICY
SW1(config-pmap-c)# class C2_VOICE
SW1(config-pmap-c)# priority percent 10
SW1(config-pmap-c)# class VOICE
SW1(config-pmap-c)# priority percent 15
SW1(config-pmap-c)# class VIDEO
SW1(config-pmap-c)# bandwidth percent 25
SW1(config-pmap)# class CONTROL_PLANE
SW1(config-pmap-c)# priority percent 10
SW1(config-pmap-c)# class PREFERRED_DATA
SW1(config-pmap-c)# bandwidth percent 25
SW1(config-pmap-c)# class class-default
SW1(config-pmap-c)# bandwidth percent 15
SW1(config-pmap-c)# exit
SW1(config-pmap)# exit

Step 3 : Apply the output service policy to all interfaces as shown in the configuration example below:

SW1(config)# int e1/1
SW1(config-if)# service-policy output QOS_POLICY
SW1(config-if)# exit
SW1(config)# int e1/2
SW1(config-if)# service-policy output QOS_POLICY
SW1(config-if)# end

See Also

https://workbench.cisecurity.org/benchmarks/22581

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(2), CAT|III, CCI|CCI-001095, CSCv7|14.1, Rule-ID|SV-221129r999738_rule, STIG-ID|CISC-RT-000760, Vuln-ID|V-221129

Plugin: Cisco

Control ID: 02a244d12bb50a99ad6909a462b8c983ecdcef6cce913be06d439dc689d4294e