Detections
Analytics

CISC-RT-000760 - The Cisco PE switch must be configured to enforce a Quality-of-Service (QoS) policy to provide preferred treatment for mission-critical applications.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network requires a QoS framework to differentiate traffic and provide a method to manage network congestion. The Differentiated Services Model (DiffServ) is based on per-hop behavior by categorizing traffic into different classes and enabling each node to enforce a forwarding treatment to each packet as dictated by a policy.

Packet markings such as IP Precedence and its successor, Differentiated Services Code Points (DSCP), were defined along with specific per-hop behaviors for key traffic types to enable a scalable QoS solution. DiffServ QoS categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment based on the classification. It is imperative that end-to-end QoS is implemented within the IP core network to provide preferred treatment for mission-critical applications.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure to enforce a QoS policy to provide preferred treatment for mission-critical applications.

Step 1: Configure class-maps to match on DSCP values as shown in the configuration example below:

SW1(config)#class-map match-all PREFERRED_DATA
SW1(config-cmap)#match ip dscp af33
SW1(config-cmap)#class-map match-all CONTROL_PLANE
SW1(config-cmap)#match ip dscp cs6
SW1(config-cmap)#class-map match-all VIDEO
SW1(config-cmap)#match ip dscp af41
SW1(config-cmap)#class-map match-all VOICE
SW1(config-cmap)#match ip dscp ef
SW1(config-cmap)#class-map match-all C2_VOICE
SW1(config-cmap)#match ip dscp 47
SW1(config-cmap)#exit

Step 2: Configure a policy map to be applied to the core-layer-facing interface that reserves the bandwidth for each traffic type as shown in the example below:

SW1(config)#policy-map QOS_POLICY
SW1(config-pmap)#class CONTROL_PLANE
SW1(config-pmap-c)#priority percent 10
SW1(config-pmap-c)#class C2_VOICE
SW1(config-pmap-c)#priority percent 10
SW1(config-pmap-c)#class VOICE
SW1(config-pmap-c)#priority percent 15
SW1(config-pmap-c)#class VIDEO
SW1(config-pmap-c)#bandwidth percent 25
SW1(config-pmap-c)#class PREFERRED_DATA
SW1(config-pmap-c)#bandwidth percent 25
SW1(config-pmap-c)#class class-default
SW1(config-pmap-c)#bandwidth percent 15
SW1(config-pmap-c)#exit
SW1(config-pmap)#exit

Step 3: Apply the output service policy to all interfaces as shown in the configuration example below:

SW1(config)#int g1/1
SW1(config-if)#service-policy output QOS_POLICY
SW1(config-if)#exit
SW1(config)#int g1/2
SW1(config-if)#service-policy output QOS_POLICY
SW1(config-if)#end

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_IOS_Switch_Y24M04_STIG.zip

Item Details

References: CAT|III, CCI|CCI-001095, Rule-ID|SV-220458r917423_rule, STIG-ID|CISC-RT-000760, STIG-Legacy|SV-110771, STIG-Legacy|V-101667, Vuln-ID|V-220458

Plugin: Cisco

Control ID: 143a369e619e746a7da6e511107701f015dcb2fde0791e832d399341c6f910c5