QoS design for VPN

is there sample/templete for Qos configuration for remote access VPN?
for example:
user from Internet access VPN gateway, once got authenticated, it will get the IP address from DHCP server and access internal resource. how can i configure the Qos to assign minimum bandwidth for this traffic on Internet facing router?

Unclear what you mean by "assign minimum bandwidth". Do you want to cap the traffic, gurantee a minimum, or both? Direction of control, in or out or both?
Is there only one user and only one VPN flow, or several? Is the VPN gateway also the same router as the Internet facing router, or are they different?

Similar Messages

URGENT: QoS Design on Data Center MPLS - MediaNet Question...

Hello,
I am posting this in hopes I can get some guidance from anyone who has done this in the field. We have a large enterprise customer with 21 sites all around the world, they have Verizon MPLS and are experiencing QoS related issues on their WAN regarding Video/Voice. We have proposed remediating their network acccording to the Enterprise QoS SRND 3.3 and the new MediaNet SRND to account for Video and TP QoS (
http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND_40/QoSCampus_40.html )
Here is the problem/question that was proposed in our presales meeting and I honestly don't know where to look for an answer... I am not asking for anyone to design a solution for me, just merely point me in the right direction:
The Data Center has a ~40MB MPLS Connection ( full mesh ) into the cloud ( Verizon )
Site A has a 8MB connection
Site B has a 4MB connection
I know on the Service policy and the interfaces at SiteA and SiteB I can assign "Bandwidth xxxx" and use ~95% of the bandwidth to do queuing and shaping/policing ect. I am not concerned with SiteA and SiteB, that I think I can handle...
Question was posed from the customer, "How can we ensure at the DataCenter level the 40MB MPLS is "chopped" up so that only 8MB of the total speed goes to SiteA ALONG with an attached QoS policy designed for that specific site, as well as ensure only 4MB goes to SiteB with an attached QoS policy.
So I am looking for a way to allocate bandwith per site on the DC 40MB connection going into the cloud ( so that SiteB cannot use more than 4MB ) and attach a MediaNet specific QoS Service policy to that site. The customer does not have seperate MPLS circuits for each site, they all come into the DC on 40MB shared ethernet connection ( no VC, or dedicated circuits to other sites ).
Any thoughts on if this is possible?
Thanks!
Alex

This is an example I have seen and I hope that is useful to you.
Site A
Subnet: 172.16.1.0/24
Site B
Subnet:172.16.2.0/24
HeadOffice:
ip access-list extended Site_A
permit ip any 172.16.1.0 0.0.0.255
ip access-list extended Site_B
permit ip any 172.16.2.0 0.0.0.255
class-map match-any Site_A
match access-group name Site_A
class-map match-any Site_B
match access-group name Site_B
policy-map To_Spokes
class Site_A
shape average 8000000
service-policy Sub_Policy(Optional)
class Site_B
shape average 4000000
service-policy Sub_Policy(Optional)
class class-default
shape average 28000000
service-policy Sub_Policy(Optional)
Interface G0/0
Description To MPLS cloud
bandwidth 40000000
service-policy output To_Spokes
interface G0/1
Description To HeadOffice
bandwidth 40000000
service-policy output To_Spokes
It would be greatly appreciated if someone can correct this or improve it as I am still learning.
Please see the netflow graph from one of our routers using a similar policy as above.

Issue with cisco ONS 15310. Slot with Ethernet ports, designed for bridging.

Hi, guys. I’ve got an issue with cisco ONS 15310 sdh optical network. I’ve got a special slot with Ethernet ports, designed for bridging. Assume, we’ve got to multiplexers, named A and B with ports A0 and B0 respectively. The ios console of these slots says, the configuration is as follows:
no ip address set on these ports
Ports are administratively up
Auto mdix
Bridge groups are the same on these ports.
Dot1q tunnel.
I’m trying to monitor a device with an ip-address connected to port B0. It answers ping if I connect the notebook directly to a device. But if I connect the notebook to port A0 and ping the device pluged in port B0 through the optical network, it doesn’t answer. I tried connections with straight and cross cable.
Guys, who set the network said, it should work as a point to point bridge with no extra configuration. But it doesn’t. I used wireshark sniffer to lookup what’s happening on port A0. All I see is cdp-s from port A0 and self-announcements of the notebook.
Any suggestions? Thank you in advance.

B
Building configuration...
Current configuration : 3712 bytes
! Last configuration change at
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
hostname B
boot-start-marker
boot-end-marker
enable password -
clock timezone -
ip subnet-zero
no ip domain-lookup
no mpls traffic-eng auto-bw timers frequency 0
bridge 100 protocol ieee
bridge 140 protocol ieee
bridge 141 protocol ieee
bridge 142 protocol ieee
bridge 143 protocol ieee
bridge 144 protocol ieee
interface Loopback0
ip address 192.x.0.x 255.255.255.255
interface FastEthernet0
description -
no ip address
mode dot1q-tunnel
bridge-group 140
bridge-group 140 spanning-disabled
interface FastEthernet1
description --- B0 ---
no ip address
mode dot1q-tunnel
bridge-group 141
bridge-group 141 spanning-disabled
interface FastEthernet2
description -
no ip address
mode dot1q-tunnel
bridge-group 142
bridge-group 142 spanning-disabled
interface FastEthernet3
description -
no ip address
mode dot1q-tunnel
bridge-group 143
bridge-group 143 spanning-disabled
interface FastEthernet4
description -
no ip address
mode dot1q-tunnel
bridge-group 144
bridge-group 144 spanning-disabled
interface FastEthernet5
no ip address
shutdown
interface FastEthernet6
no ip address
shutdown
interface FastEthernet7
description -
no ip address
shutdown
mode dot1q-tunnel
bridge-group 100
bridge-group 100 spanning-disabled
interface POS0
description -
no ip address
crc 32
interface POS0.1
encapsulation dot1Q 141
no snmp trap link-status
bridge-group 141
interface POS0.2
encapsulation dot1Q 142
no snmp trap link-status
bridge-group 142
interface POS0.3
encapsulation dot1Q 143
no snmp trap link-status
bridge-group 143
interface POS0.4
encapsulation dot1Q 144
no snmp trap link-status
bridge-group 144
interface POS0.5
description -
encapsulation dot1Q 140
no snmp trap link-status
bridge-group 140
interface POS1
no ip address
crc 32
interface POS1.1
encapsulation dot1Q 100
no snmp trap link-status
bridge-group 100
router ospf 100
log-adjacency-changes
network 192.x.0.x 0.0.0.0 area 0
ip default-gateway [x.x.x.x]
ip classless
no ip http server
snmp-server community public RO
snmp-server ifindex persist
snmp-server trap link ietf
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps config
snmp-server enable traps cpu threshold
snmp-server enable traps entity
snmp-server enable traps syslog
snmp-server enable traps hsrp
snmp-server enable traps config-copy
snmp-server enable traps bridge
snmp-server enable traps ospf state-change
snmp-server enable traps ospf errors
snmp-server enable traps ospf retransmit
snmp-server enable traps ospf lsa
snmp-server enable traps ospf cisco-specific state-change
snmp-server enable traps ospf cisco-specific errors
snmp-server enable traps ospf cisco-specific retransmit
snmp-server enable traps ospf cisco-specific lsa
snmp-server enable traps bgp
snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message
snmp-server enable traps ipmulticast
snmp-server enable traps rtr
snmp-server enable traps mpls traffic-eng
snmp-server enable traps mpls ldp
snmp-server enable traps rsvp
snmp-server enable traps l2tun session
snmp-server enable traps mpls vpn
snmp-server host x.x.x.x public
control-plane
line con 0
line vty 0 4
password -
logging synchronous level 4
login
end

Switchport QoS configuration for WLC

Hi guys,
I am having a question about switchport QoS configuration for WLC. In the "enterprise mobility deployment guide 4.1", it says we can use both either "mls qos trust cos" or "mls qos trust dscp", depending on the mapping, however looking through Jerome's video tutorial on QoS in youtube, he actually mentioned that we need to keep this value as "mls qos trust cos", and I have also read from somewhere else that since controllers are layer 2 device, we do need to use "mls qos trust cos" on the switchport directly connected to the WLC.
however I did see some configurations using "mls qos trust dscp" on the switchport, which is for 5508 WLC due to some hardware design in the 5508 WLC. so I just want to ask what is the differnece between these two commands when we use them for switchports connected to WLC, and does this command really specific for what controller platform we use or it only depends on code version?
thank you very much for your time and help.

Hi George,
Thanks for your reply, however I am still a bit confused on the difference between the two commands...
so in the deployment guide it does say we can do either one on the switchports connected to the WLC, so when should we use trust dscp instead of cos?
it sort of make sense when we talk about WLC is a layer 2 device hence we should use cos, but we also have packets marked with dscp values and I think the controller will keep the value without any modification, then that means we can also use trust dscp in order for this mapping to be done correctly, is this correct?
I did see some other people saying that when using turst dscp and did a packet capture, the values cannot be mapped correctly, but there are also cases that this works. expecially with 5508 series controllers, does it really have some hardware features that doing different things than the 4404s and the 2100 series?
but still, in what situation should we trust dscp on switchports connecting to WLC and when should we use trust cos as a best practice? or we should just forget about trust dscp for switchport connecting to WLC?
Thanks.

Cisco 3650 QoS design: "mls QoS" not supported

Dear colleagues,
I am currently testing a Cisco 3650 for various catalogue items. One key feature that we use on almost all our catalogue items, is Quality of Service (QoS).
On the old Cisco 3560 and 3750, we use "mls qos" and related commands. We use numbered ACLs for untrusted QoS policy that sits on the LAN / ingress port. I have raised a TAC case for this issue but is there a tool to help me convert the "mls QoS" design on the old 3560 platform to the new 3650 platform where "mls qos" is not supported?
Many thanks.

Hi,
The new 3650 runs IOS-XE and the older Cisco 3560 and 3750 run IOS. So the QOS architecture on the new 3650 is different.
here is the link to the qos config for the 3650:
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/3se/qos/configuration_guide/b_qos_3se_3650_cg/b_qos_3se_3650_cg_chapter_011.html
HTH

How will an external Hard drive designed for the macbook Pro work with my White Macbook? My white macbook has a Firewire 400 and the G-Tech HD has a 800 to 400 compatible cable for the firewire.

I am asking this because I want the G-Tech Hard drive says that it is designed for the macbook pro. Yet, I want to back up faster with by using my firewire 400 which is not an option on the one designed for the white macbook that does not have a firewire (only a USB port.) The G-Tech Hard drive comes with the 800 to 400 compatible cable and has 5400 RPM with 750 GB. Also, I've heard that laptops with low battery (mine all the time) won't have the power for a bus powered Hard drive (as in no ac plug in adaptor.) Can I just plug in my laptop? Any one know the answers from experience with this hard drive?

As far as I know, if a harddrive works with a Macpro, it should work with the Macbook: if your Macbook is low on power, plug in the AC adapter
If your Macbook has a firewire port, then it should be fine. BUt i would do somemore research first.

Is this the best design for asynchronous notifications (such as email)? Current design uses Web Site, Azure Service Bus Queue, Table Storage and Cloud Service Worker Role.

I am asking for feedback on this design. Here is an example user story:
As a group admin on the website I want to be notified when a user in my group uploads a file to the group.
Easiest solution would be that in the code handling the upload, we just directly create an email message in there and send it. However, this seems like it isn't really the appropriate level of separation of concerns, so instead we are thinking to have a separate
worker process which does nothing but send notifications. So, the website in the upload code handles receiving the file, extracting some metadata from it (like filename) and writing this to the database. As soon as it is done handling the file upload it then
does two things: Writes the details of the notification to be sent (such as subject, filename, etc...) to a dedicated "notification" table and also creates a message in a queue which the notification sending worker process monitors. The entire sequence
is shown in the diagram below.
My questions are: Do you see any drawbacks in this design? Is there a better design? The team wants to use Azure Worker Roles, Queues and Table storage. Is it the right call to use these components or is this design unnecessarily complex? Quality attribute
requirements are that it is easy to code, easy to maintain, easy to debug at runtime, auditable (history is available of when notifications were sent, etc...), monitor-able. Any other quality attributes you think we should be designing for?
More info:
We are creating a cloud application (in Azure) in which there are at least 2 components. The first is the "source" component (for example a UI / website) in which some action happens or some condition is met that triggers a second component or "worker"
to perform some job. These jobs have details or metadata associated with them which we plan to store in Azure Table Storage. Here is the pattern we are considering:
Steps:
Condition for job met.
Source writes job details to table.
Source puts job in queue.
Asynchronously:
Worker accepts job from queue.
Worker Records DateTimeStarted in table.
Queue marks job marked as "in progress".
Worker performs job.
Worker updates table with details (including DateTimeCompleted).
Worker reports completion to queue.
Job deleted from queue.
Please comment and let me know if I have this right, or if there is some better pattern. For example sake, consider the work to be "sending a notification" such as an email whose template fields are filled from the "details" mentioned in
the pattern.

Hi,
Thanks for your posting.
This development mode can exclude some errors, such as the file upload complete at the same time... from my experience, this is a good choice to achieve the goal.
Best Regards,
Jambor
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Print Layout Designer for UDO

Hi,
Can we design report with print layout designer for UDO forms?
If yes, how do we accomplish this?
If not, is there any other alternative?
I am using 2004B. Thanks.

I use the iTextSharp project to create PDF's (http://itextsharp.sourceforge.net/)... its free and it works (A little hard to use, but it works). A more simple PDF-project are SharpPDF (http://sharppdf.sourceforge.net/). This is also free and very easy to use, but not that many features.

How can I see if my program is for more than one user? We think we have bought in design for more users, but can not find out how to get in for more than one?

How can I see if my program is for more than one user? We think we have bought in design for more users, but can not find out how to get in for more than one?

If you bought a CC for team, you can log in at http://adobe.com and insert the e-mail that you gave at the moment at the purchase and than you can manage and see you product/plan/team.
If I was not clear you can use the following link to help you solving your issue:
Creative Cloud Help | Manage your Creative Cloud for teams membership
If your not clear about this situation, contact with an agent of Adobe, by chat or phone. Use the following link to see the type of support you have on this matter:
http://adobe.com/getsupport
I think this will help you.
Regards

Getting error while publishing workflow using SP designer for SharePoint 2013

Hi,
I am try to setup Workflow manager for our sharepoint applications.
WF manager set ran without any issue.
I registered the SPWorkflow service which succeeded as well. The Workflow service application shows "Workflow is connected"
I am creating a workflow using sharepoint designer using my credential (not Service account). I am able to save it but while publishing, its prompting with an error.
The error says "Errors were found while compiling the workflow.The workflow files were saved but cannot run." Clicking advanced button show
"Microsoft.SharePoint.SPException: We're sorry, we weren't able to complete the operation, please try again in a few minutes. If you see this message repeatedly, contact your administrator.
at Microsoft.SharePoint.SPScaleOutDatabaseMap.CreateSqlSession(ISPScaleOutDatabaseMapProvider mapProvider, Byte[] compositeKey, Guid forceRefreshVersion, Guid& version)
at Microsoft.SharePoint.SPScaleOutDatabaseCommandExecutor.Execute(ExecuteDelegate operation, ISPScaleOutDatabaseMapProvider mapProvide"
Any help would be highly appreciated
Thanks,

Hi,
According to your post, my understanding is that you got error while publishing workflow using SharePoint designer for SharePoint 2013.
Please check whether the Central Admin > Manage Service Application-> “App Management Service” is started.
Please check whether the “Configure service application associations”, ”App Management Service” is already associated.
Then please check whether the “Manage Services on server” and the “App Management Service” is started.
In addition, please try to re-register Workflow Service.
If the issues still exists, please follow the steps in the
Steps to Verify that Server Is Correctly Set Up. After you verified that the server is correctly set up, follow the steps in the
Steps to Troubleshoot Workflow Management Service and
Troubleshooting the Service Bus for Windows Server then retry your action related to publishing workflows
More information:
http://wp.ahcheng.com/2013/03/23/error-were-found-when-compiling-the-workflow-the-workflow-files-were-saved-but-cannot-be-run/
http://sp2013.pro/2013/04/solution-errors-were-found-when-compiling-the-workflow-the-workflow-files-were-saved-but-cannot-be-run-cannot-set-unknown-member/
Best Regards,
Linda Li
Linda Li
TechNet Community Support

This workflow cannot be imported because it was created in SharePoint Designer for a different Site

Hello everyone. I am getting this error when attempting to move minor workflow changes from mirror SharePoint development / production environments and hoping someone can help me.
"This workflow cannot be imported because it was created in SharePoint Designer for a different site, or the original workflow has been moved or deleted. To move a workflow between sites, use Save as Template (.wsp file) instead of a Visio workflow
drawing."
So basically I have taken an image of our single SharePoint server, Domain Controller, and a client and restored them to an OFFLINE development environment for the testing of workflow changes prior to production. I've put quite a bit of time into one
particularly and would like to export/import rather than re-created from scratch.
I've successfully created the form template and imported. This created the necessary list items nicely and the form appears to work as expected. However, when attempting to import the .VWI file exported from dev SharePoint, I am getting the above
error. If I change the .VWI to .zip and remove the "workflow.xoml.wfconfig.xml" file, then re-zip and change the file extension back to .VWI I get a dialog that allows me to import, but I have to choose a new name and much of the related content
is lost. I need to be able to overwrite/merge the existing workflow with the import. Any suggestions?
One strange thing I ran into was during a test of an export/import from and to the exact same environment. If I simply export to .VWI, then import from .VWI with no changes, SAME everything I still get this error. Very weird. Hoping someone can shed some
light on the subject. Thank you.
Adam Tyler

Hi Adam,
Here is a blog talk about the same issue would be helpful:
http://techiescode.blogspot.com/2014/09/copymove-sharepoint-2010-designer.html
Best Regards
Dennis Guo
TechNet Community Support

I've just bought a Macbook Pro 15" and I'm trying to use Photoshop, but the resolution its displaying the images at for 100% are too small. I have to design for the web, so need to be intricate with detail, but I'm finding it adjusts the resolution of the

I've just bought a Macbook Pro 15" and I'm trying to use Photoshop, but the resolution its displaying the images at for 100% are too small. I have to design for the web, so need to be intricate with detail, but I'm finding it adjusts the resolution of the image right down. (I mean you can see the image clearly, but it's too small to edit). When I look at Safari and see a web page at 100% it's clear, but the same page displayed in Photoshop CC appears 50% of the size (even though it says it's 100%) If I move the application window to another screen it adjusts it correctly – leaving all the pallettes, menus and tools correctly sized as they are on the retina display Is there some way to adjust the way Photoshop CC displays images so it is more consistent with what you actually see? There doesn't seem to be any answer on the Adobe forum, so hopefully someone here can shed some light. MacBook Pro with Retina display, 15", OS X Yosemite (10.10.2), Photoshop CC 2014

I tested both ways. With "open in low resolution" ckecked the size of the images is cool, but it is low-resolution including Photoshop appearance.
If "open in low resolution" is unckecked the appearance is good but the very small size.
See the image below. It has 650 x 732 px, 72 dpi. The font of the text "Neste aniversário ..." is with 18pt.

Architectural design for FTP batch processing

Hello gurus,
I would like your help in determining the design for the following.
We receive several HL7 messages as a text file and copied to a shared network folder. All these files are created into several different folders depending on the region, message type. We need to come up with a B2B process to read all the files from the netwrok folder using FTP (batch process) and translate if needed (depending on the scenario) and transfer the files over to other destination folder on the network (using FTP).
For this, we can create TPs with Generic FTP channel and this works without any issues. By doing this way, we need to create TP for each and every type of message which reads the files from its own specified directory location on the network based on the the polling interval.
My question is, instead of creating TPs for each and every type of file, is there a way by which I can write a common web service that reads the source files from the network and based on the type of the file route to the proper destination folders. If it is possible, I would like to know the architecture for accomplishing this task.
I really appreciate your kind help on this.
Thanks and regards,
Raghu

Hi Raghu,
Is it a B2B communication scenario?
By doing this way, we need to create TP for each and every type of message which reads the files from its own specified directory location on the network based on the the polling interval.Why cann't you have only one TP with multiple documents, channels and agreements?
My question is, instead of creating TPs for each and every type of file, is there a way by which I can write a common web service that reads the source files from the network and based on the type of the file route to the proper destination folders. If it is possible, I would like to know the architecture for accomplishing this task.Depends on your use case and products you want to use. You can very well use FTP adapter with BPEL and poll for files. Use DVM in composite to figure out the destination and send it there. You may use OSB if it is a typical routing case with heavy load and performance is a concern. You may use B2B as well here. So ultimately you need to figure out what you want and what tools you want to use.
Regards,
Anuj

CAS SSO not working for VPN Group

Hello,
I am trying to get SSO working for a CAS/CAM in a inband virtual gateway for VPN users coming in off a ASA5520. There are two VPN groups each with its own group policy and tunnel group. One group uses a Windows IAS Radius Server and the other a token based RADIUS RSA device.
Users use the AnyConnect client to connect to the ASA where they are dumped into a vlan. SSO works for the group that uses the Winodws radius server. On the CAS the Cisco VPN Auth server has the Unauthenticated Group as the default group, and then I use mapping rules (Framed_IP_Address) to get the different vpn groups into the right roles. This works for the one group, but since SSO is not working on the second group the CAS never gets the chance to assign them into the correct role.
The only thing I got is this from the ASA:
AAA Marking RADIUS server billybob in aaa-server group cas_accounting as ACTIVE
AAA Marking RADIUS server billybob in aaa-server group cas_accounting as FAILED
I am so close but cant call this done yet....

Hey Faisel,
Thanks for the question.
This is the stange thing. For days Group A (Windows Radius Server) was working and Group B (RSA Radius Server) would not work. Then for some reason I had to reboot the CAS and BOOM...Group B started working and Group A STOPPED working.
So on the ASA I now get these:
AAA Marking RADIUS server cas2-hvn-3515 in aaa-server group cas_accounting2 as ACTIVE
AAA Marking RADIUS server cas2-hvn-3515 in aaa-server group cas_accounting2 as FAILED
Where cas_accounting2 is the AAA server group for Group A
On the ASA I can see that the FW sends a packet to the cas:
"send pkt cas2-hvn-3515/1813"
but the FW never gets an answer back from the CAS for Group A whereas with Group B I can see the response from the CAS.
"rad_vrfy() : response message verified"
What can I look for in the CAS logs to see where the problem is. I will try and setup a packet capture on the CAS and debug it too.

I received a car charger for xmas. I have an iPhone 4. Is there a difference in the charging dock between the older and newer iphones? I don't want to damage it by shoving a cable in that is designed for a newer model.

I received a car charger for xmas. I have an iPhone 4. Is there a difference in the charging dock between the older and newer iphones? I don't want to damage it by shoving a cable in that is designed for a newer model.

there are 2 connectors the old pin30 and the new ligthing bolt
they don't look very much alike so if anybody were damage byt forcing it in it would be their own fault seeing how diffrent they are

QoS design for VPN

Similar Messages

Maybe you are looking for