QoS Admission Control

QoS Admission Control offers the ability to centrally designate how, when, and by whom subnet resources are used. This is achieved through the Windows 2000 implementation of subnet bandwidth management (SBM) and Quality of Service (QoS).

  • Before installing the QoS Admission Control, see Checklist: Installing and configuring QoS Admission Control.
  • For tips about using QoS Admission Control, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Installing and configuring QoS Admission Control

Step | Reference
Review QoS Admission Control concepts. | Concepts
Plan QoS Admission Control networks. | Planning QoS Admission Control networks
Install QoS Admission Control. | To install QoS Admission Control
Verify that you have administrator rights to the computer on which you are installing the QoS Admission Control. |
Verify that the TCP/IP protocol is successfully configured on the computer. The computer must have a valid IP address. |
Start QoS Admission Control. | To start QoS Admission Control
Configure QoS Admission Control subnets. | Configure subnets
Verify that you have the IP address of the subnet you want to configure. |
Verify that you have the capacity limits of the network you want to manage with the QoS Admission Control. |
Configure user policies. | Configure user policies
Verify that you have administrator rights to Active Directory. |
Review policy recommendations. | Using QoS Admission Control


Best practices

The Windows 2000 QoS Admission Control console greatly simplifies the implementation of admission control services. To take best advantage of this:

  • Assign QoS Admission Control policies at the highest possible level. The default policies for the enterprise and subnet levels provide the broadest effects with the least effort. Enterprise policies apply to all users on all QoS Admission Control-managed subnets. If individual users have special requirements, you can create exceptions to the default policy for those users that contain only the attributes that must be different.
  • Install QoS Admission Control on a second host on the same subnet. This ensures that subnet resources are managed, even when the primary QoS Admission Control host is not available.
  • Disable the AcsService account from interactive logons. AcsService is a service account that does not need to be accessed by users. Because it has privileges, disabling logons enhances security by preventing unauthorized system entry through this account.


How to...

This section provides help with specific tasks required to install and configure the QoS Admission Control, and its associated policies.

  • Use QoS Admission Control
  • Configure policy


Use QoS Admission Control

  • Install QoS Admission Control
  • Install QoS Packet Scheduler


Install QoS Admission Control

To install QoS Admission Control

  1. Open the Windows Components wizard.
  2. In Components, click Networking Services (but do not select or clear its check box), and then click Details.
  3. Select the QoS Admission Control Service check box, and click OK.
  4. Click Next, and then click Finish.

Notes

  • To open Add/Remove Programs, click Start, point to Settings, and click Control Panel, and then double-click Add/Remove Programs. Click Add/Remove Windows Components.
  • Certain Windows components require configuration before thay can be used. If you installed one or more of these components, but did not configure them, when you click Add/Remove Windows Components, a list of components that need to be configured is displayed. To start the Windows Components wizard, click Components.
  • QoS Admission Control must be installed on a domain controller in Active Directory.
  • You must be logged in as an Administrator to install and configure QoS Admission Control.

Related Topics


Install QoS Packet Scheduler

To install QoS Packet Scheduler

  1. Open Network and Dial-up Connections.

  2. Click the Local Area Connection on which you want to install QoS Packet Scheduler, and then, on the File menu, click Properties.

  3. Click Install, click Service, and then click Add.
  4. Click QoS Packet Scheduler, and then click OK.

Notes

  • To open Network and Dial-up Connections, click Start, point to Settings, and click Control Panel.
  • Install Packet Scheduler on all end-systems that make reservations on your QoS Admission Control subnet.

Related Topics


Configure policy

  • Start QoS Admission Control
  • Configure subnets
  • Configure user policies


Start QoS Admission Control

To start QoS Admission Control

  • Open QoS Admission Control.

Notes

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.

Related Topics


Configure subnets

  • Create QoS Admission Control subnets
  • Configure traffic properties
  • Configure server properties for this subnet
  • Configure logging properties
  • Configure accounting properties
  • Configure advanced properties


Create QoS Admission Control subnets

To create QoS Admission Control subnets

  1. Open QoS Admission Control.
  2. In the console tree, click Subnetwork Settings.
  3. On the Action menu, and click Add subnetwork.

    If you are reconfiguring a subnet, click Action, and then click Properties.

  4. Type the IP address for the subnet, using the following format:

    IP Address/subnet mask width in bits (for example, 10.1.2.0/24)

  5. In the Subnet Properties dialog box, select the settings you want to apply to the subnet:
    • To configure data rates and service levels for the subnet, use the Traffic tab.
    • To administratively enable servers to act as QoS Admission Control hosts, use the Servers tab.
    • To require that QoS Admission Control hosts log all subnet RSVP messages, use the Logging tab.
    • To track network resource usage on the subnet by user, use the Accounting tab.
    • To determine the behavior of the QoS Admission Control hosts managing this subnet, use the Advanced tab.

Notes

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.
  • The IP address you enter must be the actual subnet ID, followed by the number of bits used to uniquely identify the subnet (for example, 10.1.2.0/24). For detailed information on subnet masks and IP addressing for TCP/IP, see Related Topics.
  • The Primary Domain Controller domain administrator must change the security settings for the subnet object on the PDC to allow the child domain administrator (or another user) to modify the subnet object.

Related Topics


Configure traffic properties

To configure traffic properties

  1. Open QoS Admission Control.
  2. Click the subnet you want to configure.

    3. Where?

    • QoS Admission Control
    • Subnetwork Settings
    • Applicable subnet
  3. On the Action menu, click Properties.
  4. Click Traffic, and configure traffic properties for this subnet:
    • Select Enable Admission Control Service on this subnet to enable the service on this subnet.
    • To supply a text description of the subnet to which this policy applies, type your description in Description of the subnetwork.
    • To set the maximum rate at which data can travel on this subnet, type a number in Data rate per flow.
    • To set the maximum rate allowed during a burst of packets on this subnet, type a number in Peak data rate per flow that is equal to or greater than Data rate per flow.
    • To set the maximum rate for all simultaneous flows on this subnet, type a number in Aggregate data rate that is equal to or greater than the Peak data rate per flow.
    • To set the maximum rate on all simultaneous flows during a burst of packets on this subnet, type a number in Aggregate peak data rate that is equal to or greater than the Peak data rate per flow.

Note

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.

Related Topics


Configure server properties for this subnet

To configure server properties for this subnet

  1. Open QoS Admission Control.
  2. Click the subnet you want to configure.

    3. Where?

    • QoS Admission Control
    • Subnetwork Settings
    • Applicable subnet
  3. On the Action menu, click Properties.
  4. Click Server, and configure server properties for this subnet:
    • Click Add to add a server to the list of servers allowed to run QoS Admission Control on this subnet.
    • Click Remove to remove a selected server from the list of servers allowed to run QoS Admission Control.

Note

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.

Related Topics


Configure logging properties

To configure logging properties

  1. Open QoS Admission Control.
  2. Click the subnet you want to configure.

    3. Where?

    • QoS Admission Control
    • Subnetwork Settings
    • Applicable subnet
  3. On the Action menu, click Properties.
  4. Click Logging, and configure logging properties for this subnet:
    • To determine whether the QoS Admission Control host records all RSVP messages in a log file, select Enable RSVP message logging.
    • To specify where you want the log file to be created, type the path in Log file location. This location may contain environment variables. For example, type %windir%\system32\LogFiles.
    • To specify the maximum number of circular log files QoS Admission Control can create, type a number in Number of log files.
    • To specify the largest size that each circular log file can be before the next one is created, type a number in Maximum file size.
    • To determine what type of transactions are tracked in the Windows 2000 Event Log, select the appropriate number in Logging level:
      • 0 Fatal Errors Only
      • 1 All Errors
      • 2 All Warnings and Errors
      • 3 All available information

Notes

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.
  • If the RSVP log reaches the maximum file size, it creates a new file. If it has reached the maximum number of files, it overwrites the first log file.
  • Each log file contains approximately 500 messages per megabyte of file size. Keeping the maximum log file size to a smaller value reduces the impact on disk space and eases the task of locating specific transactions.
  • When using logging features, always monitor storage space in use and be careful not to set log file sizes too high for available disk space.
  • The log file appears in the account file location you specified with the file name RSVPTRACExx.txt, where xx represents the sequential, ascending number of the log file.

Related Topics


Configure accounting properties

To configure accounting properties

  1. Open QoS Admission Control.
  2. Click the subnet you want to configure.

    3. Where?

    • QoS Admission Control
    • Subnetwork Settings
    • Applicable subnet
  3. On the Action menu, click Properties.
  4. Click Accounting, and configure accounting properties for this subnet:
    • To record QoS Admission Control host information about network resource usage in a log file, select Enable Accounting.
    • To specify where the log file is created, type the appropriate path in Account file location. This location might contain environment variables. For example, type %windir%\system32\LogFiles.
    • To specify the maximum number of circular log files created before the first is overwritten with new data, type a number in Number of files.
    • To specify the largest size of each circular log file before the next one is created, type a number in Maximum file size.

Notes

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.
  • If the QoS Admission Control accounting log reaches the maximum file size, it creates a new file. If it has reached the maximum number of files, it overwrites the first log file.
  • The log file appears in the directory specified and is named ACSUSERSESSIONxx.txt, where xx represents the sequential, ascending number of the log file.
  • By default, each log file contains approximately 500 messages per megabyte of file size. Keeping maximum log file size to a smaller, rather than larger value, reduces the impact on disk space and eases the task of locating specific transactions.
  • When using logging features, always monitor storage space in use and be careful not to set log file sizes too high for available disk space.

Related Topics


Configure advanced properties

To configure advanced properties

  1. Open QoS Admission Control.
  2. Click the subnet you want to configure.

    3. Where?

    • QoS Admission Control
    • Subnetwork Settings
    • Applicable subnet
  3. On the Action menu, click Properties.
  4. Click Advanced, and configure advanced properties for this subnet:
    • The Election Priority determines which host becomes the designated subnet bandwidth manager (DSBM) for the subnet. By default, the election priority is set to the same value on all QoS Admission Control hosts. The election is performed automatically.
    • To determine how often the QoS Admission Control hosts beacon on the subnet, type a number in Keep alive interval.
    • To set the interval following the last beacon, type a number in Dead interval.
    • To determine how often the QoS Admission Control host checks the directory service for new policy information, type a number in Local policy cache timeout.
    • To determine the rate at which the data flow is sent until the network reservation is complete, type a number in Data rate before reservation.

Notes

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.
  • Once the reservation is in place, the Data rate before reservation value is ignored. At this time, the traffic properties of the applicable QoS Admission Control policy determine the treatment of the data flow.

Related Topics


Configure user policies

  • Configure enterprise policies
  • Add subnet policies
  • Delete subnet policies
  • Configure user traffic properties


Configure enterprise policies

To configure enterprise policies

  1. Open QoS Admission Control.
  2. In the console tree, click Enterprise Settings.
  3. On the Action menu, click Add Policy.

  4. On the General tab under Identity, click the user type or group to which this policy applies.

    • If this policy applies to any member of a trusted domain, click Any Authenticated User.

    • Or, if this policy applies to any member not in a trusted domain, click Un-authenticated user.

    • If this policy applies to a specific user, click User and type a user name.
    • If this policy applies to an organizational unit (OU), click OU and type the organizational unit name.

  5. On the Flow limits and Aggregate limits tabs, set the traffic properties for the user policy.

Notes

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.
  • Modify the enterprise-level Any Authenticated User policy to meet the general needs of your users. The only time you need to create additional policies is when a user requires an exception to the enterprise policy.
  • Use the default Un-authenticated User policy to meet the general needs of external users, such as those who access the network but are not authenticated by a trusted Windows domain.

Related Topics


Add subnet policies

To add subnet policies

  1. Open QoS Admission Control.
  2. Click the subnet folder for which you want to add a user policy.

    3. Where?

    • QoS Admission Control
    • Subnetwork Settings
    • Applicable subnet
  3. On the Action menu, click Add Policy.
  4. If this policy is for members of a trusted domain, on the General tab under Identity, click Any authenticated user. If not, click Un-authenticated user.
  5. If this policy applies to a specific user, click User and type a user name.
  6. If this policy applies to an organizational unit (OU), click OU and type the organizational unit name.
  7. On the Flow limits and Aggregate limits tabs, type settings for the user policy.

Notes

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.
  • If you want to apply exceptions to the general enterprise policy that was created, modify the Any Authenticated User policy under the appropriate subnet.
  • To meet the general needs of external users, such as those who access the subnet but are not authenticated by a trusted Windows domain, use the default Un-Authenticated User policy.

Related Topics


Delete subnet policies

To delete subnet policies

  1. Open QoS Admission Control.
  2. Click the subnet folder for which you want to delete a policy.

    3. Where?

    • QoS Admission Control
    • Subnetwork Settings
    • Applicable subnet
  3. Click the policy you want to delete.
  4. On the Action menu, click Delete QoS ACS Policies.

Note

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.
  • This procedure deletes only the policies for the selected subnet. In order to delete the subnet object, go to the Active Directory Sites and Services console and remove the subnet object you want to delete.

    To delete the subnet object, open Active Directory Sites and Services, open the Sites folder, open the Subnets folder, and then click the subnet object you want to delete. On the Action menu, click Delete.

Related Topics


Configure user traffic properties

To configure user traffic properties

  1. Open QoS Admission Control.
  2. In the console tree, click Enterprise Settings.

    Or, if you want to configure policies at the subnet level instead of the enterprise level, click Subnetwork Settings.

  3. In the details pane, select the user for which you want to set the traffic properties. To add properties for a new user, on the Action menu click Add Policy. Next, on the General tab, in User, type a user name or click Browse.
  4. On the Action menu, click Properties.
  5. Set traffic properties. To see more information and recommendations about each traffic property, right-click the property, and then click What's This?.

Note

  • To open QoS Admission Control, click Start, point to Programs, point to Administrative Tools, and then click QoS Admission Control.

Related Topics


Concepts

This section provides general background information about the QoS Admission Control.

  • QoS Admission Control overview
  • Understanding the QoS Admission Control model
  • Using QoS Admission Control
  • Resources


QoS Admission Control overview

This topic covers:

  • QoS Admission Control defined
  • Benefits of QoS Admission Control


QoS Admission Control defined

QoS Admission Control is a Windows 2000 component that you can use to manage the use of network resources (bandwidth) at the subnet level. It is based on the Internet Engineering Task Force (IETF) standard for subnet bandwidth management (SBM).

The efficient use and allocation of bandwidth are important concerns for network administrators, especially with the emergence of real-time, multimedia programs. QoS Admission Control resolves this issue by preventing programs from consuming more bandwidth than the subnet can handle. It controls the amount of bandwidth that can be reserved, how the traffic is sent, and who can reserve priority bandwidth.

You can use the QoS Admission Control console to centrally create and manage QoS Admission Control policies. QoS Admission Control uses policy-based administration to determine when and how priority bandwidth is allocated and who can reserve it. You can configure policies to meet the requirements of a user, program, site, or global enterprise.

Any subnet clients that are SBM-enabled can use QoS Admission Control to request priority bandwidth. This includes any hosts running Windows 2000, Windows 98, or SBM client software. The client programs used to send data on the subnet must be QoS-enabled. In this documentation, subnet clients refers to SBM-enabled clients running QoS-enabled programs.


Benefits of QoS Admission Control

Windows 2000 QoS Admission Control simplifies your management of bandwidth at a low cost of ownership. You can:

  • Centralize policy and subnet configuration in the QoS Admission Control console.
  • Use the user and subnet identities as criteria for reserving network resources and setting priorities.
  • Make bandwidth reservation transparent to the user, requiring no user training.
  • Partition network resources between low-priority and high-priority traffic.
  • Safeguard end-to-end delivery service with low delay guarantees.
  • Interoperate with LAN, WAN, ATM, Ethernet, and Token Ring configurations.
  • Support multicast transmission of bandwidth reservation messages.
  • Process bandwidth reservation messages that are encrypted by Windows 2000 IP Security.


Understanding the QoS Admission Control model

This topic covers:

  • Quality of Service (QoS)
  • RSVP
  • Traffic control
  • QoS Admission Control


Quality of Service (QoS)

In order to understand how the QoS Admission Control works, it is necessary to first understand Quality of Service (QoS).

Generally, quality of service is the set of methods or processes a service-based organization implements to maintain a specific level of quality. In the context of Windows 2000, QoS is a set of service requirements that the network must meet to assure an adequate service level for data transmission.

Implementing QoS enables real-time programs to make the most efficient use of network bandwidth. Because it assures some level of guarantee for sufficient network resources, it gives a shared network a level of service similar to that of a private network.

A QoS guarantee indicates a service level that enables a program to transmit data in an acceptable way and in an acceptable time frame.

Quality of Service model

The goal of QoS is a guaranteed delivery system for network traffic, such as Internet Protocol (IP) packets. The set of mechanisms QoS uses to achieve this goal includes services and protocols. The Windows 2000 implementation of QoS includes:

  • A subnet bandwidth management (SBM) service for controlling bandwidth on a subnet.
  • Integrated Resource Reservation Protocol (RSVP), enabling the sender and receiver of a communication to establish a reserved, QoS highway for traffic.
  • Traffic control services for prioritizing and scheduling traffic.


RSVP

This topic covers:

  • RSVP overview
  • RSVP messages
  • RSVP example


RSVP overview

The QoS Admission Control and its subnet clients use the resource reservation protocol (RSVP) as a message service for priority bandwidth requests. RSVP is a signaling protocol that carries the bandwidth reservation along a data path that is predetermined by the network routing protocol. This protocol:

  • Supports multicast or unicast transmission.
  • Passes the reservation request to all network components in the traffic flow path.
  • Maintains the reservation at each RSVP-aware network component or hop (such as a router, computer, or switch) between the sending and receiving computers.
  • Passes transparently through routers and switches that do not support RSVP.

For the reservation to be fully guaranteed, each hop must grant the reservation and physically allocate the requested bandwidth. By granting the reservation, the hop commits to providing adequate resources.

If the reservation is rejected, the program receives an immediate response that the network cannot currently support the amount and type of bandwidth or support the requested service level. The program determines whether to send the data now using best-effort delivery or to wait and repeat the request later.

RSVP is a soft-state protocol, requiring that the reservation be periodically refreshed. The reservation information, or reservation state, is cached in each hop. If the network routing protocol alters the data path, RSVP automatically installs the reservation state along the new route. If refresh messages are not received, reservations time out and are automatically dropped, releasing bandwidth.

Notes

  • Currently, many routers and switches are not RSVP-compliant. In these cases, the reservation messages simply pass through each hop. End-to-end and low-delay guarantees for the requested service level are not available.
  • RSVP works with any current-generation routing protocol with no modifications required, and supports a number of network layer protocols, including TCP/IP.


RSVP messages

RSVP uses the following message types to establish and maintain reserved traffic paths on a subnet:

Message type | Function
PATH | Carries the data flow information from the sender to the receiver. The PATH message reserves the path that requested data must take when returning to the receiver. PATH messages contain bandwidth requirements, traffic characteristics, and addressing information, such as the source and destination IP addresses.
RESV | Carries the reservation request from the receiver. RESV messages contain the actual bandwidth reservation, the service level requested, and the source IP address.
PATH-ERR | Indicates an error in response to the PATH message.
RESV-ERR | Indicates an error in response to the RESV message.
PATH-TEAR | Removes the PATH state along the route.
RESV-TEAR | Removes the reservation along the route.


RSVP example

RSVP was initially designed to be receiver-initiated because sender initiation does not scale well to large, multicast scenarios in which there are heterogeneous receivers. With RSVP, each receiver makes its own reservation, and any differences among reservations are resolved by RSVP. If different receivers require different resources, both the sender and routers merge the reservation requests by taking the maximum values requested.

The following illustration shows a typical series of events involving RSVP messages:

The RSVP model

In this example, a client requests data from a multimedia server. RSVP PATH and RESV messages are exchanged to establish a reservation so that the server can send data back to the client with the correct priority markings, which the intermediate network components handle appropriately.

  1. The multimedia server sends a PATH message to the QoS Admission Control host.
  2. The QoS Admission Control host approves the request and sends it toward the client. The PATH message travels through the network, setting up a PATH state at each hop. Each PATH state contains a copy of the PATH message and the IP address of the previous hop host.
  3. The client creates an RESV message, indicating that it wants to receive the data. The RESV message follows the reverse data path to the multimedia server, using the addressing information in the PATH state to determine the route.
  4. As the RESV message arrives at each hop, the reservation is granted and physical bandwidth is allocated. The hop maintains the reservation (RESV) state and notifies traffic control that data is to be sent.
  5. The multimedia server and the client periodically send PATH and RESV messages during the data transmission, to keep the reservation state in place.


Traffic control

This topic covers:

  • Traffic control overview
  • Traffic control components
  • Service levels


Traffic control overview

Traffic control is a QoS mechanism that:

  • Reduces delay and latency (accumulated delay) in the transmission of network traffic.
  • Works with QoS Admission Control and RSVP to meet the service level and priority required in the bandwidth request.
  • Starts when a QoS-enabled client program requests QoS.
  • Is available for subnet clients that are not QoS Admission Control-enabled (the client programs must be QoS-enabled).
  • Controls data flow through devices that do not use RSVP.

For more information about installing the Windows 2000 traffic control mechanism, QoS Packet Scheduler, see To install QoS Packet Scheduler.


Traffic control components

To reduce network delays, the traffic control dynamic-link library (DLL) shapes and prioritizes traffic, using a process of packet classification and scheduling.

  • The packet classifier determines the service class to which an individual packet belongs. Packets are then queued by service level to be serviced by the packet scheduler.
  • The packet scheduler determines the delivery schedule of each packet queue and handles competition between queued packets that need simultaneous access to network resources. The packet scheduler takes the information from the packet classifier, creates queues for each data flow, and then empties the queues at the rate specified by RSVP when the flow was created.

The Packet Scheduler should be installed on all end-systems that make reservations on your QoS Admission Control subnet. For more information, see To install QoS Packet Scheduler.


Service levels

The service level for each data flow is configured in each QoS Admission Control policy, as part of the traffic properties. To determine the appropriate service level setting required, it is necessary to understand traffic patterns, which fall into two major groups: elastic and real-time.

  • Elastic traffic adapts easily to change. When little bandwidth is available, elastic traffic delivery is slow. Delivery is expedited when bandwidth is abundant. The data sender is automatically tuned to the rate of the network. Elastic traffic is usually generated by interactive-oriented or transaction-oriented programs, such as bulk data transfers.
  • Real-time traffic has the characteristic that the arrival time interval, between any two packets at the receiver, must closely match their departure interval. Real-time traffic is limited in its ability to adapt to changing network conditions, and delays can significantly reduce intelligibility. For example, stretched or dropped syllables during audio conferencing can alter both context and content. If video traffic is delayed too long, the picture cannot be viewed.

Three service levels are supported in QoS Admission Control. Best effort is suitable for elastic traffic. The other two levels are suitable for real-time programs, giving them preferential service. At these two levels, any unreserved bandwidth or reserved bandwidth not currently in use remains available for other traffic.

  • Best effort is the standard operating procedure of many IP-based networks. It is a connectionless model of delivery that is suitable for elastic traffic. Packets are sent with no guarantees for low delay or adequate bandwidth.
  • Controlled load approximates the behavior of best-effort service in unloaded (not heavily loaded or congested) conditions. A flow receiving controlled load service at a network element can experience little or no delay or congestion loss.
  • Guaranteed service guarantees the maximum limit on delay. This is most useful if every host on the data path provides it, including routers or switches that are compliant with QoS and RSVP.

Clearly, the network user benefits from choosing guaranteed service because it improves the quality of transmission. However, the impact of guaranteed traffic on the network is heavy, so it is not desirable for programs that generate elastic or best-effort traffic.


QoS Admission Control

This topic covers:

  • Admission Control overview
  • Admission Control model
  • Client/server example


Admission Control overview

Real-time programs typically use the RTP or UDP protocol to send data. These protocols allow faster transmission than connection-oriented protocols (such as TCP), which can create delays when they verify transmission after every packet. Because RTP and UDP are connectionless protocols, however, reliability of the delivery service is limited. If the network is congested and packets are dropped, there is no recovery.

The performance of real-time programs depends on low-delay service because significant delays and losses cause distorted or incomplete images and sounds. To deploy real-time programs with an acceptable traffic rate, network resources must have some level of guaranteed availability. Also, the resource management must allow real-time traffic to coexist with traditional traffic on the same network. QoS Admission Control, working with Windows 2000 Quality of Service (QoS), is a simple and economical model for achieving this, especially when the alternative is a different network for each type of traffic.

You can use QoS Admission Control to centrally designate how, by whom, and when shared network resources are used. After you install and configure the service, the ACS host controls bandwidth for the subnet to which it is connected. Any host on the subnet (subnet clients) can submit priority bandwidth requests to the QoS Admission Control host. This host determines if adequate bandwidth is available, based on the following:

  • The current state of resource availability on the subnet
  • QoS Admission Control user policy rights

You can set up a QoS Admission Control host on any network-enabled computer running Windows 2000 Server. QoS Admission Control operates at the IP network layer, servicing the most common program protocols, including all transport protocols in the TCP/IP protocol suite (TCP, UDP, and RTP).

Clients and servers running Windows 98 or Windows 2000 are automatically configured to use the QoS Admission Control host to request bandwidth. QoS Admission Control also supports clients running any other operating systems that are SBM-enabled (running subnet bandwidth management client software).

Programs that are not QoS-aware do not interact with the QoS Admission Control, and receive best-effort service levels from the network.


Admission Control model

The illustration below shows different clients making reservation requests to the same QoS Admission Control host. In the illustration, "Shared media" represents the subnet. Each subnet client must pass its reservation request through the QoS Admission Control host.

The QoS Admission Control model

The QoS Admission Control host multicasts beacons, which are messages that notify subnet clients that it is present and ready to receive requests. A client will not attempt to send a request to a host that is not sending beacons. To avoid losing bandwidth management services, you can install the QoS Admission Control on multiple hosts on the same subnet. Only one QoS Admission Control host actually performs bandwidth management services at any time. The other QoS Admission Control hosts function as backups, automatically becoming active if the primary QoS Admission Control host stops functioning.

The QoS Admission Control host grants or rejects bandwidth requests based on the QoS Admission Control policy rights of the user. The host rejects a request if the user does not have the right to reserve priority bandwidth on that subnet or to reserve the requested amount of bandwidth, or if the subnet itself is not capable of making the guarantee at the time. Traffic is never blocked if a request cannot be granted. Instead, the program is notified and determines whether to immediately send the data at the best-effort service level or to wait and request priority bandwidth later.

As each request is received by the QoS Admission Control server, the process follows this sequence:

  1. The requesting user identity is verified using the Kerberos protocol, which is the default Windows 2000 authentication service.
  2. The QoS Admission Control policy for that user is retrieved from Active Directory.
  3. The QoS Admission Control host checks the policy to see if the user has adequate rights for the request and then verifies whether network resource levels are adequate.
  4. The QoS Admission Control host approves or rejects the request.

When the request is granted, priority bandwidth is logically allocated by the QoS Admission Control host and the request is forwarded to the receiving host.


Client/server example

The following illustration shows a QoS Admission Control host configured to allow a maximum reservable bandwidth of 20 megabits per second (Mbps). Each client represents a host on the managed subnet.

QoS Admission Control deployment

In this example, the following events occur:

  1. A video-conferencing program on Client A requests 10 Mbps of reserved bandwidth. The QoS Admission Control host determines that there is available bandwidth and logically grants the reservation, after which 10 Mbps of the possible 20 Mbps of bandwidth are allocated.
  2. A video-conferencing program on Client B requests 10 Mbps of reserved bandwidth. Because there is still bandwidth available, the QoS Admission Control host logically grants the reservation. Now, 20 Mbps of the possible 20 Mbps of bandwidth are allocated, and no additional bandwidth is available.
  3. A video-conferencing program on Client C requests 10 Mbps of reserved bandwidth. Because no priority bandwidth is available at this time, the QoS Admission Control host rejects the reservation. The program on Client C determines whether to send the data now at a best-effort service level or wait until priority bandwidth becomes available.


Using QoS Admission Control

This topic covers:

  • Planning QoS Admission Control networks
  • QoS Admission Control servers
  • QoS Admission Control policies
  • Interpreting QoS Admission Control log files
  • Using Windows monitoring tools with QoS Admission Control


Planning QoS Admission Control networks

Before you implement QoS Admission Control, it is recommended that you make sure your hardware, Windows configuration, and QoS policies meet the necessary requirements for QoS Admission Control.

Hardware

QoS Admission Control requires network adapters that are compatible with the IEEE 802.1p standard. This standard provides the mechanism necessary for traffic control. For more information about the standards upon which Windows QoS Admission Control networks are based, see QoS Admission Control standards (RFCs) and Internet Drafts (QoS Admission Control).

Windows configuration

QoS Admission Control must be installed on a Windows 2000 Server that is a member of the domain that contains the subnet you intend to manage. For more information about installing QoS Admission Control, see To install QoS Admission Control.

Packet Scheduler should be installed on every end-system in the subnet that makes reservations with the QoS Admission Control. For more information about installing Packet Scheduler, see To install QoS Packet Scheduler.

QoS Admission Control policies

Enterprise and subnet policies can be applied to users and objects in your QoS Admission Control-enabled network. QoS Admission Control policies are represented in the directory service. For more information about planning and implementing QoS Admission Control policies, see Planning QoS Admission Control policies.


QoS Admission Control servers

This topic covers:

  • Implementing QoS Admission Control
  • QoS Admission Control logging features


Implementing QoS Admission Control

QoS Admission Control must be installed on a network-enabled host running Windows 2000 Server. Each QoS Admission Control host can manage only the subnets to which it is directly attached. You can make necessary configurations in Properties for each specific subnet by using the appropriate check box on the Traffic tab.

All QoS Admission Control messages on the subnet can be tracked for network usage statistics and to verify that the subnet clients and QoS Admission Control host are properly interacting. You can also set up logging to help with troubleshooting, verifying that RSVP messages are sent and received. Circular log files are created and subject to administrative control in terms of their size, location, and total number.

For more information on installing QoS Admission Control, see To install QoS Admission Control.


QoS Admission Control logging features

You can configure accounting services to collect information about network resource usage on a per-user basis, using this information to:

  • Plan for the number of users who regularly reserve resources on this network.
  • Assess current and future network bandwidth needs.

The accounting log also provides useful information for troubleshooting QoS Admission Control-related network communication errors.

You can also configure the logging services to view QoS Admission Control host RSVP messages. The RSVP log provides information similar to that of Network Monitor. You can trace who sends and receives RSVP messages and whether RSVP messages are accepted or rejected. This information is useful whenever QoS Admission Control-related network communication errors occur.

The QoS Admission Control accounting service and RSVP logging service log messages in the Windows 2000 Server Event Viewer. These logs are more detailed and are recorded as fixed (not customizable) ASCII-format files, which can be viewed with a text editor or converted to an ODBC database.

Accounting and RSVP log files

You can control several options for each type of log, including the directory in which the files are created and how many files are created.

Both accounting and RSVP log files are circular. If you specify a maximum file size and the file reaches that limit, one of two things can occur:

  • Unless the maximum number of log files is also reached, another log file is created. This option is useful for searching a long history of transactions for a pattern, instead of only the latest information.
  • No new log files are created. Instead, the file is simply overwritten each time the maximum file size is reached. Any search of logging data is limited to the more current information.

You do not have to stop QoS Admission Control services to view log files.

New log entries are generated whenever a client requests bandwidth. The log file size or the number of log files grows as requests are made. It is important to balance your need for detailed data with your need to limit file size and number. Extremely large log files can compromise performance because each file contains approximately 500 messages per megabyte. Additionally, smaller log files are easier for the administrator to search for specific events.

Be careful to consider available disk space when setting log file sizes and monitor the storage space in use whenever using any logging features.

Note

  • For more information about QoS Admission Control logging, see RSVP logs and Accounting logs.


QoS Admission Control policies

This topic covers:

  • Planning QoS Admission Control policies
  • Policy types
  • Subnet configuration
  • User policies


Planning QoS Admission Control policies

QoS Admission Control policy is a combination of two policies containing general rules for your enterprise: the Any Authenticated User enterprise policy, and the Unauthenticated User enterprise policy.

All other QoS Admission Control policies you create, including other enterprise and subnet policies, should be considered exceptions to the general rules in the default enterprise policies.

For example, to override the aggregate bandwidth for a particular user, you can create a subnet policy for the user with only the aggregate bandwidth value configured. All other values necessary for the bandwidth reservation come from one of the default enterprise policies. This enables you to determine which policy attributes the exception policy values override.

Policy hierarchy

QoS Admission Control searches policy values in a specific order. Higher priority policy values always override lower priority policy values when the same values are configured in both policies. If values are not configured in the higher priority policies, QoS Admission Control uses values from lower priority policies.

When a user has a group profile defined, policies are applied in the following manner:

  1. User policy for the current subnet
  2. Group policy on the current subnet
  3. Authenticated user on the current subnet
  4. User in the enterprise container
  5. Authenticated user in the enterprise container

The process of building the final policy profile used by the QoS Admission Control for each user is a cumulative process. The initial user policy is determined by the global default and at each point going to the most specific policy (user on a particular subnet), the value of attributes can be updated. This allows the most general attributes to be set once, and then more specific policy to be established as needed.

If a user is not recognized, then the unauthenticated user policy is applied. This allows you to create a policy that can potentially prevent visiting users from using reserved resources on the subnet.

Planning for unauthenticated user policies

An unauthenticated user is any user on a computer running Windows 2000 that is not logged on under a domain account, but is connected to the network. For example, if you are logged onto a computer connected to the network as the local administrator, you are logged on as an unauthenticated user.

Configure the default enterprise unauthenticated user policy (Unauthenticated User). The QoS Admission Control applies this policy when an unauthenticated user makes a priority bandwidth request.

Configure a default subnet unauthenticated user policy if the enterprise unauthenticated user policy is not valid for the selected subnet.


Policy types

QoS Admission Control policies are hierarchical, from most specific (a particular user on a specific subnet) to least specific (a user policy for all QoS Admission Control-managed subnets). Using the QoS Admission Control console, you can centrally create policies for all users with two policy levels.

Enterprise policies

The enterprise settings hold the network-wide policies for users. Enterprise policies apply to all QoS Admission Control-managed subnets. For enterprise policies, configure the default Any Authenticated User policy. This policy is applied to all authenticated users in the domain. If you have special user requirements, create exception polices for users with only the attributes that must be different from the default policy.

After installation, the QoS Admission Control enterprise policies contain a set of default values. The default settings for the enterprise policies are illustrated in this table.

Traffic Property | Any Authenticated User | Un-Authenticated User
Data Rate | 500 kilobits per second | 64 kilobits per second
Peak Data Rate | 500 kilobits per second | 64 kilobits per second
Number of Flows | Two (2) | One (1)

For information about configuring enterprise policies, see To configure enterprise policies.

Subnet policies

Subnet settings hold a QoS Admission Control subnet object that represents the actual QoS Admission Control-managed subnet. By default, each subnet policy you create uses the policy settings from the enterprise policies. You can create user policies under each QoS Admission Control subnet object. These policies apply only to the subnet that contains them.

You need additional policies only if a user has unique requirements for sending data on a specific subnet.

When a user requests priority bandwidth, the QoS Admission Control host searches Active Directory for policy values in the following order:

  1. A subnet-level user policy for the subnet on which the user is requesting priority bandwidth
  2. An enterprise-level user policy

If the QoS Admission Control host does not find a policy for the user, it uses the default unauthenticated user policy. For more information about policy hierarchy, see Planning QoS Admission Control policies.


Subnet configuration

When you use the QoS Admission Control console to create a subnet object, this applies a common set of properties to all QoS Admission Control hosts on that subnet. You can use QoS Admission Control for centralized, remote configuration of the QoS Admission Control service on each host. This ensures that all QoS Admission Control hosts on the subnet handle client requests in the same way.

Subnet properties are not to be confused with subnet-level user policies. You create a QoS Admission Control subnet object to set the traffic limits for the subnet and the QoS Admission Control Service properties for each QoS Admission Control host managing the subnet.

A subnet object is linked to the physical subnet and the QoS Admission Control hosts by the subnet IP address. The subnet object properties determine:

  • The traffic limits for the subnet.
  • The logging and accounting properties for the QoS Admission Control hosts.
  • QoS Admission Control properties on each QoS Admission Control host.

After you create a QoS Admission Control subnet object, you can add subnet-level user policies.

For more information on configuring policies for QoS Admission Control, see Configure policy.


User policies

You should modify the enterprise-level Any Authenticated User policy to meet the general needs of your users. The only time you need to create additional policies is when a user has different requirements. The default unauthenticated user policy is used if the user is not logged in as a member of the trusted domain. This is useful for controlling the traffic of users who access the network but are not authenticated by a trusted Windows 2000 domain.

In some cases, a particular user has unique resource requirements on a specific subnet. To meet special requirements, you can create user policies at the Subnet Settings level. Default unauthenticated and any authenticated user policies are provided at this level and can be modified to meet the needs of most users sending data on the subnet.

Enterprise Settings policies apply to all subnets unless the user has a policy in Subnet Settings. For example, if User A has a policy in Enterprise Settings, and another policy in Subnet Settings for Subnet A, the enterprise policy applies except when User A sends or receives data on Subnet A.

Note

  • For more information about QoS policies, see Policy types.


Interpreting QoS Admission Control log files

This topic covers:

  • Accounting logs
  • RSVP logs


Accounting logs

Accounting logs can help you identify the causes of problems on your network. Accounting log information includes:

  • Who is using network resources.
  • The date and time of individual sessions.
  • Addressing information for individual sessions.

In the log file, all fields are terminated with a semicolon (;). Following is an example of an accounting log record:

1998/11/18 13:58:00:0578;192.168.3.5:4000[17];Start Sender;ENGR\Vincent;192.168.3.4:4000;New; 250000,1500,300000,10,1500

For accounting purposes, the most significant values in the entry show that the QoS Admission Control host approved a bandwidth request on November 18, 1998, at 1:58 P.M., which initiated a session with ID 192.168.3.4 and began sending data from a host in the ENGR (engineering) domain for a user who logged on as Vincent.

The following table describes in detail each item in the log. Each message in the accounting log contains the following parameters, separated by semicolons.

Field | Description
Date/time | Date and time of the record, in Greenwich Mean Time (GMT).
Session IP addressing information | The receiver's IP address, the port number on which the data is sent (following the colon), and the decimal protocol ID of the protocol used, enclosed in brackets ([ ]).
Record type | One of the following: Start Sender, Start Receiver, Stop Sender, Stop Receiver, Reject Sender, or Reject Receiver.
User ID | The domain and user name, preceded by a backslash (\), of the sender or receiver.
IP addressing information for the last hop | The IP address of the last hop and either the port number on which the data is sent (following the colon) or the hexadecimal address of the network adapter (if the host relaying the message is a multihomed device). For example, 192.168.2-2.106:0x00000000.
Message status | One of the following: New, Modify, Stop Sender reason, Reject Sender, or source IP address of the data flow.
Message detail | Sender's traffic information, receiver's traffic information, Stop Receiver reason, and Reject Receiver reason

Important

  • Do not set log file sizes too high for available disk space. Monitor storage space that is in use whenever using any logging features.

Notes

  • Extremely large log files can compromise performance. Each log file contains approximately 500 messages per megabyte. Small log files are easier for network administrators to search for specific events.
  • For a list matching protocol IDs with protocol names, see RFC 1700.
  • You do not have to stop QoS Admission Control to view log files.
  • For more information about QoS Admission Control logging, see QoS Admission Control logging features.
  • For more information about configuring subnet accounting, see To configure accounting properties.


RSVP logs

RSVP log information can help you troubleshoot by identifying:

  • The date and time of the RSVP message.

  • Addressing information for the sender and receiver of the message.

In the RSVP log file, each field is terminated with a comma (,). A vertical bar (|) indicates the end of a group of traffic information. Following is an example of an RSVP log record:

1998/02/06 15:35:05, PATH ,192.168.3.6,4000,17,|,
192.168.3.5,0x00000000,|,30000,|,
192.168.3.4,4000,|,3.000E+004,1.50E+003,3.300E+004,10,1500,|,
0,0.000E+000,1500,1.#IOE+000

The most significant values in the entry show that on February 6, 1998, at 3:35 P.M., a PATH message originating with a user (host ID 192.168.3.6) went to the receiver requesting data to begin the reservation process.

The following table describes each item in the log in detail, showing the parameters that each message in the RSVP log contains.

Field | Description
Date/time | Date and time of the message, in Greenwich Mean Time (GMT)
Type of message One of the following: PATH, RESV, PATH-ERR, RESV-ERR, PATH-TEAR, RESV-TEAR with additional parameters:
  • Confirmation request: Resv-confirm or No Resv-confirm, indicating whether the receiver wants a reservation confirmation.
  • Scope: An explicit list of sender hosts (in wildcard reservation-style format) toward which the information in the message is forwarded.
  • Reservation style: Determining whether resources are reserved by fixed filter, share explicit, or wildcard. For more information about these styles, see RFCs 2205, 2210, 2215, and 2216.

For detailed information on these parameters, see RFC 2205.
Session IP addressing information The receiver's IP address, the port number on which the data is sent, and the decimal protocol ID of the protocol used, followed by a vertical bar (|).

For a list matching protocol IDs with protocol names, see RFC 1700.
IP addressing information for the last hop | The IP address of the last hop and the port number on which the data is sent (following the colon). Or, the hex address of the network adapter if the host relaying the message is a multihomed device, followed by a vertical bar (|).
Refresh interval | The frequency at which, in milliseconds, this message is sent.
Sender IP addressing information | The sender's IP address, the port number on which the data is sent, and the decimal protocol ID of the protocol used, followed by a vertical bar (|).
Bucket rate | The bucket data rate.
Bucket size The size of the bucket in which packets are grouped for transmission.

For more information on packet buckets, see RFCs 2210, 2215, and 2216.
Peak rate | The burst rate of the packets.
Packet size | The minimum packet size for transmission.
MTU size The maximum packet size for transmission, followed by a vertical bar (|). This field, plus the previous four fields, make up the Tspec (traffic parameters for the flow).

For more information on the Tspec, see RFCs 2205, 2210, 2215, and 2216.
Adspec | The remaining fields in the record indicate the traffic parameters for the receiver.

Important

  • Do not set log file sizes too high for available disk space. Monitor storage space that is in use whenever using any logging features.

Notes

  • Extremely large log files can compromise performance as each file contains approximately 500 messages per megabyte (MB). Small files are easier for network administrators to search for specific events.

  • You do not have to stop QoS Admission Control service to view log files.
  • For more information about QoS Admission Control logging, see QoS Admission Control logging features.


Using Windows monitoring tools with QoS Admission Control

Standard Windows monitoring tools can be used to monitor your QoS Admission Control hosts and network. These tools include System Monitor, Event Viewer, and Network Monitor.

System Monitor

System Monitor displays the resource use for specific components and program processes so that you can use reports to gauge the efficiency of your computer. It also helps you identify and troubleshoot problems such as unbalanced resource use or insufficient hardware.

System Monitor contains counters related to the QoS Admission Control service. The counters to activate for QoS RSVP are the ACS/RSVP service, interfaces, and policy counters. For more information about installing and activating these counters, see System Monitor.

Event Viewer

Event logging automatically starts each time you start Windows 2000 Server. In Event Viewer, the system log assists you in troubleshooting problems with QoS Admission Control.

For example, if QoS Admission Control is not running, you can filter the system log to display only messages pertaining to RSVP. Or you can choose to display only a particular type of RSVP event message. For information about filtering Event Viewer messages, see To filter events in an event log.

For general information about Event Viewer, see Event Viewer.

Network Monitor

Network Monitor provides additional information about the performance of your QoS-enabled network. You can use Network Monitor to capture and display information about the interface upon which QoS Admission Control is running.

For information about Network Monitor, see Network Monitor overview.


Resources

This topic covers:

  • Internet Drafts (QoS Admission Control)
  • QoS Admission Control standards (RFCs)
  • Web sites


Internet Drafts (QoS Admission Control)

Internet Drafts contain detailed, technical information about RSVP, subnet bandwidth management (SBM), and traffic control. Authors use Internet Drafts directories to distribute documents that they might eventually submit for publication as an RFC (Request for Comment) and to solicit feedback on them.

The following Internet Drafts examine issues related to QoS Admission Control:

  • "Providing Integrated Services Over Low-Bit-Rate Links"
  • "SBM (Subnet Bandwidth Manager): A Proposal for Admission Control Over IEEE 802-Style Networks"
  • "A Framework for Providing Integrated Services Over Shared and Switched IEEE 802 LAN Technologies"
  • "Integrated Services over IEEE 802.1D/802.1p Networks"
  • "Integrated Service Mappings on IEEE 802 Networks"
  • "RSVP Cryptographic Authentication"
  • "RSVP Extensions for Policy Control"
  • "Partial Service Deployment in the Integrated Services Architecture"

These drafts can obtained from the Internet Engineering Task Force (IETF) working group for quality of service at the IETF Web site.

Note


QoS Admission Control standards (RFCs)

Requests for Comments (RFCs) are an evolving series of reports, proposals for protocols, and protocol standards used by the Internet community. Quality of Service (QoS) standards are defined in RFCs published by the Internet Engineering Task Force (IETF) and other working groups.

The following RFCs cover QoS issues:

RFC | Description
2205 | Resource ReSerVation Protocol (RSVP) Version 1 Functional Specification
2207 | RSVP Extensions for IPSEC Data Flows
2208 | Resource ReSerVation Protocol (RSVP) Version 1: Applicability Statement: Some Guidelines on Deployment
2209 | Resource ReSerVation Protocol (RSVP) Version 1: Message Processing Rules
2210 | The Use of RSVP with IETF Integrated Services
2211 | Specification of the Controlled-Load Network Element Service
2212 | Specification of Guaranteed Quality of Service

For more information on RFCs and how to obtain them, see TCP/IP standards (RFCs).

Note

  • To see the most current RFCs related to RSVP, subnet bandwidth management (admission control), and traffic control, see the Active IETF Working Groups Web site.


Web sites

The following Web sites post information about QoS issues, Internet engineering standards, and other related topics.

  • Active IETF Working Groups Web site
  • IETF Web site
  • RSVP home page at USC ISI

    • Note


Troubleshooting

What problem are you having?

I cannot identify the node that is dropping or blocking RSVP data.

Cause: Network topology is unclear.

Solution: At the command prompt, run the command tracert. To identify the hops between the sender and receiver, run tracert receiver's IP address, where the receiver's IP address is the address of the receiver.

See also: Tracert.

My network card does not appear to be functioning with QoS Admission Control.

Cause: The network card is not 802.1p compliant.

Solution: Replace the network card with one that is 802.1p compliant.