Week 4 Day 1: End-to-End Policy Integration¶

Policy Hierarchy Summary¶

TRAFFIC DECISION TREE (Evaluated in order at each WAN edge):

1. SD-WAN Application-Aware Routing (AAR) Policy
   → Matches app/destination → selects SLA class and preferred color

2. Cloud OnRamp for SaaS (if app has probe)
   → Overrides AAR preferred color if probe shows better path

3. Cloud OnRamp for IaaS (Azure Virtual WAN)
   → Provides Azure VNet routes via OMP → data policy enforces path

4. Umbrella SASE
   → DNS queries redirected → HTTP/S traffic via SIG tunnel
   → Applies URL filtering, malware inspection, CASB

5. QoS Policy
   → Applied at egress of each WAN transport interface
   → Ensures bandwidth allocation per traffic class

Device Template: Complete Feature Attachment¶

Navigate: Configuration → Templates → Device Templates

For each device template type (Hub-C8500, Branch-ISR4331, Branch-ISR1100):

FEATURE TEMPLATES ATTACHED:
├── AAR Policy: Abhavtech-Hub-CloudOnRamp-AAR (or Branch variant)
├── Control Policy: Azure-IaaS-Route-Distribution
├── Data Policy: Azure-IaaS-Data-Policy
├── Cloud OnRamp SaaS: All 6 apps
├── Cloud OnRamp IaaS: Azure Virtual WAN
├── Umbrella DNS: Enabled with token
├── Umbrella SIG: Enabled (branch: direct, hub: tunnel)
├── QoS Policy: WAN-EGRESS-QOS (per transport interface)
└── Logging: Enabled to Splunk via syslog

SITE-SPECIFIC VARIABLES (per device):
├── System IP
├── Site ID
├── WAN interface IPs and colors
└── LAN subnet(s)

Week 4 Day 2: Advanced QoS Configuration¶

Hub Site QoS — All Transport Types¶

! ============================================================================
! ADVANCED QOS CONFIGURATION — C8500-12X HUB SITES
! Apply to: MPLS, Internet DIA, ExpressRoute interfaces
! ============================================================================

! Traffic Classification — by DSCP (set by AAR policy)
class-map match-any QOS-EF
 match dscp ef          ! 46 = Voice (Teams, Webex)

class-map match-any QOS-AF41
 match dscp af41        ! 34 = Video conferencing

class-map match-any QOS-CS3
 match dscp cs3         ! 24 = Signaling, management
 match dscp cs4         ! 32 = Real-time critical

class-map match-any QOS-AF21
 match dscp af21        ! 18 = Business critical apps
 match dscp af22
 match dscp af23

class-map match-any QOS-AF11
 match dscp af11        ! 10 = Interactive data (O365 non-Teams)
 match dscp af12
 match dscp af13

class-map match-any QOS-CS1
 match dscp cs1         ! 8 = Background
 match dscp default     ! 0 = Best effort

! MPLS Egress Policy (10G interface — allocate per class)
policy-map MPLS-EGRESS-QOS
 class QOS-EF
  priority percent 15           ! 1.5Gbps guaranteed for voice
  police rate percent 20        ! Cap at 20% to prevent domination
 class QOS-AF41
  bandwidth percent 15          ! 1.5Gbps for video
  random-detect dscp-based
 class QOS-CS3
  bandwidth percent 10          ! 1Gbps for signaling
 class QOS-AF21
  bandwidth percent 30          ! 3Gbps for business-critical
  fair-queue
  random-detect dscp-based
 class QOS-AF11
  bandwidth percent 20          ! 2Gbps for interactive
  fair-queue
 class QOS-CS1
  bandwidth percent 5           ! 500Mbps for background
 class class-default
  bandwidth percent 5           ! 500Mbps remaining
  fair-queue

! Internet DIA Egress Policy (1G interface)
policy-map DIA-EGRESS-QOS
 class QOS-EF
  priority percent 20           ! 200Mbps for voice
 class QOS-AF41
  bandwidth percent 15          ! 150Mbps for video
 class QOS-AF21
  bandwidth percent 25          ! 250Mbps for business apps
 class QOS-AF11
  bandwidth percent 20          ! 200Mbps for interactive
 class class-default
  bandwidth percent 20          ! 200Mbps for internet
  fair-queue

! ExpressRoute Egress Policy (10G — Teams/O365 primary)
policy-map EXPRESSROUTE-EGRESS-QOS
 class QOS-EF
  priority percent 25           ! 2.5Gbps for Teams voice
 class QOS-AF41
  bandwidth percent 25          ! 2.5Gbps for Teams video
 class QOS-AF21
  bandwidth percent 20          ! 2Gbps for O365 Exchange/SharePoint
 class QOS-AF11
  bandwidth percent 20          ! 2Gbps for remaining O365
 class class-default
  bandwidth percent 10
  fair-queue

! Apply to interfaces
interface TenGigabitEthernet0/0/0.100
 description MPLS-TATA-WAN
 service-policy output MPLS-EGRESS-QOS
!
interface GigabitEthernet0/0/4
 description INTERNET-DIA
 service-policy output DIA-EGRESS-QOS
!
interface TenGigabitEthernet0/0/2.4001
 description EXPRESSROUTE-PRIMARY
 service-policy output EXPRESSROUTE-EGRESS-QOS
!
interface TenGigabitEthernet0/0/3.4001
 description EXPRESSROUTE-SECONDARY
 service-policy output EXPRESSROUTE-EGRESS-QOS

Branch Site QoS¶

! ============================================================================
! BRANCH QOS — ISR 1100-4G (smaller scale — 100Mbps DIA + LTE)
! ============================================================================

hostname BLR-BR-01

! Simplified 4-class model for branch
class-map match-any BRANCH-VOICE
 match dscp ef
 match dscp cs4

class-map match-any BRANCH-PRIORITY
 match dscp af41
 match dscp af21
 match dscp cs3

class-map match-any BRANCH-BULK
 match dscp af11
 match dscp cs1

policy-map BRANCH-WAN-QOS
 class BRANCH-VOICE
  priority percent 30           ! Reserve 30Mbps of 100Mbps for voice
 class BRANCH-PRIORITY
  bandwidth percent 40          ! 40Mbps for O365, Azure apps
  random-detect dscp-based
 class BRANCH-BULK
  bandwidth percent 20          ! 20Mbps for general web
 class class-default
  bandwidth percent 10          ! Remaining 10Mbps
  fair-queue

! Apply to DIA WAN interface
interface GigabitEthernet0/0/0
 description DIA-WAN
 service-policy output BRANCH-WAN-QOS
!