Cisco IOS PBR – PBRing Skype

iosroutingskype

I've got a very simple question, which seems to be extremely difficult when put into practice.

I have a Cisco IOS router with two Internet links (one over a WAN, through a proxy, everywhere, etc.) the other direct Internet.

Most traffic destined for the internet goes through the proxy over the WAN.

I want Skype traffic (why the client uses skype, I don't know..) to go out of the Internet link, while the rest of the traffic goes over the WAN through the proxy, etc.

Apparently skype is very difficult to detect/classify because of it's many adaptations to being blocked.

Is there any way to identify Skype on an IOS router (2911), and set it's next hop IP/interface?

Thank you,
Aaron

Best Answer

NBAR - network based application recognition is what you are after (http://www.cisco.com/en/US/docs/ios-xml/ios/qos_nbar/configuration/15-0m/nbar-mqc.html) can match on Skype with deep packet inspection. Once you match the protocol set a DSCP value via a service policy and then apply PBR based on this DSCP value, setting your next-hop to your ISP. The method is outlined here: http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00800fc176.shtml. . It's dated, but the method is still applicable.

Related Solutions

Firewall – Multiple interface NAT routing

These rules probably don't do what you want. The first rule permits any new connection from eth1 and eth2, the second permits everything from eth0 and eth1. This appears to permit everything from any interface basically making your firewall pointless.

iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth2 -j ACCEPT

You may mean this instead.

iptables -A INPUT -m state --state NEW -i eth1 -j ACCEPT

Anyway, instead of adding things to rc.local I would probably update your /etc/network/interfaces to look like this. I am making some guesses about what you have for masks, so be sure to check and update. You probably should be adding all of the link routes to the fiber table.

auto eth0
iface eth0 inet static
  address 192.168.1.2
  netmask 255.255.255.0
  network 192.168.1.0
  broadcast 192.168.1.255
  gateway 192.168.1.1
  up ip route add table fiber scope link proto kernel dev eth0 192.168.1.0/24

auto eth1
iface eth1 inet static
  address 10.254.239.1
  netmask 255.255.255.0
  network 10.254.239.0
  broadcast 10.254.239.255
  up ip route add table fiber scope link proto kernel dev eth1 10.254.239.0/24

auto eth2
iface eth2 inet static
  address 20.20.20.22
  netmask 255.255.255.252
  network 20.20.20.20
  broadcast 20.20.20.23
  up ip route add table fiber scope link proto kernel dev eth2 20.20.20.20/30
  up ip route add default via 20.20.20.21 table fiber
  up ip rule add fwmark 2 table fiber

Cisco – QoS for Cisco Router to Prioritize Voice and Interactive Traffic

If you do a show policy-map interface Fa8, you should see how the different QoS classes are being utilized. If you're seeing anything in the priority class, I'd say that qos pre-qualify is doing its work.

Best Answer

Related Solutions

Firewall – Multiple interface NAT routing

Cisco – QoS for Cisco Router to Prioritize Voice and Interactive Traffic

Related Topic