QoS Part I: Classification and Marking

QoS Part I: Classification and Marking

Quality of Service (QoS) is the ability to provide different levels of performance for individual applications and services that run over the networks.  Different application attributes such as constant vs. burst bandwidth consumption, jitter, perceived latency, error rate, availability and admission control can be controlled by the proper implementation and deployment of QoS.

The need for QoS has become increasingly necessary, especially within the backbone network where the real time applications like VoIP and Cisco TelePresence needs to be prioritized.  QoS has become crucial for the everyday business needs due to the ever changing traffic load on the network from Internet browsing, streaming media, file transfers, data replication etc. The critical applications should take advantage of QoS and be prioritized, in order to get more preference over non-critical applications.

This is how the switch treats frames by default after the QoS is enabled:

-          A frame enters the switch port and it does not have the frame tagged (it means the port is access port and the frame enters the switch does not have ISL or dot1q encapsulation).

-          The switch encapsulates the frame with the dot1q (ignore ISL because dot1q is the default on all the new switches).

-          Inside the dot1q frame tag, there are three bits called 802.1p priority bits available, which are also called CoS (Class of Service bits). These bits are set to 0 by default.

-          The switch calculates DSCP value based on the CoS-DSCP map table. As per the table, the switch sets the DSCP value to 0. DSCP value is located at the IP header of the packet.

Unlike the routers, the QoS classification and marking acts differently in Cisco Catalyst switches. In Cisco routers, you can classify the packets using MQC either based on the incoming packet DSCP value or based on the access control list (ACL). This depends on whether you trust the QoS label of the incoming packet or not. In the Cisco Catalyst 3750 Switch, you can classify the frames either based on the incoming CoS/DSCP values or based on the ACL.

The configuration based on the incoming CoS/DSCP value is achieved in three different ways:

-          Port based configuration using the mls qos interface based commands

-          MQC based configuration using class-map and policy-map

-          VLAN based configuration

You can use either one of these three methods. You cannot use more than one method in a port. For example, you have configured the mls qos trust cos command on a port. When you configure the port with the

“service-policy input <policy-map-name>” command, it removes the

“mls qos trust cos” command automatically.

You could have as many classes of traffic as you wish, but be sure to adjust it to your networks needs. For the purposes of explaining the QoS I took the 5 most typical classes of services to be implemented within end-to-end from campus network to the backbone network:

- VOICE Class, for VoIP telephony traffic (Marked with CS5, DSCP: EF). Low Latency queue is recommended for this class (more details in Part II of this document)

- VIDEO Class, for Video Conference and Cisco TelePresence traffic (Marked with CS4, DSCP: AF41)

- Critical Data Class (D3), High importance Data Traffic, Critical Applications (Marked with CS3, DSCP: AF31)

- Business Data Class (D2), Medium importance and Default Data Traffic (Marked with CS2 and CS0, DSCP: AF21 and AF0)

- Scavanger (D1), Low importance Data Traffic(Marked with CS1, DSCP: AF11)

Classes 6 and 7 (CS6 and CS7) are NOT to be marked manually as they are reserved for synchronization for a group of critical network protocols (BGP, EIGRP, DNS and etc.) and assigned CS6 and priority by the pak_priority mechanism. They are to be matched though by the traffic treatment policies.

LLQ is ideal for Voice and Video traffic because it provides a guaranteed minimal amount of delay and jitter through the router. Cisco recommends applying the LLQ on up to 33% of the traffic.

You can attach a service policy to either the physical interface or to the switched virtual interface (SVI or VLAN interface). If you attach a service policy to a VLAN interface, the only ports that use this service policy are ports that belong to that VLAN and are configured for VLAN-based QoS. If the port is not set for VLAN-based QoS, the port still uses the default port-based QoS and only looks at the service policy that is attached to the physical interface.

If you are using QoS of both, Layer 3 (DSCP Values) and Layer 3 (CS Values), be sure to define how the values are mapped using the following command from the Global Configuration mode:

mls qos map cos-dscp 0 10 18 26 34 46 48 56

MQC Method, Step 1: Define the traffic using the Access Lists

You must tell the router which traffic you want to give QoS, which you can accomplish using an access control list (ACL). In the following example you will see how the VoIP and Video traffic is marked:

VOICE_TRAFFIC: (EF)

ip access-list extended VOICE_TRAFFIC

remark *VOICE: Strict Priority Traffic,10%,DSCP:EF*

 permit udp any any range 32512 32768

 permit udp any range 32512 32768 any

VIDEO_TRAFFIC: (AF41)

ip access-list extended VIDEO_TRAFFIC

remark *VIDEO: Priority Traffic,35%,DSCP:AF41*

remark ---- Video Conference server ----

 permit udp any range 50000 59999 any

 permit udp any any range 50000 59999

remark ---- Cisco TelePresence ----

 permit udp any eq 16388 any

 permit udp any any eq 16388

remark ---- Polycom Video ----

 permit udp any any range 3220 3247

 permit udp any range 3220 3247 any

remark ---- Tandberg Video ----

 permit udp any any range 2326 2485

 permit udp any range 2326 2485 any

MQC Method, Step 2: Create the CLASS MAPS and correlate with the ACLs

A class-map defines the traffic into groups. For example, you could create a class-map called VoIP traffic and put all VoIP protocols under it using the previously defined Access List:

class-map match-any CLASS_VOIP

  match access-group name ACL_VOIP

Here are the steps to create the class map based on the already configured Access Lists:

class-map match-any VOICE_CLASS

  match access-group name VOICE_TRAFFIC

class-map match-any VIDEO_CLASS

  match access-group name VIDEO_TRAFFIC

class-map match-any CRITICAL_CLASS

  match access-group name CRITICAL_DATA

class-map match-any BUSINESS_CLASS

  match access-group name BUSINESS_DATA

class-map match-any OTHER_DATA_CLASS

  match access-group name OTHER_DATA

MQC Method, Step 3: Create POLICY MAP and set the traffic marking

The DSCP can be set to a desired value at the Trust Boundary of the network in order to make it easy for core devices to classify the packet and provide a suitable level of service. Class-Based Packet Marking can be used to set the DSCP value.

The policy maps are an actual step where the DSCP value is assigned to a certain traffic group. First the concepts of DSCP/CoS/ToS need to be explained.

There are 8 DSCP values compatible with each IP precedence binary value:

DSCP Class Selector	DSCP Binary Value	Precedence Value	Range of DSCP values
Default	000000	0	0-7
CS1	001000	1	8-15
CS2	010000	2	16-23
CS3	011000	3	24-31
CS4	100000	4	32-39
CS5	101000	5	40-47 (46 = EF)
CS6	110000	6	48-55
CS7	111000	7	56-63

Assured forwarding (AF) per-hop behavior allows for up to 4 different classes of queuing purposes, each with 3 levels of drop probability that can be implied. To mark these packets, 12 DSCP values are needed, with the names of these values starting with "AF". Assured forwarding on each PHB actually involved to different QoS functions. These are usually done using different QoS tools. The first is queuing, where each router classifies the packets into 4 different classes, and packets from each class are placed in a separate queue. The second function is congestion avoidance, where routers drop packets before tail drop is required. Assured forwarding does not mean that an individual packet is assured of making it across the network, just that attempts will be made to assure that queuing tools provide enough bandwidth, and when congestion does occur, less important will be discarded first.

	Low Drop Probability	Medium Drop Probability	High Drop Probability
Class 1	001010 AF11 DSCP 10	001100 AF12 DSCP 12	001110 AF13 DSCP 14
Class 2	010010 AF21 DSCP 18	010100 AF22 DSCP 20	010110 AF23 DSCP 22
Class 3	011010 AF31 DSCP 26	011100 AF32 DSCP 28	011110 AF33 DSCP 30
Class 4	100010 AF41 DSCP 34	100100 AF42 DSCP 36	100110 AF43 DSCP 38

Use the following formula if you need to convert AF (Assured Forwarding) values to DSCP:

Decimal from AFxy = (8*x) + (2*y)

Examples:

AF13 = (8*1) + (2*3) = DSCP 14

AF31 = (8*3) + (2*1) = DSCP 26

AF43 = (8*4) + (2*3) = DSCP 38

It can be done by remembering how many bits the different markings use. For example CoS uses three bits to mark. DiffServ uses 6. ToS is 6 bit DSCP + 2 bits for ECN. Example:

CoS :              0 , 1 , 2 ,  3 ,   4 ,   5 ,   6 ,   7
DSCP :          0 , 8 , 16, 24 , 32 , 46 , 48 , 56

When you specify the ip dscp value in the class map command, you have these:  

L3Switch(config)# class-map match-all VOIP

L3Switch(config-cmap)# match ip dscp ?

   <0-63>   Differentiated services codepoint value

   af11     Match packets with AF11 dscp (001010)

   af12     Match packets with AF12 dscp (001100)

   af13     Match packets with AF13 dscp (001110)

   af21     Match packets with AF21 dscp (010010)

   af22     Match packets with AF22 dscp (010100)

   af23     Match packets with AF23 dscp (010110)

   af31     Match packets with AF31 dscp (011010)

   af32     Match packets with AF32 dscp (011100)

   af33     Match packets with AF33 dscp (011110)

   af41     Match packets with AF41 dscp (100010)

   af42     Match packets with AF42 dscp (100100)

   af43     Match packets with AF43 dscp (100110)

   cs1      Match packets with CS1(precedence 1) dscp (001000)

   cs2      Match packets with CS2(precedence 2) dscp (010000)

   cs3      Match packets with CS3(precedence 3) dscp (011000)

   cs4      Match packets with CS4(precedence 4) dscp (100000)

   cs5      Match packets with CS5(precedence 5) dscp (101000)

   cs6      Match packets with CS6(precedence 6) dscp (110000)

   cs7      Match packets with CS7(precedence 7) dscp (111000)

   default  Match packets with default dscp (000000)

   ef       Match packets with EF dscp (101110)

Finally this is how the Policy Map TRAFFIC-CLASSIFICATION needs to be configured in order to correlate with the previously defined Class Maps:

policy-map TRAFFIC-CLASSIFICATION

  class VOICE_CLASS

    set ip dscp ef

  class VIDEO_CLASS

    set ip dscp af41

  class CRITICAL_CLASS

    set ip dscp af31

  class OTHER_DATA_CLASS

    set ip dscp af11

  class BUSINESS_CLASS

    set ip dscp af21

MQC Method, Step 4: Apply policy maps to the Access-Switch input interface/s

Like an ACL, you must apply the policy-map to the specific interface you want it to affect. You can apply the policy-map in either output or input mode. Here's the command to use:

service-policy output|input {name of policy-map}

There are 3 options to apply the policy map: 

Option 1 Mark on USER INTERFACES (is the Access Switch can handle the load)

interface range <all physical user interfaces>

service-policy input TRAFFIC-CLASSIFICATION

Option 2 Mark on the Egress of the Access SWs (not allowed on some models)

interface range GigabitEthernet <all uplinks to Distribution switches>

service-policy output TRAFFIC-CLASSIFICATION

*PFC QoS supports the output keyword only with PFC3 and only on Layer 3 interfaces (either LAN ports configured as Layer 3 interfaces or VLAN interfaces). With PFC3, you can attach both an input and an output policy map to a Layer 3 interface.

* On the Cisco Catalyst 3750 Switch, policing can only be configured on the ingress port. Policing can only be configured through MQC. This means there is no interface specific command to police the traffic. You can configure policing in the policy-map and you can apply the policy-map using only the service-policy input <policy-name> command. You cannot apply any policy-map to the output side of an interface.

Option 3 Mark on VLAN INTERFACES is the one to be implemented

(vlan-based QoS, following the current policy)

interface vlan XXX

service-policy input TRAFFIC-CLASSIFICATION

interface range <all physical user interfaces>

mls qos vlan-based

*The other option would be creating separate access lists and policy maps, and applying them only to the corresponding VLANs.

OSPF: Advertising routes on the Interface

The routes can be advertised using the "network" command, but there is also another way. You can do an entire configuration on the Interface Level!

 Cisqueros_R2(config-if)# ip ospf network point-to-point
 Cisqueros_R2(config-if)# ip ospf 1 area 0

*Do not forget to define the "router ospf 1" process in the Global Configuration mode before the interface configuration!

Being defined as a P2P network - DR and BDR election will not take place. The state of all the OSPF Neighbors will be "FULL/-", as presented below:

 Cisqueros_R2#show ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address
3.3.3.3           0   FULL/  -        00:00:30    10.1.23.3
1.1.1.1           0   FULL/  -        00:00:34    10.1.12.1

This way the interface is configured to automatically belong to the Area 0, and the interface Subnet will be "injected" into the OSPF Area.


If there is SECONDARY IP configured on the interface - it will also be advertised. If however you do NOT want to advertise the Secondary IP, you can do the following specific OSPF command:

 Cisqueros_R2(config-if)#ip ospf 1 area 0 secondaries none 

*If you wish the loopback interfaces to be advertised with their correct masks, be sure to configure an OSPF P2P Loopback interface (it makes no difference how you advertise it with the "network" command, you need to also do this)

Cisqueros_R3(config)# int Lo0   
Cisqueros_R3(config-if)# ip ospf network point-to-point

ACE Load Balancer: Configure the Load-Balancing Service

There are quite a few ways to structure the configuration of the Load Balancing Service on a Cisco ACE device, or a Load Balancer (LB). The official Cisco documentation can be a bit overwhelming, as you can see here. Heres the approach that I´ve always found simple to understand.Step 1
Define the REAL SERVERS (rservers or physical servers) that will participate the Load-Balancing process. The number of Real Servers (rservers) within the Server Farm can vary, where 1 server would logically be the minimum, and the maximum depend on the Balancer model. In this example two Real Servers are configured, with names SERVERCISQUEROS03 and SERVERCISQUEROS04, and the respective IP Addresses 10.187.4.42 and 10.187.4.43.

Define the ratio between the Real Servers in the farm using the "weight X" command. In this case the value X will be 1, so the load will be equally ballanced between the two servers.

From the Global Configuration mode:

 rserver host SERVERCISQUEROS03
 ip address 10.187.4.42
 weight 1
 inservice


 rserver host SERVERCISQUEROS04
 ip address 10.187.4.43
 weight 1
 inservice


Step 2Define the PROBE. The Probe helps the balancer verify that the Real Servers are available, and providing the Service that we are trying to establish using the exact physical PORT (9080 in this case).

The probe can be TCP, Http, Https... Be careful here! This defines the connection between your ACE and the Real Servers, not between the Client and the Real Server, so make sure how your servers are configured.

In this example I did the http probe that uses the GET method, and goes for /Index.html on the server.

 probe http web_cisqueros.blogspot.com
  port 9080
  interval 30
  faildetect 2
  request method get url /index.html
  expect status 200 200

Other attributes I used in the configuration:

interval 30 #Probe gets launched against the server every 30 seconds faildetect 2 #If the probe fails to get the response from the server twice, it changes the state to "FAILED"expect status 200 200 #Status the probe expects from the Real Server (2xx codes indicate success)


Step 3

Define the SERVER FARM that will inter-connect the two connected Real Servers with the configured Probe. Put both of the configured rservers "in service".

serverfarm host SRV_cisqueros.blogspot.com
 description *** Cisqueros Server Farm ***
 predictor roundrobin
 probe web_cisqueros.blogspot.com
 rserver SERVERCISQUEROS03 9080
  inservice
 rserver SERVERCISQUEROS04 9080
  inservice


Step 4

Define the Layer 7 Policy Map to specify the match criteria and action, and relate it to your Server Farm.

 policy-map type loadbalance first-match PM-VIP-cisqueros.blogspot.com
  class class-default   serverfarm SRV_cisqueros.blogspot.com


Step 5

Define the Layer L3-L4 Class Map to specify the LB match criteria applied to input traffic. Be sure to know the Load Balancing Service VIP (Virtual IP) address beforehand.

 class-map match-all VIP-cisqueros.blogspot.com
  2 match virtual-address 10.187.4.111 tcp eq 9080

*The number "2" is due to the configuration Best-Practice, its a rule sequence number and this way we can modify the Class Map later adding the 1st rule

Step 6

Define, or use the already existing L3-L4 Policy Map that you are using for the other Balanced Services. Within it define the Class Map for this particular Load Balancing Service, and connect it to the already configured Layer 7 Policy Map.

 policy-map multi-match PM-VIP
  class VIP-cisqueros.blogspot.com
   loadbalance vip inservice
   loadbalance policy PM-VIP-cisqueros.blogspot.com
   loadbalance vip icmp-reply active

Some commands to check the validity of the configured Server Farm and Probe:

 #show probe web_cisqueros.blogspot.com [details]

 #show serverfarm SRV_cisqueros.blogspot.com

ACE Load Balancer: Redirection - HTTP to HTTP/HTTPS

In this document I´ll explain how to filter the http protocol on a Cisco ACE Load Balancer, and how to redirect the filtered http traffic to another URL. This concept is widely used for http-to-https redirection.


Step 1 Create the redirection rserver

rserver redirect REDIRECT-HTTP-APP
  webhost-redirection url_redirect HTTP_CODE
  inservice

The url_ url_redirect is the URL where the traffic will be redirected to, and the HTTP_CODE is the code of redirection (normaly it will be 301 or 302).
If we wish the URL to stay the same, as is normally the case of redirection to Https, we will use the %h%p instead of the URL.

%h stands for Hostname. If you have only %h then http://cisqueros.blogspot.com/mat.html will redirect you to https://cisqueros.blogspot.com

%p stands for Path

301 redirects are permanent. They mean that the page has moved, and they request any search engine or user agent coming to the page to update the URL in their database. This is the most common type of redirect that people should use.

302 - temporary redirect

You can read about these redirects here.

Step 2 Create the Server Farm that will contain the redirection rserver

serverfarm redirect SRV-REDIRECT-HTTP-APP
  rserver REDIRECT-HTTP-APP
    inservice


Step 3 Create the class-map

class-map match-all VIP-APP-REDIRECT
2 match virtual-address X.X.X.X tcp eq www

Where the X.X.X.X is the Virtual IP


Step 4 Create the policy-map, and correlate it to the previously configured Server Farm

policy-map type loadbalance first-match PM-VIP-APP-REDIRECT
  class class-default 
      serverfarm SRV-REDIRECT-HTTP-APP


Step 5 Apply the configuration to the Layer3-4 existing policy map

policy-map multi-match PM-VIP
  class VIP-APP-REDIRECT
    loadbalance vip inservice
    loadbalance policy PM-VIP-APP-REDIRECT
    loadbalance vip icmp-reply active

DAI - Dynamic ARP Inspection

(config)#ip arp inspection vlan 2 <--- Inspect ARP within the VLAN 2

You can create a ARP Access List and map the IP to MAC, and apply it to DAI:
 (config)#arp access-list ARP_ACL_20
 (config-arp-nacl)#permit ip host 20.1.1.2 mac host 0000.1111.1111
 (config-arp-nacl)#permit ip host 20.1.1.3 mac host 0000.3333.3333
And now APPLY:
 (config)#ip arp inspection filter ARP_ACL_20 vlan 2

 #show ip arp inspection

Source Mac Validation      : Disabled
Destination Mac Validation : Disabled
IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL
 ----     -------------    ---------   ---------          ----------
    2     Enabled          Active      ARP_ACL_20         No

 Vlan     ACL Logging      DHCP Logging      Probe Logging
 ----     -----------      ------------      -------------
    2     Deny             Deny              Off

 Vlan      Forwarded        Dropped     DHCP Drops      ACL Drops
 ----      ---------        -------     ----------      ---------
    2              0              0              0              0

The switch CPU performs dynamic ARP inspection validation checks; therefore,
the number of incoming ARP packets is rate-limited to prevent a denial-of-service attack.
(config-if)#ip arp inspection limit rate 5 <--- DEFAULT IS 15 PPS (packets per second)

#show ip arp inspection interfaces

 Interface        Trust State     Rate (pps)    Burst Interval
 ---------------  -----------     ----------    --------------
 Gi3/0/1          Untrusted                5                 1 <--- THE CHANGED ONE
 Gi3/0/2          Untrusted               15                 1 <--- 15 pps IS THE DEFAULT VALUE

To monitor the DROPPED packets due to DAI:
(config)#ip arp inspection log-buffer logs 0 interval 5 <--- LOG 0 - NO SYSTEM MESSAGE GENERATED

Check the log for details:
#show ip arp inspection log
Total Log Buffer Size : 32
Syslog rate : 0 entries per 5 seconds.

ACE Load Balancer SSL Certificate Part I, Generate the CSR

ACE Load Balancer SSL Certificate Part I, Generate the CSR (Certificate Signing Request)

You have more than one Real Servers, and its much more practical to install an SSL certificate once, on the ACE Load Balancer, then to install it on each and any of the Servers within the Balanced Service.

The CSR is needed for generate or order a new certificate. New certificates are generated by Certificates Authorities (CA) using the CSR as a seed for the certificate generation.

In order to terminate the SSL certificate on the Load Balancer, a few steps must be performed.

Step 1 Define and Configure the Parameters

First thing we need to do is to generate the CSR based on the RSA key and a set of parameters that we need to define and configure on the ACE Load Balancer in the Global Configuration mode:

  (config)# crypto csr-params CSR_CISQUEROS

  (config-csr-params)# country SP

  (config-csr-params)# state MA

  (config-csr-params)# locality MADRID

  (config-csr-params)# organization-name CISQUEROS TECHNOLOGY

  (config-csr-params)# organization-unit NETWORKS

  (config-csr-params)# common-name prevol.cisqueros.blogspot.com

  (config-csr-params)# email cisqueros@blogspot.com

Step 2 Generate the RSA key (2048 in this example)

LB_ACTIVE# crypto generate key 2048 CISQUEROSRSAKEY.PEM

LB_ACTIVE# show crypto files

Filename                                 File  File    Expor      Key/

                                         Size  Type    table      Cert

-----------------------------------------------------------------------

… … …

CISQUEROSRSAKEY.PEM                    1675  PEM     Yes         KEY

… … …

T1-LBA-01 # show crypto key CISQUEROSRSAKEY.PEM

1024 bit RSA keypair found in CISQUEROSRSAKEY.PEM

Modulus:

9b:d1:06:75:ad:54:8b:81:e5:72:56:58:f9:fc:79:bd:07:51:c2:8b:52:01:bf:8e:c9:8b:20:61:30:7a:4b:62:f7:c3:c3:04:37:b8:46:3e:68:af:21:55:fa:82:e6:a7:58:f6:b0:2b:a2:7e:ac:59:3c:7c:2f:a8:a1:f3:3e:f5:92:9f:56:40:04:cc:ce:4c:33:1d:04:69:51:b6:a5:4a:f7:5a:47:a7:b9:3d:8c:81:

aa:09:83:6f:58:3b:f9:08:f8:33:7c:10:bf:b5:16:61:cc:81:18:4c:a1:39:fe:ac:21:45:4c:20:02:44:44:df:08:68:33:af:0c:99:1b:8d:

Step 3 Generate the CSR Key

CSR is generated from the key and the CSR parameter map, "crypto generate csr" generates the PKCS10 CSR in PEM format and outputs the CSR to the screen

LB_ACTIVE # crypto generate csr CSR_CISQUEROS CISQUEROSRSAKEY.PEM

-----BEGIN CERTIFICATE REQUEST-----

MIIC/DCCAeQCAQAwgbYxCzAJBgNVBAYTAklUMQswCQYDVQQIEwJNSTEPMA0GA1UE

BxMGTUlMQU5PMSQwIgYDVQQKExtHSUUgQVhBIFRFQ0hOT0xPR1kgU0VSVklDRVMx

GDAWBgNVBAsTD1NFUlZJQ0UgQ09OVFJPTDEdMBsGA1UEAxMUcHJldm9sLmF4YS1p

dGFsaWEuaXQxKjAoBgkqhkiG9w0BCQEWG2VtYW51ZWxlLmNhbnR1QGF4YS10ZWNo

LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALF38eazErvgTOl7

hP3sAboRGvXzee6+4aTpmC+ZTjeboLkfrehfZfYdEyhgBdu6trM8vxiL6Urzlgj4

RGdUlAfUgHwaXmTOO3QgqsgvdRpyk14lYecN2DytgP1ibq9w3h5MyOP+CfI6Huhv

DyQBILJlSepnJUFOhEOR2YRGdW0HTGgZWCykaUQb3GZSLGHMN5jAzPfvX1WTZNxM

PDQOYsGZ45MssciQp7pl8sXX1xBCvNNuJx1T28LTjA0+ikuFjKyDmfMXpYB8n4oO

76KsdII033zfNZBZQLcTE4rk5nuHfjmfziu5bmk9mqwX3zOughiWTovXxVI960iR

25ZzGa0CAwEAAaAAMA0GCSqGSIb3DQEBBAUAA4IBAQBdQnM2H+iA4TLQWmYqv8Y5

AEL4pYpdBJDvnMvIVMrG3d8lOJe7AkMHPsTGovd+1fbVh8xw+xRc/nsUfmZmWLCM

LeuLAEhdODPP+vNx3sE3cL2rD/eg+eTXLi5ZrdOlojsknuCihxTq/4fo5DimGr2C

8HNAX+x9NyXOPEjK4AdGsP2NOVfPOAr2dHHv7g7OeDo2ElDXmfXtTdL7NZ8NRJoX

8VDlARGp0zNhh/Urn6oFat4MkhyIfvh8wKCA1uQ4jX19NsfdTjjGaI/Y4q6mpTm9

XqisIh5QKQ/3XJI8gz4YSNF5wegI4XQ6Qwp1QQzQozA2y9Qouu7xqKC0eQKv1dYl

-----END CERTIFICATE REQUEST-----

TIP: CSR is not saved on the Load Balancer. Should you have the need to have it again, you will have to generate it one more time using the same steps.

TIP2: The only thing that the Certificate Authority is interesed in, and what you absolutely must send them is the content between the following two lines in the CSR:

 -----BEGIN CERTIFICATE REQUEST-----

And

 -----END CERTIFICATE REQUEST-----

  Step 4 Export the CSR Key to the Standby Load-Balancer

Export the RSA Key to the standby load-balancer,  in order to avoid desynchronization when saving. First export the RSA key from the original load-balancer:

LB_ACTIVE# crypto export CISQUEROSRSAKEY.PEM terminal

-----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQCb0QZ1rVSLgeVyVlj5/Hm9B1HCi1IBv47JiyBhMHpLYvfDwwQ3

uEY+aK8hVfqC5qdY9rAron6sWTx8L6ih8z71kp9WQATMzkwzHQRpUbalSvdaR6e5

PYyBqgmDb1g7+Qj4M3wQv7UWYcyBGEyhOf6sIUVMIAJERN8IaDOvDJkbjQIDAQAB

AoGBAI3CFYZqM0jY3M6xEDIfKQJ47kF4TxuYE2f5U3QYjqqXV6KagfPPitislOhX

OJpvDkE57f1E0MosRYMWOO1eSB/nvvAIod2Fcj9VZoTexKgyykukzZStYvwaEKKV

pdMaoK31H9olTj2zTl6vzzYs59q0YCEPmp1hvr1A1mMKrQ8BAkEAzXSF5RdLBEuD

isc20/z3FkW+tkJwkeNEoTem1knqSVtQTdTVaGjULgtIexJF8NzHdHf1tYYw6w2o

AESr85j2uQJBAMImR+PeDtyWFOatVeqI+ofgFootW6cPUOaNzBVlY7ehhz2ytRWn

9Neu3tW0v85p0iSZCSH+TdPozn65uIW2oXUCQHAVdopRV8qDC8MlBSNHKOEMsYsq

2dCs5J7zBmB3OIpGd5vOVZI9RivMWgFSKbfKKkG+w9wA1iUVcSacUBZ3x3kCQQCY

v9mL1CfJMWNcYj/YeNDzmkDhkfIsLAawfht1MgIUdcebqUCDu1MNZo33gW/vDJ7D

IIxo7FV7Rg1A8wnUWe4JAkBP8dj2BSY2SCsGPZ7VlaJQBalpxdQIMF52bLdsWNAK

LAakpQffg4I2t8MHNKYPuxMfSsmHPkzrNaDpN9Ohk21J

-----END RSA PRIVATE KEY-----

Then copy it to the other (Standby) load-balancer using the command: crypto import terminal CISQUEROSRSAKEY.PEM

LB_STANDBY# crypto import terminal NAME_OF_THE_KEY.KEY

Please enter PEM formatted data. End with "quit" on a new line.

 -----BEGIN RSA PRIVATE KEY-----

 MIIEowIBAAKCAQEAuDU2bvtOg1PiVKxIdvgZHaURfS+Df/eCq+Y7ASRY8PV7vGpl

 ZfDKVh48TTSu7SsMXSlAf0Rrmn67xnbOL13lIth/C7GgCdHYyX4QB+vdhYN10x8M

 PEUQbQlHS8urFBnQsph8CV/2oUjSWUz/UhqLZidsuddaNUiqN2ZFdO/Baa54laKX

YoGWBYwcRbsL+cirrt/7Xh4/vqXzVjAvBacLcSm7nQ5kArVWI8hFYFDiubEIN2LO

 YoGWBYwcRbsL+cirrt/7Xh4/vqXzVjAvBacLcSm7nQ5kArVWI8hFYFDiubEIN2LO

 keV7eoQxaM1rsvyS5WrB3tBzELI6zpTJVWNkSrLVRR2o6kOx/pM/hms4RzLIO87E

 TGMAzCnNLrQ8PpBESPGMLLjnyXo1iPPFIqz+NwIDAQABAoIBAQCCllasfsO+Hi2J

 UUld7awAdBDd6l0Szuh37JNPz/CtgZnijJqtlfIa8vxUz1BjGe197cynbF3L/KQp

 ofexZKMX/Nqz84w86eMBlLjQpMk56WQR8yS9ZUirw7Qja5MwgMyOj8L+8mTpGbLl

 U8x87Ax+stxFMwHkXEsvUvVSXNWEkNGZRafziJ5X+Skw6EFHOGHlJG1KoyHdTfrr

 KijxTDvMSSu4HzOrKSZTgJ3W3Vg963rdvWmhc9lH2VcwcmABtl1yZNCmEvzYVbqO

 s1ipO2tVeFUD5WC3x03rhKOWwF0XVTe/+W57J6i4EZkAuEfrFIfE1YEh5jGftG+E

 esVIszmBAoGBAPFBfuKV7V/zn4+lJc3SsL9FE9g4ay1Cqx6+d/474HlV9YxT1ba7

 09APF5aNnZjeaH0AqgaSm0uErpgkCVzKTweVXNeQj2j3/DTVZaa5hutSt8CFwY8K

 tl5YuG3obH6GL0+bGBdX0fPw7NGtaPggpihi4pgSOTck98hMcRGeXBPxAoGBAMN3

 MBu4t6RVz7bHf5vqbc8c85kt2iWt27VET/uQPlrIJmjN9HwdFnTuA9WNDpXEmvLi

 qG5BNGV0RB1p1EywFkNYroeGxI+TyvfG5jqV7pCMDOuNeBEpMGq1bFtfmUYyjaXe

 y4jORUD2KK1hgSxtR5xourQ7yJo9McjxE1IwZ7ynAoGACjciv0dn6LMxI2zzv9ZX

 A5JSN8qTxzPWeRPJkutIIvsfzZRTLUyguGObNRXEAZARTpGzoVmd18HDfs+v0c0D

 MagCaWJGoEQ32qjaiAe9DcPP4ggH3R2wASiyjnzT8zuNT0qa54oharnd3TcBhdgk

 EPu26oeDArG/CC0scHmLHpECgYATrDdHUvwIqipRtxp80sdihQNvc1H1YN4wDEQQ

 iZ/8+xAClFf69eKAukPghmXlZPhDYdSZ5C4l1+HTJAeeAEr9VDucoE/AM5vF/FrH

 ord0DORwALkI4SBiXQge2ixPCF+BRj8t8bS+qQfHC304v3bpoxDHewzhmS8djkXn

 i7+lGQKBgAvj9zNIWlAmoAGZISt1LMi+MHn2YjWGOUw3HHeX4G8W57s5IpfjOo+u

 xPP7TGErKkfjTx1BaMR6NhsLlAV0fGURS4U38NcFLaUE1Npa3wOwVOPMcJ8Ozmb9

 MNMqY3s2fZ+W9buRAwdK+8dzkSyNnkDlRDKv5Ey5eVCm2Lp0FzHZ

 -----END RSA PRIVATE KEY-----