Quality of Service (QoS) gives you control over how your bandwidth is used, prioritizing critical network traffic (such as streaming media) over less important communication (such as e-mail) and limiting the bandwidth used by specific applications. It can also help cut costs by getting more use of existing bandwidth and enabling network consolidation by combining your phone, videoconferencing and wide area network connections with your Internet connection while minimizing performance problems.
How QoS Works
Routers forward traffic between networks. One of the biggest causes of network performance problems (specifically latency) is router queuing. Queuing occurs when a router needs to forward more traffic to a destination network than the network can handle at one time.
By default, most routers work on a first-in, first-out basis. This works well for Web browsing and e-mail, but if real-time communication sits in a queue for more than a few milliseconds, the quality degrades significantly. For example, if the total latency is more than 150 milliseconds, a Voice over Internet Protocol conversation will cut out.
Consider a small business with a 512-kilobits-per-second Internet connection. If a user makes a VoIP phone call while sending an e-mail, the router won’t be able to immediately forward all the traffic across the DSL connection. With first-in, first-out, some of the VoIP packets would need to wait behind the e-mail packets — adding latency and degrading the quality of the VoIP phone call. With QoS, as shown in the following figure, the router forwards all the high-priority VoIP traffic first, and sends the lower priority e-mail traffic only after the high-priority queue is empty.
What’s New in Windows Vista and Windows Server 2008
Routers can distinguish between high-priority and low-priority packets by examining the Differentiated Services Code Point (DSCP) value in each packet. Unfortunately, previous versions of Windows didn’t give systems administrators control over the DSCP values, and almost all traffic had the default DSCP value of 0.
With Windows Vista and Windows Server 2008, you can use Group Policy settings to mark outgoing network traffic with DSCP values. With this capability, a QoS routing infrastructure, and a few QoS policies, database queries from your critical customer service application can soar past e-mail and Web browsing traffic.
You can also use Group Policy settings to throttle traffic from specific applications. For example, if your outgoing e-mail server is filling up your Internet connection every time you send a mass-mailing, you can throttle the e-mail server to use only half the bandwidth — even if your network infrastructure doesn’t support QoS. Policy-based QoS can be very specific, so you could throttle traffic bound for the Internet but allow traffic bound for computers on your high-speed local area network to use all available bandwidth.
QoS policies are focused on controlling outgoing traffic. While you have much less control over incoming traffic, you can also use Group Policy settings to throttle all incoming Transmission Control Protocol traffic for a computer. So, if downloads to your client computers are using too much bandwidth, you can tune Windows to slow down that incoming traffic.
Adding QoS to Your Network
QoS requires careful planning and coordinated efforts from systems and network administration teams. Before you create your policies, follow these high-level steps to create a plan to add QoS to your network:
- Prioritize the different types of traffic on your network by assigning a standard DSCP value to each, as the example below shows. You don’t need to use every DSCP value. Any traffic you don’t classify will automatically have a DSCP value of 0, which is considered best effort.
- Work with your network engineering team to configure routers to prioritize traffic based on the DSCP values you specified. This might already be done; some routers have QoS enabled by default for standard DSCP values.
- Identify the executable file associated with each traffic type. For example, if you want to assign a DSCP value to packets sent by your Internet Information Services Web server, you would specify the executable inetinfo.exe. If you can’t identify the executable file, identify the TCP or User Datagram Protocol port number that the application uses. Finally, decide whether to apply the DSCP values for all outgoing traffic or for only traffic addressed to specific networks or IP addresses.
- Configure policy-based QoS using Group Policy Objects (GPOs), as described later in this article.
- If you identify client computers consuming too much bandwidth with incoming traffic, use GPOs to throttle all incoming traffic on those computers, as described at the end of this article.
Typically, QoS will work only on your internal network. Most Internet Service Providers either remove or ignore DSCP values.
How to Configure Policy-Based QoS
To configure QoS policies, follow these steps:
- Edit the GPO you want to add the policy to, and select the Computer Configuration\Windows Settings\Policy-based QoS node or the User Configuration\Windows Settings\Policy-based QoS node.
- Right-click the Policy-based QoS node and click Create New Policy.The Policy-based QoS Wizard appears.
- On the Create A QoS Policy page, type a policy name and DSCP value. Optionally, select the Specify Throttle Rate check box, and set a throttle rate in either kilobytes per second or megabytes per second. The value you enter must be in kilobytes or megabytes per second, rather than the more commonly used kilobits or megabits per second. One kilobyte is equal to eight kilobits, and one megabyte is equal to eight megabits. Click Next.
- On the This QoS Policy Applies To page, select Only applications with this executable name if you can identify a specific executable file. Then, type the executable name. If you can’t identify an executable file (for example, the traffic you want the policy to apply to is generated by a service running in svchost.exe), then leave All applications selected. Click Next.
- On the Specify The Source And Destination IP Addresses page, leave the default settings to apply the policy to all computers. To apply the policy only to specific computers on your network, select Only for the following source IP address or prefix, and then type the IP address or network that identifies the computers that should use the policy. To apply the policy only to traffic being sent to specific computers or networks, select Only for the following destination IP address or prefix, and then type the destination IP address or network. Click Next.
- On the Specify The Protocol And Port Numbers page, identify traffic based on TCP or UDP port numbers only if you didn’t specify an executable name. If you are configuring a QoS policy for a server, specify the source port. If you are configuring a QoS policy for a client, specify the destination port. For example, if you want to throttle SMTP traffic from an e-mail server, you would select TCP, select From This Source Port Number Or Range, and then specify port 25 (the port number SMTP uses). Click Finish.
How to Throttle Incoming Traffic
While you don’t have direct control over incoming traffic, Windows can use TCP’s traffic control capabilities to slow down incoming traffic. Unlike the policy-based QoS you just read about, this change affects all applications on a computer (including any critical applications). Because of this limitation, you should leave this setting at the default unless you have a computer that’s slowing down your network by downloading large files.
To specify the inbound TCP throughput level, follow these steps:
- Edit the GPO you want to configure, right-click Computer Configuration\Windows Settings\Policy-based QoS, and then click Properties.
- On the Inbound TCP Traffic tab, select the Specify the inbound TCP throughput level check box. Then, a level from 0 (to slow down traffic as much as possible) to 3 (the default setting, which is maximum throughput).
- Click OK.
Tony Northrup is a developer, security consultant and author with more than 10 years of professional experience developing applications for Microsoft Windows.
Policy-based QoS
QoS features allow administrators to configure
certain network protocols and applications to have a higher network
bandwidth priority than others. QoS also allows administrators to limit
the bandwidth used by lower priority applications. The use of QoS has
increased rapidly over the past several years as more organizations have
begun using their networks to send more than just email and browse the
Web. Today’s businesses are using their networks to stream multimedia
from and to the Internet, use cloud-based services, and support Voice
over IP (VoIP) phone systems. Using these services requires prioritizing
some protocols over others. QoS has traditionally been a network
feature that could be set up on network routers and layer 3 switches.
The network devices are set up to inspect network traffic and give
certain protocols a higher priority than others.
The
most widely used method of implementing QoS is using differential
services code point (DSCP) tagging. DSCP assigns a value between 0 and
63 to data packets. QoS services read this value and give higher
numbers, a higher priority on the network.
QoS in Windows Server 2003 and Windows XP
Microsoft introduced some basic QoS APIs in Windows
XP and Windows Server 2003. This allowed application developers to apply
QoS settings to their applications but was limited in features and
needed to have code written to support QoS. Additionally, the
administrator would need to install the QoS packet scheduler on the
Windows Server after Windows installation. It should be noted that to
support QoS, the full network path has to trust the QoS values coming
from the client. This is typically something implemented on internal
networks, but due to an organization’s inability to control
Internet-based network routers, it is rarely implemented over an
Internet connection.
Windows Server 2008 R2 includes the feature
Policy-based QoS. Policy-based QoS allows Windows administrators to
apply DSCP values to traffic entering or leaving a computer based on
application, port number, protocol, or source and destination IP
addresses. These QoS polices can be applied to Windows Vista, Windows 7,
Windows Server 2008, and Windows Server 2008 R2 computers and users
logged onto these operating systems. These policies are deployed via
traditional group policies. This means that you can apply different QoS
policies to different systems based upon their Active Directory (AD)
site, OU membership, or the domain they belong to. This makes QoS
management very granular and less complicated to administer. Let us set
up and see Policy-based QoS in action. Policy-based QoS can be
especially helpful in VoIP technology deployments such as Microsoft
Office Communications Server 2007 R2.
Creating a Policy-based QoS GPO
In the below exercise, we will create a new
Policy-based QoS GPO for traffic destined for port 80 (http). This will
give standard Web browsing traffic a higher value leaving the computer
over other network traffic. If the network devices support the DSCP
value provided by the policy, they will also give the traffic higher
priority.
1.
In
our example, we will use a local computer policy; however, the same
policy can be set up in AD. Open the group policy editor: Start | Run type gpedit.msc and click OK. The Local Group Policy Editor will open as seen in Figure 3.
Figure 3. Local Group Policy Editor.
2.
Expand the nodes Computer Configuration | Windows Settings and User Configuration | Windows Settings (see Figure 4).
You will notice that Policy-based QoS can be applied to the computer or
to the user. For our example, we will use a computer-based policy.
Figure 4. Computer and User Policy-Based QoS Options.
3.
Right click the Policy-based QoS node and choose Create New Policy.
4.
The Policy-based QoS Wizard will launch (see Figure 5). Enter a descriptive name in the Policy Name field. Then use the Specify DSCP value option to set a DSCP value. In our example, we will not be throttling the traffic so leave this option unchecked. Click Next to continue.
Figure 5. Policy Name and DSCP Value.
5.
We
can assign the DSCP policy to specific applications by choosing the
executable, or if this server is set up as a Web application server, we can specify the URL of the application. For our example, we will leave the default of All Applications selected (see Figure 6). Click Next to continue.
Figure 6. Policy-Based QoS Applications.
6.
We can specify that this policy applies only to certain source or destination IP addresses (see Figure 7). We will leave both of these options as the default for our example. Click Next.
Figure 7. Limit Policy-Based QoS to Listed Source or Destination IP Addresses.
7.
We now need to choose the protocol and port number or range that we want the DSCP value to (see Figure 8).
For our testing purposes, let us choose port 80 (http) as the
destination port. This will allow us to easily use a Web browser to test
our policy. Click Finish to create the policy.
Figure 8. Policy-Based QoS Protocol and Port Number Options.
8.
You should now see the policy appear under the Policy-based QoS node in the Local Group Policy Editor window as seen in Figure 9.
Figure 9. New Policy-Based QoS Policy.
9.
Now
let us test our new policy. To perform this test, you will need to
download and install Network Monitor. Network Monitor can be downloaded
from Microsoft Download Center at http://download.microsoft.com. After installing Network Monitor, open it by going to Start | All Programs | Network Monitor 3.3.
10.
The Network Monitor Start Page will be opened as seen in Figure 10. Click the link New Capture Tab to set up a new network capture session.
Figure 10. Network Monitor Start Page.
11.
A new capture tab will be opened. Click the Start button at the top of the Network Monitor window to start capturing traffic (see Figure 11).
Figure 11. New Capture Session.
12.
Now let us create some outbound http traffic. Open Internet Explorer by going to Start | All Programs | Internet Explorer.
13.
Browse a standard http Web site. Then close Internet Explorer.
14.
Go back to the Network Monitor window and click the Stop button. You should see that the utility has captured traffic in the frame summary pane (see Figure 12).
Figure 12. Network Monitor Captured Traffic.
15.
Expand the iexplorer.exe node in the network conversations pane.
16.
Locate one of the IPv4 sessions (see Figure 13) and select the session you want to view.
Figure 13. Selected IPv4 Session frames.
17.
After selecting an IPv4 session, notice the list of frames in the frames summary pane as seen in Figure 14. Select a frame that contains DstPort=HTTP(80).
Figure 14. The Frames Summary Pane.
18.
Expand the IPv4 section in the frame details pane (see Figure 15). Notice the DifferentiatedServicesField
subnode. You will notice that the frame has been given a DSCP value of
10. This shows that the policy is correctly applying a DSCP value to
outbound port 80 traffic.
Figure 15. IPv4 Session Frame Details.
Test various QoS policies in your test lab
during your Windows Server 2008 R2 deployment. You can use them to help
ensure that the critical applications receive necessary network
bandwidth to perform optimally.
certain network protocols and applications to have a higher network
bandwidth priority than others. QoS also allows administrators to limit
the bandwidth used by lower priority applications. The use of QoS has
increased rapidly over the past several years as more organizations have
begun using their networks to send more than just email and browse the
Web. Today’s businesses are using their networks to stream multimedia
from and to the Internet, use cloud-based services, and support Voice
over IP (VoIP) phone systems. Using these services requires prioritizing
some protocols over others. QoS has traditionally been a network
feature that could be set up on network routers and layer 3 switches.
The network devices are set up to inspect network traffic and give
certain protocols a higher priority than others.
most widely used method of implementing QoS is using differential
services code point (DSCP) tagging. DSCP assigns a value between 0 and
63 to data packets. QoS services read this value and give higher
numbers, a higher priority on the network.
QoS in Windows Server 2003 and Windows XP
Microsoft introduced some basic QoS APIs in Windows
XP and Windows Server 2003. This allowed application developers to apply
QoS settings to their applications but was limited in features and
needed to have code written to support QoS. Additionally, the
administrator would need to install the QoS packet scheduler on the
Windows Server after Windows installation. It should be noted that to
support QoS, the full network path has to trust the QoS values coming
from the client. This is typically something implemented on internal
networks, but due to an organization’s inability to control
Internet-based network routers, it is rarely implemented over an
Internet connection.
Policy-based QoS. Policy-based QoS allows Windows administrators to
apply DSCP values to traffic entering or leaving a computer based on
application, port number, protocol, or source and destination IP
addresses. These QoS polices can be applied to Windows Vista, Windows 7,
Windows Server 2008, and Windows Server 2008 R2 computers and users
logged onto these operating systems. These policies are deployed via
traditional group policies. This means that you can apply different QoS
policies to different systems based upon their Active Directory (AD)
site, OU membership, or the domain they belong to. This makes QoS
management very granular and less complicated to administer. Let us set
up and see Policy-based QoS in action. Policy-based QoS can be
especially helpful in VoIP technology deployments such as Microsoft
Office Communications Server 2007 R2.
Policy-based QoS GPO for traffic destined for port 80 (http). This will
give standard Web browsing traffic a higher value leaving the computer
over other network traffic. If the network devices support the DSCP
value provided by the policy, they will also give the traffic higher
priority.
1.
In
our example, we will use a local computer policy; however, the same
policy can be set up in AD. Open the group policy editor: Start | Run type gpedit.msc and click OK. The Local Group Policy Editor will open as seen in Figure 3.
Figure 3. Local Group Policy Editor.
2.
Expand the nodes Computer Configuration | Windows Settings and User Configuration | Windows Settings (see Figure 4).
You will notice that Policy-based QoS can be applied to the computer or
to the user. For our example, we will use a computer-based policy.
Figure 4. Computer and User Policy-Based QoS Options.
3.
Right click the Policy-based QoS node and choose Create New Policy.
4.
The Policy-based QoS Wizard will launch (see Figure 5). Enter a descriptive name in the Policy Name field. Then use the Specify DSCP value option to set a DSCP value. In our example, we will not be throttling the traffic so leave this option unchecked. Click Next to continue.
Figure 5. Policy Name and DSCP Value.
5.
We
can assign the DSCP policy to specific applications by choosing the
executable, or if this server is set up as a Web application server, we can specify the URL of the application. For our example, we will leave the default of All Applications selected (see Figure 6). Click Next to continue.
Figure 6. Policy-Based QoS Applications.
6.
We can specify that this policy applies only to certain source or destination IP addresses (see Figure 7). We will leave both of these options as the default for our example. Click Next.
Figure 7. Limit Policy-Based QoS to Listed Source or Destination IP Addresses.
7.
We now need to choose the protocol and port number or range that we want the DSCP value to (see Figure 8).
For our testing purposes, let us choose port 80 (http) as the
destination port. This will allow us to easily use a Web browser to test
our policy. Click Finish to create the policy.
Figure 8. Policy-Based QoS Protocol and Port Number Options.
8.
You should now see the policy appear under the Policy-based QoS node in the Local Group Policy Editor window as seen in Figure 9.
Figure 9. New Policy-Based QoS Policy.
9.
Now
let us test our new policy. To perform this test, you will need to
download and install Network Monitor. Network Monitor can be downloaded
from Microsoft Download Center at http://download.microsoft.com. After installing Network Monitor, open it by going to Start | All Programs | Network Monitor 3.3.
10.
The Network Monitor Start Page will be opened as seen in Figure 10. Click the link New Capture Tab to set up a new network capture session.
Figure 10. Network Monitor Start Page.
11.
A new capture tab will be opened. Click the Start button at the top of the Network Monitor window to start capturing traffic (see Figure 11).
Figure 11. New Capture Session.
12.
Now let us create some outbound http traffic. Open Internet Explorer by going to Start | All Programs | Internet Explorer.
13.
Browse a standard http Web site. Then close Internet Explorer.
14.
Go back to the Network Monitor window and click the Stop button. You should see that the utility has captured traffic in the frame summary pane (see Figure 12).
Figure 12. Network Monitor Captured Traffic.
15.
Expand the iexplorer.exe node in the network conversations pane.
16.
Locate one of the IPv4 sessions (see Figure 13) and select the session you want to view.
Figure 13. Selected IPv4 Session frames.
17.
After selecting an IPv4 session, notice the list of frames in the frames summary pane as seen in Figure 14. Select a frame that contains DstPort=HTTP(80).
Figure 14. The Frames Summary Pane.
18.
Expand the IPv4 section in the frame details pane (see Figure 15). Notice the DifferentiatedServicesField
subnode. You will notice that the frame has been given a DSCP value of
10. This shows that the policy is correctly applying a DSCP value to
outbound port 80 traffic.
Figure 15. IPv4 Session Frame Details.
during your Windows Server 2008 R2 deployment. You can use them to help
ensure that the critical applications receive necessary network
bandwidth to perform optimally.
Пользователи Windows Vista признали расширенный брандмауэр Windows Advanced Firewall. Теперь и у вас есть такая возможность благодаря Windows Server 2008. Вы даже можете использовать групповую политику (Group Policy) во всеобъемлющем централизованном управлении брандмауэра Windows Advanced Firewall. Если вы еще не имели возможности использовать брандмауэр Vista, то вам предстоит испытать наслаждение. Windows Advanced Firewall включенный в Vista и Windows Server 2008 позволяет вам производить точные настройки контроля входящего и исходящего доступа. Контроль исходящего доступа был недостающим звеном в брандмауэре Windows XP. Теперь у вас есть контроль над исходящими соединениями, поэтому если вы обнаружили на своем брандмауэре, что хосты заражены червем, предназначенным для определенного порта и нескольких портов, вы можете блокировать эти порты на каждом хосте с помощью политики групп.
На рисунке ниже показан мастер New Inbound Rule Wizard. Мастер, которого можно использовать в консоли Group Policy Management, позволяет вам с легкостью настраивать входящие правила. Есть также мастер для настройки исходящих правил, который позволяет вам блокировать исходящие соединения, вы можете контролировать их на основе UDP или TCP портов, ICMP типов сообщений, или вы можете блокировать каждое отдельное приложение.
Одной из самых впечатляющих характеристик брандмауэра Windows Firewall является то, как он упростил процесс создания IPsec политик. В прошлом настройка политик IPsec была довольно сложной задачей. Вам нужно было пройти через мастеров и надеяться, что вы все правильно настроили. С новым брандмауэром Windows Advanced Firewall все совсем по-другому. На рисунке ниже показан простой в использовании мастер New Connection Security Rule Wizard, который значительно упрощает создание IPsec политик изолирования доменов, политики запрета аутентификации, IPsec соединения между серверами и IPsec туннелей. Windows Advanced Firewall преобразовал процесс настройки IPsec политики из чего-то ужасного в то, что мне хочется попробовать. Попробуйте, и думаю, вам понравится.
Еще одним значительным улучшением в Windows Server 2008 является централизованное управление политикой QoS с помощью политики групп (Group Policy). Предыдущие версии Windows включали характеристику QoS, но поскольку она не была основана на стандартах, не многие люди (если вообще таковые были) использовали ее. Windows Server 2008 изменил игру, представив новую функцию QoS на основе политики, которую можно использовать практически сразу.
Есть два способа применения QoS политики – вы можете жестко закодировать значения пропускной способности или воспользоваться Differentiated Services Code Point (DSCP) значениями, которые настроены на маршрутизаторах вашей сети. DSCP – это метод производственных стандартов для применения QoS в корпоративных сетях. Однако даже если у вас нет активированных DSCP маршрутизаторов, или даже если вы не используете DSCP, вы можете настраивать политики так, чтобы локальные хосты контролировали пропускную способность на TCP или UDP портах, или на специальных приложениях.
На рисунке ниже показана политика QoS, которая дросселирует SMTP протокол на порте TCP 25 пункта назначения. Вы можете выбирать хосты, для которых будет назначена данная политика. Например, вам не нужно дросселировать ваш SMTP сервер, но для хостов вашей сети вы, возможно, захотите ограничить уровень SMTP трафика. Таким образом, вы можете контролировать то, сколько спама зараженный компьютер может отправить, прежде чем вы обнаружите, что машины подвергались атаке.
Заключение
Windows Sever 2008 включает сотни новых возможностей и параметров, каждая из которых может стать причиной того, что данная версия является стоящим апгрейдом для вашей организации. В этой статье я освятил лишь небольшую часть новых и усовершенствованных параметров, которые, на мой взгляд, делают Windows Server 2008 достойным апгрейдом. Для более подробной информации о Windows Server 2008 перейдите по ссылке Windows Server 2008 Technical Library.
С учетом выпуска Windows Server 2008 будет неплохой мыслью начинать практиковаться и изучать процесс установки 2008, а также применять необходимые функциональные возможности (такие как роли и прочие параметры) и анализировать новые опции установки, которые теперь доступны в 2008, например Core Server инсталляция, использование Windows Deployment Services (WDS), а также несопровождаемая установка, апгрейды и/или ситуации двойной загрузки. В этой статье будут описаны основы установки полной копии Windows Server 2008 на оборудование производственных серверов.
В Windows Server 2008 вы найдете новые инструменты для установки вашего сервера. В 2008 вы обнаружите, что не только гораздо проще устанавливать Windows Server, но для вас представлено больше опций, соответствующих нуждам вашего производства, и теперь вы можете устанавливать (или не устанавливать) все, что вам требуется, или что пожелаете. Например, если вы хотите иметь возможность выбора и запустить минимальный набор требуемых служб, вы можете выбрать опцию ядра сервера (Server Core) во время установки. Если вы хотите развернуть Windows Server 2008 с несопровождаемыми файлами ответа, с новыми опциями и параметрами, вы можете значительно упростить этот процесс.
В этой статье мы рассмотрим базовые опции установки, доступные вам при развертывании полной копии Windows Server 2008 на производственных серверах. Целью этой статьи является ознакомление и акклиматизация читателя с процессом развертывания Windows Server 2008 на системах вашей производственной сети.
Заметка:важно отметить тот факт, что, хотя 2008 является отличным продуктом с множеством новых характеристик и улучшенных функций, нельзя использовать бета и тестовую версию Windows в своей производственной сети. Она не поддерживается и является незаконченным продуктом. Вам также не следует использовать новые операционные системы (или апгрейды) в своей производственной сети, предварительно не протестировав официальный выпуск в лабораторных условиях, чтобы убедиться, что ваши приложения совместимы, равно как и ваше оборудование, диски и т.д.
03.06.2009 —
Опубликовал: |
ms windows server 2008
Sorry, the comment form is closed at this time.
Skip to content
Implementing QoS on a Windows 2008 Server
These are instructions to create a basic catch-all policy for all traffic generated from a machine running 3CX PhoneSystem which tags all traffic with a DSCP value of 56. Create a Local Policy for QoS Run “gpedit.msc” Go …
Link:
Implementing QoS on a Windows 2008 Server
Похожие записи
Пробная АТС 3CX на 1 месяц.
Связь, совместная работа и общение между сотрудниками и клиентами теперь как никогда удобны и просты. Разверните нашу бесплатную тестовую систему на 30 дней и убедитесь, что она оптимально подходит для вашего бизнеса.
Компания
Решения
Ссылки
Узнать Больше
Page load link
|
|
|
