PfRv3 Zero SLA Support

The Performance Routing v3 (PfRv3) Zero SLA Support feature enables users to reduce probing frequency on various ISP links, such as 3G, 4G, and LTE. When the Zero SLA (0-SLA) feature is configured on an ISP link, only the channel with the DSCP (Differentiated Services Code Point) value 0 is probed. For all other DSCPs, channels are created only if there is traffic, but no probing is performed.

Feature Information for PfRv3 Zero SLA Support

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for PfRv3 Zero SLA Support

Feature Name

Releases

Feature Information

PfRv3 Path of Last Resort Support

15.5(3)M

The PfRv3 Path of Last Resort is a route used by the device when a service provider cannot be reached or the exits are out of bandwidth.

The following commands were modified or added by this feature: domain path isp-name, show domain default vrf border, show domain default vrf master.

Performance Routing v3 Zero SLA Support

15.5(1)T

Cisco IOS XE Release 3.14S

The Performance Routing v3 Zero SLA Support enables users to reduce probing frequency on various ISP links.

The following command was modified by this feature:domain (interface configuration).

Prerequisites for PfRv3 Zero SLA Support

  • Upgrade hub-border routers with the latest Cisco IOS image to configure the Zero SLA feature.

Restrictions for PfRv3 Zero SLA Support

  • Fast-monitor interval and brown out features are not supported with Zero SLA configurations.

Information About PfRv3 Zero SLA Support

Information About Zero SLA

The Zero SLA (0-SLA) feature enables users to reduce probing frequency in their network infrastructure. Reduction in probing process helps in reducing cost especially when ISPs charge based on traffic, and helps in optimizing network performance when ISPs provide limited bandwidth. When this feature is configured, probe is sent only on the DSCP-0 channel. For all other DSCPs, channels are created if there is traffic, but no probing is performed. The reachability of other channels is learnt from the DSCP-0 channel that is available at the same branch site.

Figure 1. Probing on Zero SLA

In the above illustration, the branch and hub sites are connected with red and blue ISP links. On the red ISP link, Zero SLA is configured at the hub site. Traffic exists on DSCP-0, DSCP AF31, and DSCP-EF channels on both ISP links, but on the red link probing is sent only on the DSCP-0 channel. A probe sent during the WAN discovery signals if a link is a Zero SLA link or a normal link.

Information About Path of Last Resort

A Path of Last Resort is a route used by the device when a service provider cannot be reached or the exits are out of bandwidth. This feature is supported for 3G and 4G metered links. When the service provider is not available, the traffic is routed to the path of last resort if you have specified the path of last resort keyword in the domain path command. When the exits are up with optimum bandwidth, the links are transitioned back. The following are the different supported modes:

  • Standby mode—No traffic classes are routed over the path of last resort service provider.

  • Active mode—Traffic classes are routed over the path of last resort service provider.

  • Disabled mode—The path of last resort is not enabled for the interface.

The path of last resort routes are muted when it is in standby mode. The smart probe frequency is reduced to 1 packet every 10 seconds from 20 packets per second.

Compatibility Matrix for Zero SLA Support

In Performance Routing v3, capability negation happens through service advertisement framework (SAF) messages. When the PfR v3 domain comes up, it registers itself to the SAF to publish the compatibility and support for different release versions.

Use the show domain default master site-capability command to view the release version and the capability negation between hub and branch sites.

The following table shows the devices with various Cisco IOS/XE release versions and its support for Zero SLA within a single branch.

Master Controller

Border Router

Compatibility Between Release Versions

Zero SLA Support

Cisco IOS XE Release 3.14 or later

Cisco IOS Release 15.5(1)T or later

Cisco IOS XE Release 3.14 or later

Cisco IOS Release 15.5(1)T or later

Yes

If the master controller and border routers have the same Cisco IOS release versions, the Zero SLA feature is enabled.

Cisco IOS XE Release 3.14 or later

Cisco IOS Release 15.5(1)T or later

Cisco IOS XE Release 3.13 or earlier

Cisco IOS Release 15.4T or earlier

Yes

If the master controller has the latest Cisco IOS release and the border router has the earlier release version, the Zero SLA feature is disabled.

Cisco IOS XE Release 3.13

Cisco IOS Release 15.4T

Cisco IOS XE Release 3.13

Cisco IOS Release 15.4T

Yes

Zero SLA is not supported on Cisco IOS XE Release 3.13.

Cisco IOS XE Release 3.13

Cisco IOS Release 15.4T

Cisco IOS XE Release 3.14 or later

Cisco IOS Release 15.5(1)T or later

No

The release versions are not compatible and hence, Zero SLA cannot be enabled.


Note

  • If you are configuring PfRv3 on a site, it is mandatory that the hub master and the hub border routers in a site are on the same version of the Cisco IOS XE software.

  • In a site, the branch master controller and the associated borders in the branch should also have the same version of the Cisco IOS XE software. But, it is not mandatory for the software version on the hub master or the hub border to match the software version on the branch master controller and its borders.

  • Ensure that the Cisco IOS XE software version installed on the hub master, hub border router, branch master controller and borders support Zero SLA.

How to Configure PfRv3 Zero SLA Support

Configuring PfRv3 Zero SLA Support

Configure the Zero SLA (0-SLA) feature on the border router at the hub site.

Before you begin

Configure PfRv3 topology on the hub and branch site. For more information on configuring PfRv3, see the "How to Configure PfRv3" topic in the Performance Routing v3 Configuration Guide.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. interface tunnel tunnel-number
  4. bandwidth bandwidth-value
  5. ip address ip-address mask
  6. domain path isp-name [internet-bound | path-id | path-last-resort | zero-sla]

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.
Step 2

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 3

interface tunnel tunnel-number

Example:

Device(config)# interface tunnel 100

Enters interface configuration mode.

Step 4

bandwidth bandwidth-value

Example:

Device(config-if)# bandwidth 10000000

Configures inherited and received bandwidth values for the tunnel interface. The bandwidth value is in kilobits and the valid values are 1 to 10000000.

Step 5

ip address ip-address mask

Example:

Device(config-if)# ip address 10.32.1.1 255.0.0.0

Configures an IP address of the border router at the hub site.

Step 6

domain path isp-name [internet-bound | path-id | path-last-resort | zero-sla]

Example:

Device(config-if)# domain path ISP1 zero-sla

Specifies a service provider for the interface.

  • internet-bound —Configures an internet bound interface.

  • path-id —Configures service provider's path-id for the interface.

  • path-last-resort —Configures the interface to be a path of a last resort.

  • zero-sla —Configures Zero SLA for the interface.

Note 

You can configure multiple Internet Service Providers (ISPs). If you are defining a specific domain name for an ISP (for example, domain_abc), you must specify the same domain name while configuring the ISP paths.

Verifying PfRv3 Zero SLA Support

The show commands can be entered in any order.

Before you begin

Configure Zero SLA on the hub-border router.

SUMMARY STEPS

  1. show domain default master status
  2. show domain default master channel
  3. show domain default border status
  4. show domain default border channel
  5. show domain default master site-capability
  6. show domain default vrf vrf-name master status
  7. show domain default vrf vrf-name border status
  8. show domain default vrf vrf-name master channels
  9. show domain default vrf vrf-name border channels
  10. show domain default vrf vrf-name master policy

DETAILED STEPS

Step 1

show domain default master status

Displays the status of the hub master controller.

Step 2

show domain default master channel

Displays channel information of the hub master controller.

Step 3

show domain default border status

Displays the status of the hub border routers.

Step 4

show domain default border channel

Displays the information of border router channels at the hub site.

Step 5

show domain default master site-capability

Displays the capability information of master controller.

Example:

Device# show domain default master site-capability

Device Capability

-----------------------------------------------------------
|       Capability          |     Major     |     Minor      |
-----------------------------------------------------------
|     Domain                |     2         |      0         |
-----------------------------------------------------------
|     Zero-SLA              |     1         |      0         |
-----------------------------------------------------------
Site id  :10.2.10.10

-----------------------------------------------------------
|       Capability          |     Major     |     Minor      |
-----------------------------------------------------------
|     Domain                |     2         |      0         |
-----------------------------------------------------------
|     Zero-SLA              |     1         |      0         |
-----------------------------------------------------------
Site id  :10.2.12.12

-----------------------------------------------------------
|     Capability            |     Major     |     Minor      |
-----------------------------------------------------------
|     Domain                |     2         |      0         |
-----------------------------------------------------------
|     Zero-SLA              |     1         |      0         |
-----------------------------------------------------------
Table 2. show domain default master site-capability Field Descriptions

Field

Description

Capability

Features supported by PfR v3 domain.

Domain

Domain version.

Major - Means the major release version number for PfR v3.

Minor - Means the minor release version number for PfR v3.

Zero-SLA

Zero-SLA feature support.

Major - Means the major release version of the Zero-SLA feature on the master controller.

Minor - Means the minor release version of the Zero-SLA feature on the master controller.

Step 6

show domain default vrf vrf-name master status

Displays the master status of the hub border routers.

Example:

Device# show domain default vrf vrf1 master status

Borders:
  IP address: 10.204.1.4
  Version: 2
  Connection status: CONNECTED (Last Updated 00:59:16 ago )
  Interfaces configured:
   Name: Tunnel20 | type: external | Service Provider: ISP2 | Status: UP | Zero-SLA: NO | Path of
Last Resort: Disabled
    Number of default Channels: 0
  Tunnel if: Tunnel1
  IP address: 10.203.1.3
  Version: 2
  Connection status: CONNECTED (Last Updated 00:59:16 ago )
  Interfaces configured:
    Name: Tunnel10 | type: external | Service Provider: ISP1 | Status: UP | Zero-SLA: YES | Path of
Last Resort: Standby
      Number of default Channels: 0
  Tunnel if: Tunnel1
Step 7

show domain default vrf vrf-name border status

Displays the master status of the hub border routers.

Example:

Device# show domain default vrf vrf1 border status

--------------------------------------------------------------------
**** Border Status ****
Instance Status: UP
Present status last updated: 01:01:42 ago
Loopback: Configured Loopback1 UP (30.209.1.9)
Master: 30.209.1.9
Master version: 2
Connection Status with Master: UP
MC connection info: CONNECTION SUCCESSFUL
Connected for: 01:01:42
Route-Control: Enabled
Asymmetric Routing: Disabled
Minimum Mask length: 28
Sampling: off
Minimum Requirement: Met
External Wan interfaces:
    Name: Tunnel10 Interface Index: 16 SNMP Index: 13 SP: ISP1 path-id: 0 Status: UP Zero-SLA: YES
Path of Last Resort: Standby Path-id List: 0:0
  Name: Tunnel20 Interface Index: 18 SNMP Index: 15 SP: ISP2 Status: UP Zero-SLA: NO Path of Last
Resort: Disabled Path-id List: 0:0


Auto Tunnel information:


   Name:Tunnel1 if_index: 21
   Borders reachable via this tunnel:
--------------------------------------------------------------------
Step 8

show domain default vrf vrf-name master channels

Displays the master status of the hub master controller.

Example:

Device# show domain default vrf vrf1 master channels

Channel Id: 9 Dst Site-Id: 30.209.1.9 Link Name: ISP1 DSCP: af41 [34] pfr-label: 0:0 | 0:0 [0x0]
TCs: 0
  Channel Created: 00:57:15 ago
  Provisional State: Initiated and open
  Operational state: Available
  Channel to hub: FALSE
  Interface Id: 16
  Supports Zero-SLA: Yes
  Muted by Zero-SLA: Yes
  Muted by Path of Last Resort: Yes
  Estimated Channel Egress Bandwidth: 0 Kbps
  Immitigable Events Summary:
    Total Performance Count: 0, Total BW Count: 0
  ODE Stats Bucket Number: 1
    Last Updated : 00:56:15 ago
     Packet Count : 505
     Byte Count : 42420
     One Way Delay : 229 msec*
     Loss Rate Pkts: 0.0 %
     Loss Rate Byte: 0.0 %
     Jitter Mean : 535 usec
     Unreachable : FALSE
    TCA Statistics:
     Received:1 ; Processed:1 ; Unreach_rcvd:0
  Latest TCA Bucket
    Last Updated : 00:56:15 ago
     One Way Delay : 229 msec*
     Loss Rate Pkts: NA
     Loss Rate Byte: NA
     Jitter Mean : NA
     Unreachability: FALSE
Step 9

show domain default vrf vrf-name border channels

Displays the information of border router channels at the hub site.

Example:

Device# show domain default vrf vrf1 border channels

Channel id: 2
 Channel create time: 00:46:02 ago
 Site id : 255.255.255.255
 DSCP : default[0]
 Service provider : ISP1
 Pfr-Label : 0:0 | 0:0 [0x0]
 exit path-id: 0
 Exit path-id sent on wire: 0
 Number of Probes sent : 0
 Number of Probes received : 0
 Last Probe sent : 00:46:02 ago
 Last Probe received : - ago
 Channel state : Initiated and open
 Channel next_hop : 0.0.0.0
 RX Reachability : Initial State
 TX Reachability : Reachable
 Channel is sampling 0 flows
 Channel remote end point: 0.0.0.0
 Channel to hub: FALSE
 Version: 0
 Supports Zero-SLA: No
 Muted by Zero-SLA: No
 Muted by Path of Last Resort: Yes
 Probe freq with traffic : 1 in 10000 ms
Step 10

show domain default vrf vrf-name master policy

Displays the status of the master policy.

Example:

Device# show domain default vrf vrf1 master policy

class VOICE sequence 10
  path-last-resort ISP1
  class type: Dscp Based
    match dscp ef policy custom
      priority 1 one-way-delay threshold 200 msec
      Number of Traffic classes using this policy: 2

Configuration Examples for PfRv3 Zero SLA Support

Example: Configuring PfRv3 Zero SLA Support

Let us consider a use case scenario, where the service provider of a large enterprise network wants to reduce the probing frequency on all its channels. To reduce probing, Zero-SLA is configured on the ISP link from BR1.

Note

In the following example, only the hub master controller, BR1 (border router 1), R10 and R11 (branch border router) configurations are described.

Figure 2. PfRv3 Topology
In this example, the following routers are used:

  • Hub Master Controller — Cisco ASR 1002-X router configured with an embedded services processor (ESP) default bandwidth of 5 Gbps upgradable with software licensing options to 10 Gbps, 20 Gbps, and 36 Gbps.

  • Hub Border Routers — Cisco ASR 1000 Series Embedded Services Processor 2

  • Branch Routers — Cisco 4451X Integrated Services Router.

Configure the interfaces on hub master controller 

HubMC> enable
HubMC# configure terminal
HubMC(config)# interface Loopback0
HubMC(config-if)# ip address 10.8.3.3 255.255.255.255
HubMC(config-if)# exit
Configure the device as hub-master controller 
HubMC(config)# domain one
HubMC(config-domain)# vrf default
HubMC(config-domain-vrf)# master hub
HubMC(config-domain-vrf-mc)# source-interface Loopback0
HubMC(config-domain-vrf-mc)# enterprise-prefix prefix-list ENTERPRISE
HubMC(config-domain-vrf-mc)# site-prefixes prefix-list DATA_CENTER_1
HubMC(config-domain-vrf-mc)# exit
Configure IP prefix-lists 
HubMC(config)# ip prefix-list DATA_CENTER_1 seq 5 permit 10.8.0.0/16 le 24
HubMC(config)# ip prefix-list ENTERPRISE seq 5 permit 10.0.0.0/8 le 24
Configure domain policies on hub master controller 
HubMC(config)# domain one
HubMC(config-domain)# vrf default
HubMC(config-domain-vrf)# master hub
HubMC(config-domain-vrf-mc)# monitor-interval 2 dscp ef
HubMC(config-domain-vrf-mc)# load-balance
HubMC(config-domain-vrf-mc)# class VOICE sequence 10
HubMC(config-domain-vrf-mc-class)# match dscp ef policy voice
HubMC(config-domain-vrf-mc-class)# path-preference MPLS fallback INET
HubMC(config-domain-vrf-mc-class)# exit
HubMC(config-domain-vrf-mc)# class VIDEO sequence 20
HubMC(config-domain-vrf-mc-class)# match dscp af41 policy real-time-video
HubMC(config-domain-vrf-mc-class)# match dscp cs4 policy real-time-video
HubMC(config-domain-vrf-mc-class)# path-preference INET fallback MPLS
HubMC(config-domain-vrf-mc-class)# exit
HubMC(config-domain-vrf-mc)# class CRITICAL sequence 30
HubMC(config-domain-vrf-mc-class)# match dscp af31 policy custom
HubMC(config-domain-vrf-mc-class-type)# priority 2 loss threshold 10
HubMC(config-domain-vrf-mc-class-type)# priority 1 one-way-delay threshold 600
HubMC(config-domain-vrf-mc-class-type)# priority 2 jitter threshold 600
HubMC(config-domain-vrf-mc-class)# exit
HubMC(config-domain-vrf-mc-class)# path-preference MPLS fallback INET
Configure the interfaces on hub border router (BR1) 
BR1> enable
BR1# configure terminal
BR1(config)# interface Loopback0
BR1(config-if)# ip address 10.8.1.1 255.255.255.255
BR1(config-if)exit
Configure the device as border router (BR1) 
BR1(config)# domain one
BR1(config-domain)# vrf default
BR1(config-domain-vrf)# border
BR1(config-domain-vrf-br)# source-interface Loopback0
BR1(config-domain-vrf-br)# master 10.8.3.3
BR1(config-domain-vrf-br)# exit
Configure tunnel from BR1 to DMVPN1 (MPLS)Link 
BR1(config)# interface Tunnel100
BR1(config-if)# bandwidth 100000
BR1(config-if)# ip address 10.0.100.84 255.255.255.0
BR1(config-if)# no ip redirects
BR1(config-if)# ip mtu 1400
BR1(config-if)# ip nhrp authentication cisco
BR1(config-if)# ip nhrp map multicast dynamic
BR1(config-if)# ip nhrp network-id 1
BR1(config-if)# ip nhrp holdtime 600
BR1(config-if)# ip tcp adjust-mss 1360
BR1(config-if)# load-interval 30
BR1(config-if)# tunnel source GigabitEthernet3
BR1(config-if)# tunnel mode gre multipoint
BR1(config-if)# tunnel key 100
BR1(config-if)# tunnel protection ipsec profile DMVPN-PROFILE1
BR1(config-if)# domain one path MPLS
Configure Zero-SLA on BR1 to DMVPN1 (MPLS)Link 
BR1(config-if)# domain one path MPLS zero-sla
Configure the interfaces (R10) 
R10> enable
R10# configure terminal
R10(config)# interface Loopback0
R10(config-if)# ip address 10.2.10.10 255.255.255.255
R10(config-if)exit
Configure the device as branch master controller (R10) 
R10(config)# domain one
R10(config-domain)# vrf default
R10(config-domain-vrf)# border
R10(config-domain-vrf-br)# source-interface Loopback0
R10(config-domain-vrf-br)# master local
R10(config-domain-vrf-br)# exit
R10(config-domain-vrf)# master branch
R10(config-domain-vrf-mc)# source-interface Loopback0
R10(config-domain-vrf-mc)# hub 10.8.3.3
Configure the tunnel interface and tunnel path from R10 
R10(config)# interface Tunnel100
R10(config-if)# bandwidth 100000
R10(config-if)# ip address 10.0.100.10 255.255.255.0
R10(config-if)# no ip redirects
R10(config-if)# ip mtu 1400
R10(config-if)# ip nhrp authentication cisco
R10(config-if)# ip nhrp map 10.0.100.84 172.16.84.4 
R10(config-if)# ip nhrp map multicast 172.16.84.4
R10(config-if)# ip nhrp network-id 1
R10(config-if)# ip nhrp holdtime 600
R10(config-if)# ip nhrp nhs 10.0.100.84
R10(config-if)# ip nhrp registration timeout 60
R10(config-if)# ip tcp adjust-mss 1360
R10(config-if)# load-interval 30
R10(config-if)# delay 1000
R10(config-if)# tunnel source GigabitEthernet2
R10(config-if)# tunnel mode gre multipoint
R10(config-if)# tunnel key 100
R10(config-if)# tunnel protection ipsec profile DMVPN-PROFILE1
R10(config-if)# domain one path MPLS
Configure another tunnel path from R10 
R10(config)# interface Tunnel200
R10(config-if)# bandwidth 50000
R10(config-if)# ip address 10.0.200.10 255.255.255.0
R10(config-if)# no ip redirects
R10(config-if)# ip mtu 1400
R10(config-if)# ip nhrp authentication cisco
R10(config-if)# ip nhrp map 10.0.200.85 172.16.85.5
R10(config-if)# ip nhrp multicast 172.16.85.5
R10(config-if)# ip nhrp network-id 2
R10(config-if)# ip nhrp holdtime 600
R10(config-if)# ip nhrp nhs 10.0.200.85
R10(config-if)# ip tcp adjust-mss 1360
R10(config-if)# load-interval 30
R10(config-if)# delay 1000
R10(config-if)# tunnel source GigabitEthernet3
R10(config-if)# tunnel mode gre multipoint
R10(config-if)# tunnel key 200
R10(config-if)# tunnel protection ipsec profile DMVPN-PROFILE2
R10(config-if)# domain one path INET
Configure the interfaces (R11) 
R11> enable
R11# configure terminal
R11(config)# interface Loopback0
R11(config-if)# ip address 10.2.11.11 255.255.255.255
R11(config-if)# exit
Configure the device as branch master controller (R11) 
R11(config)# domain one
R11(config-domain)# vrf default
R11(config-domain-vrf)# border
R11(config-domain-vrf-br)# source-interface Loopback0
R11(config-domain-vrf-br)# master local
R11(config-domain-vrf-br)# exit
R11(config-domain-vrf)# master branch
R11(config-domain-vrf-mc)# source-interface Loopback0
R11(config-domain-vrf-mc)# hub 10.8.3.3
Configure the tunnel interface and tunnel path from R11 
R11(config)# interface Tunnel100
R11(config-if)# bandwidth 100000
R11(config-if)# ip address 10.0.100.11 255.255.255.0
R11(config-if)# no ip redirects
R11(config-if)# ip mtu 1400
R11(config-if)# ip nhrp authentication cisco
R11(config-if)# ip nhrp map 10.0.100.84 172.16.84.4 
R11(config-if)# ip nhrp map multicast 172.16.84.4
R11(config-if)# ip nhrp network-id 1
R11(config-if)# ip nhrp holdtime 600
R11(config-if)# ip nhrp nhs 10.0.100.84
R11(config-if)# ip nhrp registration timeout 60
R11(config-if)# ip tcp adjust-mss 1360
R11(config-if)# load-interval 30
R11(config-if)# delay 1000
R11(config-if)# tunnel source GigabitEthernet2
R11(config-if)# tunnel mode gre multipoint
R11(config-if)# tunnel key 100
R11(config-if)# tunnel protection ipsec profile DMVPN-PROFILE1
R11(config-if)# domain one path MPLS
Configure another tunnel path from R11 
R11(config)# interface Tunnel200
R11(config-if)# bandwidth 50000
R11(config-if)# ip address 10.0.200.11 255.255.255.0
R11(config-if)# no ip redirects
R11(config-if)# ip mtu 1400
R11(config-if)# ip nhrp authentication cisco
R11(config-if)# ip nhrp map 10.0.200.85 172.16.85.5
R11(config-if)# ip nhrp multicast 172.16.85.5
R11(config-if)# ip nhrp network-id 2
R11(config-if)# ip nhrp holdtime 600
R11(config-if)# ip nhrp nhs 10.0.200.85
R11(config-if)# ip tcp adjust-mss 1360
R11(config-if)# load-interval 30
R11(config-if)# delay 1000
R11(config-if)# tunnel source GigabitEthernet3
R11(config-if)# tunnel mode gre multipoint
R11(config-if)# tunnel key 200
R11(config-if)# tunnel vrf INET2
R11(config-if)# tunnel protection ipsec profile DMVPN-PROFILE2
R11(config-if)# domain one path INET

Verifying PfRv3 Zero-SLA Configurations

To verify the PfRv3 Zero-SLA configuration, use the following show commands in any order:

  • show domain domain-name master status

  • show domain domain-name border status

  • show domain domain-name master channel

  • show domain domain-name border channel

  • show domain domain-name master site-capability