交换讨论区中的主题关于思科交换机限速的问题

关于思科交换机限速的问题

CSCO11497141 — Mon, 24 Nov 2014 02:36:02 GMT

关于思科交换机限速的问题

设备型号：

WS-C3750X-24，12.2(58)SE2，C3750E-UNIVERSALK9-M）

WS-C2960S-48TS-L，12.2(55)SE7，C2960S-UNIVERSALK9-M）

描述情况：

1、C3750X-24作为外网出口，互联ISP。

2、C2960S-48TS-L上联是C3750X-24，下联是Server（Gig 1/0/15）；C2960S-48TS-L（Gig 1/0/46、Gig 1/0/47、Gig 1/0/48）与C3750X-24（Gig 2/0/17、Gig 1/0/17、Gig 1/0/18）之间做的是Trunk以及二层的Port-channel。

3、服务器的网关在C3750X-24上。

目的是：

限制服务器（61.147.x.x）的上行速度，为200M。

在C2960S-48TS-L上做配置：

access-list 1 permit 61.147.x.x

class-map match-all A

match access-group 1

policy-map A

class A

police 200000000 1000000 exceed-action drop

trust dscp

interface GigabitEthernet1/0/15

service-policy input A

2960S#show policy-mapinterface g1/0/15 input

GigabitEthernet1/0/15

Service-policy input: A

Class-map: A (match-all)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 1

Class-map: class-default (match-any)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

0 packets, 0 bytes

5 minute rate 0 bps

C2960S-A6-5#show ipaccess-lists

Standard IP access list 1

10permit 61.147.x.x

这样做没成功，2960S#show policy-map interface g1/0/15 input、show ip access-lists都没看到匹配的数据包。

或者在C3750X-24上做配置：

access-list 1 permit 61.147.x.x

class-map match-all A

match access-group 1

policy-map A

class A

police 200000000 1000000 exceed-action drop

trust dscp

interface GigabitEthernet1/0/17

service-policy input A

interface GigabitEthernet2/0/17

service-policy input A

interface GigabitEthernet1/0/18

service-policy input A

Core3750X-Stack#show policy-mapinterface g1/0/17 input

GigabitEthernet1/0/17

Service-policy input: A

Class-map: A (match-all)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 1

Class-map: class-default (match-any)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

Core3750X-Stack#showpolicy-map interface g1/0/18 input

GigabitEthernet1/0/18

Service-policy input: A

Class-map: A (match-all)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 1

Class-map: class-default (match-any)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

Core3750X-Stack#showpolicy-map interface g2/0/17 input

GigabitEthernet2/0/17

Service-policy input: A

Class-map: A (match-all)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 1

Class-map: class-default (match-any)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

Core3750X-Stack#show ipaccess-lists 1

Standard IP access list 1

10permit 61.147.x.x

这样做也没成功，3750X#show policy-map interface g1/0/17 input、show policy-map interface g1/0/18 input、show policy-map interface g2/0/17 input、

show ip access-lists也都没看到匹配的数据包。

没成功的原因：

1、是不是交换机系统版本的问题

2、是不是配置的问题

3、是不是配置的方法不对

关于思科交换机限速的问题

martinchow — Mon, 24 Nov 2014 08:16:17 GMT

Hello,
First, please make sure that you have enabled "mls qos" globally or per-port basis? Also please note that 3750/2960 implements the qos in hardware. can you collect the following commands output?
show mls qos
show mls qos inter gx/y stat
show mls qos ip gx/y
Thanks, martin

关于思科交换机限速的问题

CSCO11497141 — Mon, 24 Nov 2014 10:40:51 GMT

Hello，
Core3750X-Stack#show mls qos
QoS is enabled
QoS ip packet dscp rewrite is enabled
Core3750X-Stack#show mls qos inter g1/0/17 stat
GigabitEthernet1/0/17 (All statistics are in packets)
dscp: incoming
-------------------------------
0 - 4 : 716119613 0 8838362 1 468898
5 - 9 : 0 0 0 2 0
10 - 14 : 53 0 11 0 0
15 - 19 : 0 6357 0 0 0
20 - 24 : 0 0 0 0 6
25 - 29 : 0 0 0 0 9
30 - 34 : 0 0 0 0 4
35 - 39 : 0 0 0 0 0
40 - 44 : 1 0 0 0 0
45 - 49 : 0 5 0 47197 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
dscp: outgoing
-------------------------------
0 - 4 : 2051527611 3357628 369694 3799 57839
5 - 9 : 152421 3873 782578 265398 380031
10 - 14 : 2025753 28 129 0 2263577
15 - 19 : 351 145577 0 503558 8
20 - 24 : 134615 0 0 0 11
25 - 29 : 0 1875 0 241667 9766
30 - 34 : 1 0 972291 98 517485
35 - 39 : 0 234664 69 297890 0
40 - 44 : 30092 0 0 0 4
45 - 49 : 0 2902785 0 1326369 0
50 - 54 : 0 87 0 5059 0
55 - 59 : 0 2469 0 0 527
60 - 64 : 31 0 0 160
cos: incoming
-------------------------------

0 - 4 : 1278253059 7 76 0 27
5 - 7 : 2 45469 1358
cos: outgoing
-------------------------------
0 - 4 : 2023944426 67 555 44 639
5 - 7 : 715 62 42708948
output queues enqueued:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 2 0 0
queue 1: 1763172871 5335058 54771133
queue 2: 0 0 0
queue 3: 0 0 243376537
output queues dropped:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 0 0 0
queue 1: 42356 3 0
queue 2: 0 0 0
queue 3: 0 0 0
Policer: Inprofile: 0 OutofProfile: 0
Core3750X-Stack#show mls qos inter g1/0/18 stat
GigabitEthernet1/0/18 (All statistics are in packets)
dscp: incoming
-------------------------------
0 - 4 : 458923644 106 386599338 87 2329459
5 - 9 : 0 0 0 0 0
10 - 14 : 8 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 18
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 0 0 3540 18
50 - 54 : 53 1 0 0 1
55 - 59 : 5 0 0 0 0
60 - 64 : 0 0 0 0
dscp: outgoing
-------------------------------
0 - 4 : 144933053 0 70977 160 8
5 - 9 : 0 0 5321 10022 0
10 - 14 : 20396 679 4434 0 0
15 - 19 : 0 38212 0 0 0
20 - 24 : 2198 0 0 0 511
25 - 29 : 0 1543 0 1367 13208
30 - 34 : 0 0 14924 0 5366
35 - 39 : 0 8 0 0 0
40 - 44 : 5788 0 0 0 0
45 - 49 : 0 2064 0 45205 0
50 - 54 : 0 0 0 102 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
cos: incoming
-------------------------------

0 - 4 : 1642561755 0 2 1 4
5 - 7 : 0 0 19
cos: outgoing
-------------------------------
0 - 4 : 1757977273 19 244 63 185
5 - 7 : 38 42622 42577379
output queues enqueued:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 2 0 0
queue 1: 1216570646 9045314 42801234
queue 2: 0 0 0
queue 3: 0 0 532180745
output queues dropped:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 0 0 0
queue 1: 10070 4 0
queue 2: 0 0 0
queue 3: 0 0 0
Policer: Inprofile: 0 OutofProfile: 0
Core3750X-Stack#show mls qos inter g2/0/17 stat
GigabitEthernet2/0/17 (All statistics are in packets)
dscp: incoming
-------------------------------
0 - 4 : 805176082 0 1632555 0 1634655
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 0 0 0 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
dscp: outgoing
-------------------------------
0 - 4 : 458470313 127040 325082 840 408
5 - 9 : 12890 0 215149 1463432 0
10 - 14 : 999416 0 239151 0 17
15 - 19 : 0 37184 0 387 0
20 - 24 : 466 0 0 0 62498
25 - 29 : 0 242 5 24188 0
30 - 34 : 5 0 1190108 0 393786
35 - 39 : 0 5 0 5 0
40 - 44 : 386733 0 0 0 0
45 - 49 : 0 15092 0 20867 0
50 - 54 : 6 0 4 0 0
55 - 59 : 0 20252 0 5 0
60 - 64 : 0 0 0 10892
cos: incoming
-------------------------------

0 - 4 : 751363873 14 270 0 261
5 - 7 : 2 0 411
cos: outgoing
-------------------------------
0 - 4 : 1430504693 52 91 1 116
5 - 7 : 33 274 1006734
output queues enqueued:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 2 0 0
queue 1: 2363487014 5241098 1039976
queue 2: 0 0 0
queue 3: 0 0 3356834911
output queues dropped:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 0 0 0
queue 1: 14719 0 0
queue 2: 0 0 0
queue 3: 0 0 0
Policer: Inprofile: 0 OutofProfile: 0
Core3750X-Stack#show mls qos interface g1/0/17
GigabitEthernet1/0/17
trust state: not trusted
trust mode: not trusted
trust enabled flag: ena
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none
qos mode: port-based
Core3750X-Stack#show mls qos interface g1/0/18
GigabitEthernet1/0/18
trust state: not trusted
trust mode: not trusted
trust enabled flag: ena
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none
qos mode: port-based
Core3750X-Stack#show mls qos interface g2/0/17
GigabitEthernet2/0/17
trust state: not trusted
trust mode: not trusted
trust enabled flag: ena
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none
qos mode: port-based
C2960S#show mls qos
QoS is enabled
QoS ip packet dscp rewrite is enabled
C2960S#show mls qos inter g1/0/15 stat
GigabitEthernet1/0/15 (All statistics are in packets)
dscp: incoming
-------------------------------
0 - 4 : 1288551097 0 4491589 0 301892
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 0 0 3189 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
dscp: outgoing
-------------------------------
0 - 4 : 3816037204 0 0 0 0
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 0 0 0 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
cos: incoming
-------------------------------
0 - 4 : 1293348019 0 0 0 0
5 - 7 : 0 0 0
cos: outgoing
-------------------------------
0 - 4 : 1741107322 1 0 0 1
5 - 7 : 0 0 3121945
output queues enqueued:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 0 0 0
queue 1: 356014728 16075 3122790
queue 2: 0 0 0
queue 3: 0 0 1385092590
output queues dropped:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 0 0 0
queue 1: 0 0 0
queue 2: 0 0 0
queue 3: 0 0 0
Policer: Inprofile: 0 OutofProfile: 0
C2960S#show mls qos inter g1/0/15
GigabitEthernet1/0/15
trust state: not trusted
trust mode: not trusted
trust enabled flag: ena
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none
qos mode: port-based
Thanks, bruce

关于思科交换机限速的问题

martinchow — Mon, 24 Nov 2014 16:51:39 GMT

Hi Bruce,
thanks. we can see the qos is enabled on both devices and the qos mode is port-based. from the "qos stats" output, i didn't see any non-zero counters hit the profile even inprofile. it means your classification was failure and there is no any packets match your acl. please check if your acl configuration is correct.
// Policer: Inprofile: 0 OutofProfile: 0 <<<<< inprofile: confirm outofprofile: exceed
Thanks, martin

关于思科交换机限速的问题

CSCO11497141 — Tue, 25 Nov 2014 02:01:40 GMT

martinchow 发表于 2014-11-25 00:51
Hi Bruce,
thanks. we can see the qos is enabled on both devices and the qos mode is port-based. f ...

Hi Martin,
thanks. I was configuration the C3750X and C2960S acl is
access-list 1 permit 61.147.X.X

关于思科交换机限速的问题

martinchow — Mon, 24 Nov 2014 02:36:03 GMT

Hi Bruce,
acl is done by hardware on 2k/3k and that's why you didn't see any matched packets in the output of "show ip access-list". but if you add the "log" keyword in the ACE and it could cause packet punted to cpu then you can see matched packet counters from the output of "show ip access-list". just like you know, if the packet is huge, it may cause cpu high as well.
please confirm the acl you write is correct and can match the packet from server. does any abnormal log seen when apply this acl?
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swacl.html
Thanks, martin

关于思科交换机限速的问题

CSCO11497141 — Tue, 25 Nov 2014 09:26:44 GMT

martinchow 发表于 2014-11-25 16:33
Hi Bruce,
acl is done by hardware on 2k/3k and that's why you didn't see any matched packets in ...

Hi, Martin
I delete the acl、class-map、police-map(configuration QOS) in 2960S
configuration QOS in 3750X,
C3750X:
mls qos
access-list 106 permit ip host 61.147.X.X any
class-map match-all A
match access-group 1
policy-map A
class A
police 200000000 1000000 exceed-action drop
trust dscp
interface GigabitEthernet1/0/17
service-policy input A
interface GigabitEthernet2/0/17
service-policy input A
interface GigabitEthernet1/0/18
service-policy input A
Core3750X-Stack#show ip access-lists 106
Extended IP access list 106
10 permit ip host 61.147.x.x any
show ip access-list are no match packet , I don't know how to confuiguration,can you help me?
Thanks, bruce.

关于思科交换机限速的问题

martinchow — Tue, 25 Nov 2014 11:44:12 GMT

Hi bruce,
Maybe it's a typo issue?
class-map match-all A
match access-group 1 <<<<<
Thanks, martin

关于思科交换机限速的问题

lihuadingcisco — Mon, 22 Dec 2014 01:39:29 GMT

access-list 1 permit 61.147.x.x 0.0.0.0 把反掩码加上试试

关于思科交换机限速的问题

CSCO11497141 — Wed, 24 Dec 2014 01:29:36 GMT

lihuadingcisco 发表于 2014-12-22 09:39
access-list 1 permit 61.147.x.x 0.0.0.0 把反掩码加上试试

反掩码已经已加，现在抓了整个网段

关于思科交换机限速的问题

blgao — Wed, 24 Dec 2014 10:19:51 GMT

CSCO11497141 发表于 2014-12-24 09:29
反掩码已经已加，现在抓了整个网段

DSBU的MQC是看不到匹配的counter的

关于思科交换机限速的问题

blgao — Wed, 24 Dec 2014 10:20:47 GMT

CSCO11497141 发表于 2014-12-24 09:29
反掩码已经已加，现在抓了整个网段

show policy-map [policy-map-name [class class-map-name]]
Display QoS policy maps, which define classification criteria for incoming traffic.
Note Do not use the show policy-map interface privileged EXEC command to display classification information for incoming traffic. The control-plane and interface keywords are not supported, and the statistics shown in the display should be ignored.

关于思科交换机限速的问题

Yanli Sun — Tue, 17 Mar 2015 08:05:53 GMT

您好，不知您的问题是否已经得到满意答复，如果是请您选择“已解决”，感谢您的支持~~~

关于思科交换机限速的问题

CSCO11497141 — Wed, 19 Aug 2015 03:00:15 GMT

CSC_小M 发表于 2015-3-17 16:05
您好，不知您的问题是否已经得到满意答复，如果是请您选择“已解决”，感谢您的支持~~~

没有解决，发了case，也没解决

关于思科交换机限速的问题

ellisbao — Mon, 24 Aug 2015 01:40:05 GMT

CSCO11497141 发表于 2014-12-24 09:29
反掩码已经已加，现在抓了整个网段

加了反掩码就可以了？

关于思科交换机限速的问题

Xin Lei — Mon, 24 Aug 2015 02:22:18 GMT

我是来学习学习的;P

交换讨论区中的主题 关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

关于思科交换机限速的问题

交换讨论区中的主题关于思科交换机限速的问题