topic Bandwidth throttling via QoS in Routing and SD-WAN

Bandwidth throttling via QoS

Ricky S — Tue, 05 Mar 2019 03:25:07 GMT

Hi folks, I am fairly new to the world of QoS. Although I have a basic understanding of what it is, I don't have any real experience in implementing it in production network. We have a new requirement between two of our major offices located in Chicago and Toronto where they will be replicating large amount of data between each other on a nightly basis. We checked with the vendor of the replication software/server and there is no way to throttle the bandwidth usage in software. They said this is usually done via QoS.

I'm wondering if anyone can shine some light as to how I can configure my routers in both offices to throttle the bandwidth usage for traffic between these two specific servers. Would I need to use ACLs to do the QoS?

Re: Bandwidth throttling via QoS

Bilal Nawaz — Tue, 26 Mar 2013 18:28:01 GMT

One of the quickest solutions is this, and works pretty well imho. Use ACL's to class the traffic (this can be extended ACL's I believe too) e.g. if i wanted to limit to 3mb up and down, you can do this e.g. for servers 10.0.0.1, 172.16.0.1 from and towards each other:

### To match the traffic

ip access-list extended ACL_3Mbps

permit ip host 10.0.0.1 host 172.16.0.1

permit ip host 172.16.0.1 host 10.0.0.1

### Class the traffic

class-map Link_3Mbps

match access-group ACL_3Mbps

### Apply policy against the class (type of traffic specified by your class-map)

policy-map Policy_3Mbps

class Link_3Mbps

police 3000000 8000 exceed-action drop (8000 is the burst rate)

interface gigabitethernet1/0

### Applies the policies inbound and outbound, both directions

service-policy input Policy_3Mbps

service-policy output Policy_3Mbps

Where the ACL is you can specify source and destination or just source or source and port depending on how you configure your ACL.

Hope this helps.

Link for your reference:

http://www.cisco.com/en/US/docs/ios/12_2/qos/configuration/guide/qcfpoli_ps1835_TSD_Products_Configuration_Guide_Chapter.html#wp1006389

Bandwidth throttling via QoS

Ricky S — Tue, 26 Mar 2013 18:33:17 GMT

Perfect. I will test that out and report back. Thanks Bilal. Much appreciated.

Bandwidth throttling via QoS

Ricky S — Tue, 26 Mar 2013 18:54:26 GMT

Hi Bilal, thanks once again. One question I do have is why do we need to apply the service policy both for inbound and outbound traffic? Wouldn't the outbound traffic be policed by the inbound rule on the other side?

Both offices are connecting to each other over an IPSEC tunnel. I am going to apply the service policy on the tunnel interface on each side.

Re: Bandwidth throttling via QoS

Bilal Nawaz — Tue, 26 Mar 2013 19:04:22 GMT

Hi Rick, I only stated inbound and outbound as an example. But if you have this applied outbound in both directions you should be fine.

I'm not sure about applying to the tunnel interfaces - should work since the sources will be coming from the tunnel interfaces, I've never tried that before. Let us know how it goes

Re: Bandwidth throttling via QoS

Joseph W. Doherty — Wed, 27 Mar 2013 09:20:44 GMT

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

As Bilal has shown, one option is to police or rate-limit the replication traffic.

Another technique is to use QoS to prioritize traffic. In this case, you might de-prioritize the replication traffic.

The big difference between the two techniques, policing traffic limits the replication rate even when there's available bandwidth. Further, if you increase the limit to you might be adverse to other traffic.

Depending on your replication service requirement are, sometimes even background bandwidth reservation is sufficient.

e.g.

policy-map Sample

class-map replication

bandwidth percent 1

In the above, you'll need to define how replication is matched. It might be by hosts, other packets characteristics or some combination.

Unlike policing, which can be used in or out, prioritization can only be used outbound (i.e. you configure it on both sides' egress).

Bandwidth throttling via QoS

Ricky S — Wed, 27 Mar 2013 14:13:47 GMT

Hi Joseph, thanks for the post. I will look into the QoS as it definitely sounds interesting.

Bandwidth throttling via QoS

Ricky S — Wed, 10 Apr 2013 23:40:50 GMT

Hi Bilal, I ran into a small issue as I was testing the above solution you recommended. Router doesn't have the service-policy input option. Below is what I see.

RTRCOREQ9002(config)#int tunnel 0

RTRCOREQ9002(config-if)#service-policy ?

type type of the policy-map

RTRCOREQ9002(config-if)#service-policy type ?

access-control access-control specific policy-map

RTRCOREQ9002(config-if)#service-policy type access-control input Policy_20Mbps

policy map should be of same type

Re: Bandwidth throttling via QoS

Bilal Nawaz — Thu, 11 Apr 2013 04:39:30 GMT

Hello, what router are you configuring on? I'm not so sure about the options you have here, I haven't seen them before. Could you kindly show the options you get when you do this please:

RTRCOREQ9002(config-if)#service-policy type policy-map ?

Sent from Cisco Technical Support iPhone App

Bandwidth throttling via QoS

Ricky S — Thu, 11 Apr 2013 14:33:51 GMT

Configuring it on a Cisco 2951 running 2951-universalk9-mz.SPA.151-4.M5.bin

It doesn't give me the policy-map option (see below)

RTRCOREQ9001(config-if)#service-policy type ?
access-control access-control specific policy-map

RTRCOREQ9001(config-if)#service-policy type policy-map ?
% Unrecognized command

Bandwidth throttling via QoS

Ricky S — Thu, 11 Apr 2013 14:34:48 GMT

Also note I am configuring this on a tunnel interface, if that makes any difference.

Bandwidth throttling via QoS

Bilal Nawaz — Thu, 11 Apr 2013 15:11:49 GMT

Hi Rick,

I was able to do this:

NPEVG01#show ver

Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(4)M1, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Compiled Tue 14-Jun-11 19:25 by prod_rel_team

ROM: System Bootstrap, Version 15.0(1r)M9, RELEASE SOFTWARE (fc1)

SQPNPEVG01 uptime is 8 weeks, 6 days, 23 hours, 22 minutes

System returned to ROM by reload at 15:47:53 UTC Thu Feb 7 2013

System restarted at 15:49:12 UTC Thu Feb 7 2013

System image file is "flash0:c2900-universalk9-mz.SPA.151-4.M1.bin"

Last reload type: Normal Reload

Last reload reason: Reload Command

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

NPEVG01#show run int t0

Building configuration...

Current configuration : 95 bytes

interface Tunnel0

no ip address

service-policy input TEST

service-policy output TEST

end

My config looks like this:

class-map match-all TEST

match access-group name ACL_TEST

policy-map TEST

class TEST

police cir 3000000 bc 8000

conform-action transmit

exceed-action drop

ip access-list extended ACL_TEST

permit ip any any

interface Tunnel0

no ip address

service-policy input TEST

service-policy output TEST

Let me know if this is the template you are using.

Hope this helps.

Please rate useful posts and remember to mark any solved questions as answered. Thank you.

Re:Bandwidth throttling via QoS

paul driver — Thu, 11 Apr 2013 16:13:35 GMT

Hello
Personally i would police ingress from your lan and shape on your wan interface ( only necessary when rate-limiting your wan link)

another way has joseph has suggested is to mark your server to server traffic and other traffic (acl is possible) and give them a percentage (total max off my head i think is 99%) need to have at 1% for class deafult which if isnt used would be shared between thee two defined classes you specify.

res
paul

Sent from Cisco Technical Support Android App

Re:Bandwidth throttling via QoS

Ricky S — Fri, 12 Apr 2013 03:08:04 GMT

That's interesting, same still doesn't working for me on the Tunnel interfaces. I was able to configure it on the LAN interface and that seems to be working now.

Thanks for your assistance.

Re:Bandwidth throttling via QoS

Ricky S — Fri, 12 Apr 2013 03:09:57 GMT

Paul thanks. I was able to configure it on the LAN interface and it seems to be working. Can you please let me know what you mean by "shape on your WAN interface"? I have applied the policing service-policy on the inbout traffic from the LAN side on both routers and that seems to be working. Is there anything else that I should do on the WAN interface?

Re: Re:Bandwidth throttling via QoS

Bilal Nawaz — Fri, 12 Apr 2013 05:35:44 GMT

Hello, the differences between both policing and shaping are here: http://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a00800a3a25.shtml

Class based shaping:

match access-group name ACL_TEST
!
!
policy-map TEST
class TEST
Shape average 3000000
Shape peak 4000000
!
ip access-list extended ACL_TEST
permit ip any any
!
interface Tunnel0
service-policy output TEST

The above example shows to shape traffic to ensure 3000000 kbps with a max of 4000000kbps limit and usable if the bandwidth is available.

If you want to take the option of specifying the percentage of the bandwidth to be used instead of having the shape command you can do:

policy-map TEST
class TEST
Bandwidth percent 40
Shape peak 4000000

Ensure a bandwidth of 40% but allowing throughput of 4000000 Kbps only if enough bandwidth is available

So you could take these options and applying to outbound on the tunnel interface. Although by the sounds of it, the inbound policing sounds like its working.

Obviously class the traffic as close as possible with your ACLs, unlike my 'catch anything' 🙂

It's strange that it doesn't work for you, perhaps try shaping on the tunnel interface and see if that works.

Hope this helps

http://www.cisco.com/en/US/docs/ios-xml/ios/qos/command/send_qdm_message_through_show_atm_bundle_svc_statistics.html#GUID-989CB240-829E-4075-B2AA-3A0C5E3A2CAB

Sent from Cisco Technical Support iPhone App

Re: Re:Bandwidth throttling via QoS

paul driver — Fri, 12 Apr 2013 08:21:45 GMT

Hello,

Shaping comes into play on your routers when your physical wan lines exceeds the your traffic rate by the ISP or your neighboring site- eg: your access rate is 2mb but your CIR ( committed information rate) is 1MB. or your CIR is 2mb and Toronto is 1mb.

So this means you need to send traffic 1/2 of the time to avoid egress blocking ( Chicago over time can overwhelm the link to Toronto as its CIR is lower then yours), This is where shaping can come into play to shape the link the same at both ends.

You can shape an average/peak/percent/rate/percent/percent remaining) - And all are different but shape average and Shape peak allow bursting of traffic ( Committed burst =BC & Excessive bursts=BE with a defined Time Interval = TC

Shape value = bps
Bc/Be value =bytes per second

Shaping average & peak tc/bc/values

Bc=Tc*CIR/8

Tc=Bc/Shaped rate(CIR

Be=Bc

TC= 0.125 default

TC= 0.025 for lower 320kps

TC= 0.010 for sensitive applications

Shape average ( default BC no BE)

Shape average 1024000

Shape average 1024000(bits) bc of 16000(bytes)

This would send 16K bytes every .125 of a secs = 128000 byes *8 =1024000

Shape peak

Shape peak works a bit differently as it allows both Bc& Be to be sent over the TC

Shape peak 512000 (shaping at 1024000)

Shape peak 512000 (bits) bc of 8000(bytes) Be 8000(bytes)

512000 (1+8000/8000) = 1024000

hope this helps.

res

Paul

Please don't forget to rate any posts that have been helpful.

Thanks.

Re:Bandwidth throttling via QoS

Ricky S — Sat, 13 Apr 2013 14:42:16 GMT

wow great info here guys, you have opened my eyes to a whole new world. Thank you all for that.

One quick question I do have is that I have an ACL with 6 hosts on both sides (Chicago and Toronto) that replicate data between each other. If I police the bandwidth to 20Meg and apply it on an interface, does that bandwidth get shared among the 6 hosts or does each host get 20Meg?

Re: Re:Bandwidth throttling via QoS

Bilal Nawaz — Sat, 13 Apr 2013 14:45:30 GMT

Hello, Of what I understand, it applies to everything within the ACL. So all 6 have to share 20 megs

Anything matching the class will need to conform within what you have set

Hope this helps

Sent from Cisco Technical Support iPhone App

Re: Re:Bandwidth throttling via QoS

paul driver — Sat, 13 Apr 2013 20:34:43 GMT

Hello

Whatever is matched in class-map and are defined in a policy-map that is policed will be policed at that rate.

FYI-
You can police/shape on per class or class class-default or both.
And mark/classify within these classes via acl's/protocol type/ip precedence/dscp/cos values
Then bind these together with policy-maps which can be nested if necessary or on their own

These policy-maps then can be serviced on the necessary interfaces via service input/output policies

You can also introduce congestion avoidance to prohibit something called tail drop .

I would suggest Ricky , if you would like to dive deeper into Qos then check out the cco docs on at cisco support

http://www.cisco.com/en/US/docs/ios-xml/ios/qos/config_library/12-4/qos-12-4-library.html

Res
paul

Sent from Cisco Technical Support iPad App