topic LLQ Help required in Network Security

LLQ Help required

wasiimcisco — Fri, 21 Feb 2020 10:02:25 GMT

I want to configure LLQ on my Router which has 2 FE interface.

I want only application always gets min 5990 Bandwidth in either case.

and one user get 8 kbps.

I configure the router with below mention command but still not able to get the desired result. both users are able to get bandwidth in MB and no LLQ is working.

version 12.4

class-map match-all testclass2

match access-group 160

class-map match-all testclass

match access-group 150

policy-map testpolicy

class testclass

priority 8

class testclass2

priority 74990

interface FastEthernet0/0

bandwidth 8000

ip address 10.1.3.1 255.255.255.0

ip nat outside

ip virtual-reassembly

load-interval 30

duplex auto

speed auto

interface FastEthernet0/1

ip address 10.1.4.1 255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

ip classless

ip route 0.0.0.0 0.0.0.0 10.1.3.2

ip nat inside source list 100 interface FastEthernet0/0 overload

access-list 150 permit ip host 10.1.4.3 any

access-list 160 permit ip host 10.1.4.5 any

Router-C#show policy-map interface fastEthernet 0/0

FastEthernet0/0

Service-policy output: testpolicy

Class-map: testclass (match-all)

91678 packets, 5680284 bytes

30 second offered rate 698000 bps, drop rate 0 bps

Match: access-group 150

Queueing

Strict Priority

Output Queue: Conversation 264

Bandwidth 8 (kbps) Burst 200 (Bytes)

(pkts matched/bytes matched) 9/612

(total drops/bytes drops) 0/0

Class-map: testclass2 (match-all)

144133 packets, 8696430 bytes

30 second offered rate 898000 bps, drop rate 0 bps

Match: access-group 160

Queueing

Strict Priority

Output Queue: Conversation 264

Bandwidth 5990 (kbps) Burst 149750 (Bytes)

(pkts matched/bytes matched) 22/1251

(total drops/bytes drops) 0/0

Class-map: class-default (match-any)

27 packets, 2235 bytes

30 second offered rate 0 bps, drop rate 0 bps

Re: LLQ Help required

abdul ilyas — Thu, 29 May 2008 22:26:33 GMT

I think you didnot apply the created policy to interface fa0/0 using command service-policy.

interface FastEthernet0/0

bandwidth 8000

ip address 10.1.3.1 255.255.255.0

ip nat outside

ip virtual-reassembly

load-interval 30

duplex auto

speed auto

service-policy output testpolicy

Re: LLQ Help required

wasiimcisco — Thu, 29 May 2008 22:34:32 GMT

Kindly see the updated configuration, but still the result is same.

Router-C#sh run

Building configuration...

*May 29 15:25:44.768: %SYS-5-CONFIG_I: Configured from console by console

Current configuration : 1247 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname Router-C

boot-start-marker

boot-end-marker

no aaa new-model

resource policy

ip subnet-zero

ip cef

no ip dhcp use vrf connected

ip dhcp pool users

network 10.1.4.0 255.255.255.0

default-router 10.1.4.1

voice-card 0

no dspfarm

class-map match-all testclass2

match access-group 160

class-map match-all testclass

match access-group 150

policy-map testpolicy

class testclass

priority 8

class testclass2

priority 5990

class class-default

fair-queue

interface FastEthernet0/0

ip address 10.1.3.1 255.255.255.0

duplex auto

speed auto

service-policy output testpolicy

interface FastEthernet0/1

ip address 10.1.4.1 255.255.255.0

duplex auto

speed auto

ip classless

ip route 0.0.0.0 0.0.0.0 10.1.3.2

ip http server

no ip http secure-server

ip nat inside source list 100 interface FastEthernet0/0 overload

access-list 150 permit ip host 10.1.4.3 any

access-list 160 permit ip host 10.1.4.5 any

control-plane

line con 0

line aux 0

line vty 0 4

scheduler allocate 20000 1000

end

Router-C#

Router-C#sh run

Building configuration...

Current configuration : 1247 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname Router-C

boot-start-marker

boot-end-marker

no aaa new-model

resource policy

ip subnet-zero

ip cef

no ip dhcp use vrf connected

ip dhcp pool users

network 10.1.4.0 255.255.255.0

default-router 10.1.4.1

voice-card 0

no dspfarm

class-map match-all testclass2

match access-group 160

class-map match-all testclass

match access-group 150

policy-map testpolicy

class testclass

priority 8

class testclass2

priority 5990

class class-default

fair-queue

interface FastEthernet0/0

ip address 10.1.3.1 255.255.255.0

duplex auto

speed auto

service-policy output testpolicy

interface FastEthernet0/1

ip address 10.1.4.1 255.255.255.0

duplex auto

speed auto

ip classless

ip route 0.0.0.0 0.0.0.0 10.1.3.2

ip http server

no ip http secure-server

ip nat inside source list 100 interface FastEthernet0/0 overload

access-list 150 permit ip host 10.1.4.3 any

access-list 160 permit ip host 10.1.4.5 any

control-plane

line con 0

line aux 0

line vty 0 4

scheduler allocate 20000 1000

Re: LLQ Help required

abdul ilyas — Thu, 29 May 2008 22:53:14 GMT

Can you please post the outputs of following commands.

Router-C#show policy-map interface fa0/0

Router-C#show interface fa0/0

Re: LLQ Help required

wasiimcisco — Fri, 30 May 2008 08:13:13 GMT

Please see the the output for following commands

Router-C#sh interfaces fastEthernet 0/0

FastEthernet0/0 is up, line protocol is up

Hardware is MV96340 Ethernet, address is 001d.a16c.9b70 (bia 001d.a16c.9b70)

Internet address is 10.1.3.1/24

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 100Mb/s, 100BaseTX/FX

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:14, output 00:00:02, output hang never

Last clearing of "show interface" counters 20:47:27

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 7

Queueing strategy: Class-based queueing

Output queue: 0/1000/64/7 (size/max total/threshold/drops)

Conversations 0/2/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 69002 kilobits/sec

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 0 bits/sec, 0 packets/sec

1568797 packets input, 2304073751 bytes

Received 4249 broadcasts, 0 runts, 0 giants, 0 throttles

1 input errors, 1 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog

0 input packets with dribble condition detected

831886 packets output, 50801301 bytes, 0 underruns

0 output errors, 0 collisions, 2 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

Router-C#sh poli

Router-C#sh policy-map

Router-C#sh policy-map testpolicy

Policy Map testpolicy

Class testclass

Strict Priority

Bandwidth 8 (kbps) Burst 200 (Bytes)

Class testclass2

Strict Priority

Bandwidth 5990 (kbps) Burst 149750 (Bytes)

Class class-default

Flow based Fair Queueing

Bandwidth 0 (kbps) Max Threshold 64 (packets)

Router-C#sh poli

Router-C#sh policy-map

Router-C#sh policy-map inter

Router-C#sh policy-map interface g

Router-C#sh policy-map interface fa

Router-C#sh policy-map interface fastEthernet 0/0

FastEthernet0/0

Service-policy output: testpolicy

Class-map: testclass (match-all)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 150

Queueing

Strict Priority

Output Queue: Conversation 264

Bandwidth 8 (kbps) Burst 200 (Bytes)

(pkts matched/bytes matched) 0/0

(total drops/bytes drops) 0/0

Class-map: testclass2 (match-all)

161446 packets, 9746137 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 160

Queueing

Strict Priority

Output Queue: Conversation 264

Bandwidth 5990 (kbps) Burst 149750 (Bytes)

(pkts matched/bytes matched) 4/216

(total drops/bytes drops) 0/0

Class-map: class-default (match-any)

7562 packets, 773379 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

Queueing

Flow Based Fair Queueing

Maximum Number of Hashed Queues 256

(total queued/total drops/no-buffer drops) 0/0/0

Re: LLQ Help required

wasiimcisco — Fri, 30 May 2008 13:28:51 GMT

any update ???

Re: LLQ Help required

andrew.prince — Wed, 04 Jun 2008 11:55:26 GMT

Is this still an issue?

if so you are performing LLQ on an FE interface. LLQ will work when the interface is congested. The FW is not congested - and adding a bandwidth statement will NOT change the interface speed which will still be 100mbs.

What you need to do is not congestion management - you need to police and traffic shape!