Re: Police Does not work on Cat3550

kfarrington · ‎10-22-2003

Can anyone tell me why this configuration does not work?

All I am trying to do is rate-limit traffic on a port (any traffic)

I can do it using storm control, but i dont want to use this as it has drawbacks.

mls qos

!

class-map match-all port13

match any

!

policy-map POLICE

class port13

police 35000000 8000 exceed-action drop

!

interface FastEthernet0/13

switchport access vlan 21

no ip address

load-interval 30

service-policy history

service-policy input POLICE

!

Cat1_3550#sh policy-map int fa0/13

service-policy input: POLICE

class-map: port13 (match-all)

0 packets, 0 bytes

30 second offered rate 0 bps, drop rate 0 bps

match: any qm_police_inform_feature: CLASS_SHOW

class-map: class-default (match-any)

0 packets, 0 bytes

30 second offered rate 0 bps, drop rate 0 bps

match: any

0 packets, 0 bytes

30 second rate 0 bps

Cat1_3550#

many thx indeed,

Ken

danhut · ‎10-22-2003

Ken,

Your class-map has to specify whether the switch should match IP or non-IP traffic. So presuming you want to police IP traffic you would do something like:

class-map match-all port13

match access-group name All-IP

!

ip access-list standard All-IP

permit any

If it is non-IP traffic you would use a MAC access-list instead.

If you want to match both IP and non-IP then you would define a class-map for each; and then use the same aggregate policer within each class in the policy map eg.

mls qos aggregate-policer All-35Meg 35000000 8000 exceed-action drop

!

policy-map 123

class-map IP

police aggregate All-35Meg

class-map non-IP

police aggregate All-35Meg

kfarrington · ‎10-22-2003

Here is my simple config, it simple does not work?

mls qos

!

class-map match-all port13-ip

match access-group name all-ip

!

policy-map POLICE

class port13-ip

police 3496000 80000 exceed-action drop

!

interface FastEthernet0/7

switchport access vlan 21

no ip address

load-interval 30

service-policy input POLICE

!

ip access-list standard all-ip

permit any

!

Now I start a 5 meg stream from a laptop (have now moved the port onto a different switch just to make sure its not the switch)

Cat2_3550#sh int fa 0/7

FastEthernet0/7 is up, line protocol is up (connected)

Hardware is Fast Ethernet, address is 000c.858f.0087 (bia 000c.858f.0087)

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 13/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 100Mb/s

input flow-control is off, output flow-control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input never, output 00:00:00, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

30 second input rate 5164000 bits/sec, 494 packets/sec

30 second ouxtput rate 0 bits/sec, 0 packets/sec

226764 packets input, 292030334 bytes, 0 no buffer

Received 304 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 20 multicast, 0 pause input

0 input packets with dribble condition detected

1331 packets output, 100425 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

Cat2_3550#

Bizarre?

kfarrington · ‎10-23-2003

Also, below is the version of IOS.

The reason I am so stressed about this is my lab date is next week, and know my luck, i will get asked this BUT i will NOT use it unless I can get it working?

PLEASE COULD ANYONE ELSE WHO HAS TRIED AND DOCUMENTED THIS, PLEASE POST THEIR RESULTS. PPPPLEASE!!!!!!

Cat2_3550# sh hard

Cisco Internetwork Operating System Software

IOS (tm) C3550 Software (C3550-I5Q3L2-M), Version 12.1(13)EA1a, RELEASE SOFTWARE

(fc1)

Compiled Tue 25-Mar-03 23:42 by yenanh

Image text-base: 0x00003000, data-base: 0x007C34B0

ROM: Bootstrap program is C3550 boot loader

Cat2_3550 uptime is 59 minutes

System returned to ROM by power-on

System image file is "flash:c3550-i5q3l2-mz.121-13.EA1a.bin"

cisco WS-C3550-24 (PowerPC) processor (revision H0) with 65526K/8192K bytes of m

emory.

Processor board ID CAT0714X0H9

Last reset from warm-reset

Bridging software.

Running Layer2/3 Switching Image

Ethernet-controller 1 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 2 has 12 Fast Ethernet/IEEE 802.3 interfaces

Ethernet-controller 3 has 1 Gigabit Ethernet/IEEE 802.3 interface

Ethernet-controller 4 has 1 Gigabit Ethernet/IEEE 802.3 interface

24 FastEthernet/IEEE 802.3 interface(s)

2 Gigabit Ethernet/IEEE 802.3 interface(s)

The password-recovery mechanism is enabled.

384K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address: 00:0C:85:8F:00:80

Motherboard assembly number: 73-5700-10

Power supply part number: 34-0966-02

Motherboard serial number: CAT071302WE

Power supply serial number: LIT0704001M

Model revision number: H0

Motherboard revision number: A0

Model number: WS-C3550-24-SMI

System serial number: CAT0714X0H9

Configuration register is 0x10F

Cat2_3550#

mark.edwards · ‎10-24-2003

it's clear from your config that the class-map is not matching traffic. As the policy-map is attached to a switch port, have you tried basing the class map on mac-address ACL or COS bit ?

rjackson · ‎10-24-2003

No expert here, but isnt there a numeric parameter missing. Doc doesn't indicate that its optional

police bps burst-normal burst-max

looks like the police statement isnt being used. I get this showing the polce parameters

r4#sh policy-map int e0

Ethernet0

Service-policy input: test2

Class-map: test (match-all)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group 1

police:

8000 bps, 1000 limit, 1000 extended limit

conformed 0 packets, 0 bytes; action: transmit

exceeded 0 packets, 0 bytes; action: drop

conformed 0 bps, exceed 0 bps violate 0 bps

Class-map: class-default (match-any)

0 packets, 0 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: any

kfarrington · ‎10-25-2003

it was on a cat3550 and just check, the max burst is on a router, but not a switch.

i am getting so confused, :)