Hello community,
I have an interesting case. The task is to police some bad traffic in DMVPN network. The DMVPN Hub is ASR1001-X, currently running IOS 3.16.3S.
I configured the ASR with the following steps:
1. Configure QoS for port-channels and Policy-map statistics:
platform qos port-channel-aggregate 1
platform qos match-statistics per-filter
2. Define the bad traffic with an access-list:
ip access-list extended BRANCH_QOS_ACL
remark bad_server_1
permit ip host 192.168.1.1 any
remark bad_server_2
permit ip host 192.168.1.2 any
3. Define a class-map for bad traffic:
class-map match-any BRANCH_QOS_CLASS
match access-group name BRANCH_QOS_ACL
4. Define a child policy-map with police statement:
policy-map CHILD_QOS_POLICY
class BRANCH_QOS_CLASS
police 20000000
5. Define a parent policy-map with class-default and shaper:
policy-map PARENT_QOS_TUNNEL_POLICY
class class-default
shape average 100000000
service-policy CHILD_QOS_POLICY
6. Define a shaper for the physical interface
policy-map WAN_INTERFACE_Po1_SHAPE
class class-default
shape average 2000000000
7. Apply the shaper for the physical interface:
interface Port-channel1.100
service-policy output WAN_INTERFACE_Po1_SHAPE
8. Apply the policy-map on the DMVPN Tunnel interface (tunnel source is loopback, tunnel destination is multipoint)
interface Tunnel1
nhrp group map QOS-GROUP-100MBPS service-policy output PARENT_QOS_TUNNEL_POLICY
This is the QoS related configuration on the DMVPN Hub router. When one spoke registers to the DMVPN with the group QOS-GROUP-100MBPS, everything works fine. The counters in the show policy-map multipoint output show the packets for each class of traffic.
The problem happens when i try to add the same policies on the second DMVPN interface on the router, which is routed from the second sub-interface of the Port-channel 1. Then the counters freeze and the QoS stops working. The physical interface policy-map counters are OK.
This is not counters related problem. I made test on the QoS and it doesn't work. After it hangs one time, it can't be turn on again until I restart the router.
Do anyone have some experience with such configurations?
ASR1001-X#show policy-map target
Port-channel1.100
Service-policy output: WAN_INTERFACE_Po1_SHAPE
Class-map: class-default (match-any)
825975 packets, 845474427 bytes
5 minute offered rate 13444000 bps, drop rate 0000 bps
Match: any
Queueing
queue limit 8333 packets
(queue depth/total drops/no-buffer drops) 0/0/0
(pkts output/bytes output) 700543/825312271
shape (average) cir 2000000000, bc 8000000, be 8000000
target shape rate 2000000000
Interface Tunnel1 <--> xx.xx.xx.xx
Service-policy output: PARENT_QOS_TUNNEL_POLICY
Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: any
Queueing
queue limit 8333 packets
(queue depth/total drops/no-buffer drops) 0/0/0
(pkts output/bytes output) 0/0
shape (average) cir 2000000000, bc 8000000, be 8000000
target shape rate 2000000000
Service-policy : CHILD_QOS_POLICY
Class-map: BRANCH_QOS_CLASS (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group name BRANCH_QOS_CLASS
0 packets, 0 bytes
5 minute rate 0 bps
police:
cir 20000000 bps, bc 9972 bytes
conformed 0 packets, 0 bytes; actions:
transmit
exceeded 0 packets, 0 bytes; actions:
drop
conformed 0000 bps, exceeded 0000 bps
Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: any
