Best option to throttle particular subnet/source traffic?

[CiscoBrownBelt]

So if you want to reduce how much bandwidth can be used from certain hosts/subnets destined to one particular subnet, it would be best configure Layer 3 QOS correct?

If let's say VRFs on a L2/3 switch are used for just the particular source subnets, destination traffic is just pointing to a layer 3 connection IP or tunnel, best place would be to implement QOS on that corresponding source VRF or actual interface the traffic enters (police or shape, single rate, etc.)?

[balaji.bandi · Accepted solution]

yes that is the best option - not sure what is the model here and IOs running :

example :

access-list 100 permit ip any 10.10.10.0 0.0.0.255
access-list 100 permit ip 10.10.10.0 0.0.0.255 any
!
class-map my-ratelimit
match access-group 100
!
policy-map my-map
!
class-map my-ratelimit
police 2000000
!
int Gi0/0
service-policy input my-map
service-policy output my-map

[CiscoBrownBelt]

Awsome thanks!

So yes routing would be handled on a Cat6500. The source traffic that needs to be throttled comes in from the WAN through a switchport (in vlan X let' say) and so must go the L3 VRF interface to route to anything. I would apply the policy to that interface correct? Would that be best? Basically want to limit this traffic but only when it wants to reach a particular destination which is sent back out into the WAN via another interface.

[Joseph W. Doherty]

Answer depends on exactly what you want to accomplish and what the device supports.

In general, I prefer using L3 QoS as it's often has more features than L2 QoS.

For throttling traffic, as you note, you might police or shape, the latter feature often not as available as the former.  Of the two, when available, I often prefer shaping, but there are situations where policing could be a better choice.  Shaping, IMO, isn't as easy to misconfigure as policing.

[CiscoBrownBelt]

Awsome thanks!

As I just posted above,

So routing is handled at a Cat6500. The source traffic that needs to be throttled comes in from the WAN through a switchport (in vlan X let' say) and so must go the L3 VRF interface to route to anything. I would apply the policy to that interface correct? Would that be best? Basically want to limit this traffic but only when it wants to reach a particular destination which is sent back out into the WAN via another interface.

[Joseph W. Doherty · Accepted solution]

BTW, on a 6500 you might have the option of microflow policing, i.e. policing of individual flows.

Also BTW, don't recall 6500s offering shaping, except on their FlexWAN cards.

Anyway, you could enable an ingress policer on your 6500's WAN ingress port, and if you define it via a policy, you can be selective on what particular traffic you want it to police.

[CiscoBrownBelt]

So if that particular traffic I would want to throttle and/or Police (yea don't believe I can do shaping) comes in on a layer 2 interface, would I still want to do it there or should I do it on the Layer 3 VRF interface that is used to direct the traffic where it must go?

[Joseph W. Doherty · Accepted solution]

On a 6500, you can apply (I recall) an ingress policy on a L2 or L3 interface, shouldn't matter.  Also, policy can look at L3 info even if L2 port.

[CiscoBrownBelt]

That should be same for 4500 series Cat as well correct? If you want to let's say only allow 50% interface bandwidth utilization, best way would be to configure parameter to allow 500Mb (if let's say applying to 1Gb interface) correct?

[Joseph W. Doherty]

I believe so, i.e. that you can police a 4500's port's ingress too, but no microflow policing, that I recall.

Unlike a 6500, whose QoS is dependent on the line card, on the 4500 QoS is dependent on the supervisor.

[CiscoBrownBelt]

Awesome thanks. Its usually best to put the policy on the actual interface the traffic enters on the switch and not on the VRF used to route that particular traffic?

[Joseph W. Doherty · Accepted solution]

Depends on what you're trying to accomplish.

For granularity and/or performance, applying policy as early as possible, as on ingress edge port is best.  Yet, often more maintenance involved.  Applying a policy at an aggregation point, if granularity not needed, can be easier to maintain.

[CiscoBrownBelt]

@Joseph W. Doherty what if I only want to throttle this particular traffic but only when the interface begins to get let's say 50% or more utilized? What would be the best or better way to approach this if I just don't want to let say do a "police 2000000"? I understand most switches don't support Shaping.

Also looks like if I try and use "bandwidth parameter" on my CML lab its it not supported on the L2 switch - I guess that is not supported on a CAT4500 or 6500 - see error below:

 config-pmap-c)#bandwidth percent 5
"Bandwidth command not allowed at parent level in input direction"

[Joseph W. Doherty]

On the 4500, features vary much based on supervisor.  Supervisors 7 and later, with later IOS versions, or more likely to support something like bandwidth commands.

I don't know of a way to have a policer start to police, in your question, when there's more that 50% utilization without having the policer rate limit at some preselected value beyond 50%.

[CiscoBrownBelt]

What about from a mgmt or administrative standpoint. Let's say more users/subnets want to go to same particular destination that QOS policy will be throttleing, and that destination is reachable via a Tunnel on a router connected to switch referenced here for instance. If customers enter infrastructure via different interfaces (so not particular layer 2 interface described in previous post but lets say other layer two interaces), I would have to configure QOS on all those different applicable interfaces. 

Would it be  better to create let's say SVIs or subinterfaces  for each different subnet that may need to be throttled, or even create additional tunnels to that same destination for each individual customer that must be throttled (e.g. Tunnel Customer A to Site1, another tunnel for Customer B to Site1, Customer C to Site1, etc. on the router) and then apply QOS to each subinterface?

That way maybe monitoring QOS using an application or something and all QOS changes would be made at least on same device but different SVIs or sub-interfaces.

Let me know if I sound confusing with what I am asking