What is the order of operations in conflicting nested policy-maps?

[dustinskyes]

Hello!  I have inherited a network that had grown in the past without QoS ever being updated or properly managed.  I am redoing our

policy-maps

and found that child policies reserve a minimum bandwidth greater than the parent policy's shaper.  I think the config will explain this best.  My question is this-- will the shaper even apply to these classes?  What I am observing on the interfaces with the outbound policy leads me to believe that the shaper is superseded by the bandwidth reservation.

interface GigabitEthernet0/0/1
  description ELAN FACING INTERFACE
  bandwidth 200000
  ip address dhcp
  service-policy output OUTBOUND_WAN
!
!
policy-map CHILD
  class Video
    bandwidth percent 50
policy-map OUTBOUND_WAN
  class SOME_GENERAL_SITE
    shape average 19400000
      service-policy CHILD
  class class-default
    fair-queue
    set dscp default
!
!

If I send egress traffic that matches both the Video class and the SOME_GENERAL_SITE class and I try to do so at 200mbps, will it get shaped to 19.4mbps or will it run at 200mbps?  What I am seeing in real life is that none of the traffic (including traffic that does not match the Video class but does match the SOME_GENERAL_SITE class) is getting shaped to 19.4mbps and frequently overruns my circuit bandwidth.  I am using an ISR4321 running IOS XE 16.12.03.

[Joseph W. Doherty · Accepted solution]

I would expect any traffic in your SOME_GENERAL_SITE class should be shaped to 19.4 Mbps, and if I understand correctly what you've described, that's what's happening.

BTW the bandwidth statement, on your g0/0/1 does not, itself, restrict interface bandwidth usage.

Also BTW, bandwidth statementd in

 policy maps 

, generally, doesn't restrict bandwidth usage either.  They only set a "floor", but, technically, it's not "reserved", it's "guaranteed".  (Usually reserved means bandwidth always set aside, i.e. cannot be used except by the traffic it's allocated for.)  Also, with CBWFQ, bandwidth guarantees are really based on dequeuing ratios.  (I.e. two classes allocated 50% or 1%, share available bandwidth equally, or in a 1:1 ratio.)

Since only your parent policy has a shaper, traffic in

OUTBOUND_WAN's class-default 

can use all available bandwidth on the interface.  If you have a "logical" circuit limit of 20 Mbps, you would want something more like:

policy-map CHILD
class Video
bandwidth percent 50
class class-default
fair-queue
set dscp default
policy-map OUTBOUND_WAN
class class-default
shape average 19400000
service-policy CHILD

[Joseph W. Doherty]

BTW, sorry, I normally suggest defining bandwidth percentages for all classes.

So, something more like:

policy-map CHILD
class Video
bandwidth percent 50
class class-default
bandwidth percent 50
fair-queue
set dscp default
policy-map OUTBOUND_WAN
class class-default
shape average 19400000
service-policy CHILD

[dustinskyes]

Thank you Joseph!

I am redoing our bandwidth profiles and am using percentages as you suggest because I think it will make it easier to scale circuit size in the future without having to redo all of the

policy-maps

.  I do have one router which multiplexes on one interface at layer 3 instead of layer 2 which is where I found the conflicting bandwidth settings and shaping settings.  This interface is where I will use bits instead of percentages just because of the topology.  I am now running into an access list matching issue but I think that should be saved for another post if I cannot figure it out with research.