Bandwidth restriction for ftp traffic only on a an uplink port of a 3750X LAN switch?

[msamsamieh]

Hi All,

I have a requirement to restrict the available  bandwidth for ftp (Data and Control) ONLY on an 1G uplink port of a 3750X switch

(from any source to any destination) while making the remaining bandwidth available for all other traffic.

I am trying to explore the possible options to do so but so far I have reached only one possible scenario which restricts the bandwidth for

all traffic and not for ftp specifically:

Switch(config)# interface GigabitEthernet 1/0/25

Switch(config-if)# srr-queue bandwidth limit 30

But the above would interface BW on the port for all traffic to 30% of avaliable link BW.

Appreciate any suggestions that would help me out asap!

Thanks,

Moe

[Karsten Iwen]

Is it for your own FTP-server or for servers on the internet?

If it is for Servers on the internet: No way to do it on your Switch. Do it on the internet-firewall or the internet-router instead.

If it's for your own server: 

1. Set the server to a specific port-range for passive FTP
2. Configure an ACL on the switch for classifying the data- and control-traffic
3. configure a policer that drops all traffic above your limit.

or better:

Reconfigure the server(s) for bandwidth limits.

All in all, IMO the switch is the wrong device for the right job.

[zoltan.gyonyoru]

Hi Moe,

INGRESS:

for example limit traffic to 50 Mbps:

policy-map PM_FTP_LIMIT
 class CM_FTP
  police 52428800 80000 exceed-action drop

interface Gig X/Y/Z
 service-policy input PM_FTP_LIMIT
 
(Of course you need to create an ACL matching FTP and also a Class-map matching that ACL)

EGRESS:

interface Gig X/Y/Z
 srr-queue bandwidth shape 0 0 0 20

If your FTP traffic is in queue 4 it will limit it to 50 Mbps on a 1 Gig interface: (1/20)*1000=50
Make sure nothing else mapped to queue 4, or use different queue-set (2) if possible

Regards,

Zoltan

[Karsten Iwen · Accepted solution]

The policing is the easy part of the config ... More difficult is to match on FTP with the limited capabilities of the Catalyst.