How to do qos configurations on CISCO 3925 Router?

[kishore]

Actually i have a isp with 100 Mbps connection. I need to assign 5 Mbps to each port on a SG300 switch connected to the router. Such that each port in the switch is assigned to different vlans ( eg: gigabit port 1 is assigned to vlan 2, g2 is assigned to vlan 3 etc).

So, how to do shaping using class & policy to set the download and upload limit. Please help me to implement the qos in CISCO 3925 Router.

[jagannath.iob]

Hi Joesph,

Hope you are doing Good!

The Qos drops issue on default has been resolved after confirming the threshold for both default and AF2 class and it is under observation for other two days.

Now we have one more QOS drops issue on Internet WAN router where we are able to see drops on Shared-Process-Reliance  class . The CIR configured is 16M and at peak level also it is not exceeding more than 5M but still we are able see the drops . can you please find the attachments and help in this.

Service-policy output: restrict-policer

    Class-map: Exchange-Srv (match-any)

      2059181 packets, 2419150929 bytes

      30 second offered rate 860000 bps, drop rate 0 bps

      Match: access-group name Exchange-Srv

        2059181 packets, 2419150929 bytes

        30 second rate 860000 bps

      police:

          cir 24000000 bps, bc 750000 bytes

        conformed 2058811 packets, 2418628579 bytes; actions:

          transmit

        exceeded 370 packets, 522350 bytes; actions:

          drop

        conformed 860000 bps, exceed 0 bps

    Class-map: Shared-Process-Bharti (match-any)

      0 packets, 0 bytes

      30 second offered rate 0 bps, drop rate 0 bps

      Match: access-group name Shared-Bharti-PAT-IP

        0 packets, 0 bytes

        30 second rate 0 bps

      police:

          cir 16000000 bps, bc 500000 bytes

        conformed 0 packets, 0 bytes; actions:

          transmit

        exceeded 0 packets, 0 bytes; actions:

          drop

        conformed 0 bps, exceed 0 bps

    Class-map: Shared-Process-Reliance (match-any)

      8625724 packets, 11165013976 bytes

      30 second offered rate 13582000 bps, drop rate 1157000 bps

      Match: access-group name Shared-Reliance-PAT-IP

        8625724 packets, 11165013976 bytes

        30 second rate 13582000 bps

      police:

          cir 16000000 bps, bc 500000 bytes

        conformed 7898604 packets, 10132291097 bytes; actions:

          transmit

        exceeded 727120 packets, 1032722879 bytes; actions:

          drop

        conformed 12426000 bps, exceed 1157000 bps

    Class-map: class-default (match-any)

      7069543 packets, 7024112858 bytes

      30 second offered rate 3092000 bps, drop rate 0 bps

      Match: any

DD3RT7004#

DD3RT7004#sh policy-map interface GigabitEthernet0/0.100 output class Shared-Process-Reliance | i offer|drop|cir

      30 second offered rate 4273000 bps, drop rate 212000 bps

          cir 16000000 bps, bc 500000 bytes

          drop

DD3RT7004#sh policy-map interface GigabitEthernet0/0.100 output class Shared-Process-Reliance | i offer|drop|cir

      30 second offered rate 4666000 bps, drop rate 295000 bps

          cir 16000000 bps, bc 500000 bytes

          drop

DD3RT7004#sh policy-map interface GigabitEthernet0/0.100 output class Shared-Process-Reliance | i offer|drop|cir

      30 second offered rate 4140000 bps, drop rate 209000 bps

          cir 16000000 bps, bc 500000 bytes

          drop

DD3RT7004#sh policy-map interface GigabitEthernet0/0.100 output class Shared-Process-Reliance | i offer|drop|cir

      30 second offered rate 3798000 bps, drop rate 147000 bps

          cir 16000000 bps, bc 500000 bytes

          drop

Thanks

[Joseph W. Doherty]

Bandwidth utilization is often computed on a multi-second to multi-minute basis.  Policers often compute utilization on a multi-millisecond basis.

I.e. policers will drop short term bursts not "visible" to longer term bandwidth utilization measurements.

Or, policer's short term measurements are often the equivalent of a small egress buffer.

The "solution" is to increase the Bc interval.

[jagannath.iob]

Hi Joseph,

Thanks for your response.

i have changed the Bc interval .

sh policy-map interface GigabitEthernet0/0.100 output class Shared-Process-Reliance | i offer|drop|cir

      30 second offered rate 3798000 bps, drop rate 147000 bps

          cir 16000000 bps, bc 500000 bytes

          drop

Now find the output after changing the BC interval. drops have been decreased for some extent . can we increase it further and check .if so any impact for other classes??

sh policy-map interface GigabitEthernet0/0.100 output class Shared-Process-Reliance | i offer|drop|cir

      30 second offered rate 2786000 bps, drop rate 32000 bps

          cir 16000000 bps, bc 1000000 bytes

          drop

Please help us on this.

Thanks

[Joseph W. Doherty]

Now find the output after changing the BC interval. drops have been decreased for some extent . can we increase it further and check .if so any impact for other classes??

You could although you should see diminishing returns.  I.e. drops percentage won't decrease as much as earlier Bc adjustments.

[kishore]

its not working.

I have created the subinterface and applied the service policy to it. During which it says cannot apply service policy in input.

When i took the cable from switch to my pc an caution symbol is only shown with no ip.

I Think there are more statements to be specified in class-map, Policy-map and in the interface.

Please help me

[Joseph W. Doherty]

It would be helpful if you would post what you've specifically tried.  There are restrictions to what statements can be used with a ingress policy.

Also you mention subinterfaces - I recall there's special considerations for those too.

[kishore]

i have done like this below:

ip dhcp pool test1

network 10.0.0.0 255.255.255.0

default-router 10.0.0.1

dns-server 8.8.8.8 4.2.2.2

ip access-list extended test2

  deny ip 192.168.0.0 0.0.0.255 10.0.0.0 0.255.255.255

   permit ip 10.0.0.0 0.255.255.255 any

class-map match-all classtest

   match access-group name test2

policy-map pd110

class classtest 

shape average 20000000

policy-map pu110

class classtest 

shape average 20000000

int gig0/1.110

encapsulation dot1q 110

ip address 10.0.0.1 255.0.0.0

service-policy input pd110             ----------------->    its not working

service-policy output pu110

The router is 3925 series

[Joseph W. Doherty]

Yup, pd110 won't work as an ingress policy because it uses a shaper which queues traffic.  However, if you change pd110's to use a policer it should accept it.

[kishore]

So What commands must be added and change it ?

[Joseph W. Doherty]

policy-map pd110
 class classtest
  shape average 20000000
  police average 20000000

NB: not 100% sure about police statement on your IOS, but something like above.

[kishore]

I Think more commands are also required in the class-map and policy-map. Commands that uses dscp, etc in my 3925 router ios. I don't know much about dscp that must be used in this context (limiting the bandwidth to 5 Mbps from 200 Mbps). Done the above using police but still not working.

That is i want to do this without using police in cisco ios 3925 router.

Please help me.

[Joseph W. Doherty]

DSCP would only be useful if something was tagging your packets with a specific DSCP marking to correspond with your VLANs.

Further define "not working".