Odd rate limiting behavior on output service policy, only within a specific CIR range. 7206VXR /w NPE-G2

[3soft-sp]

I've been trying to setup a mix of rate limiting and priority queues for various classes.
The output policy on my WAN interface works perfectly and the results are as expected.
The output policy on my inside facing interface however is behaving strangely.

Any shape or police policy within 180m to 380m limits trafic to 180m no matter where it resides, parent or child
The incoming trafic from the ISP is rated at 350m

I've removed any child classes to demonstrate the behavior in the most simple config

policy-map outside-in
 class class-default
  shape average 325000000

interface GigabitEthernet0/2
 service-policy output outside-in

The above config results in speed tests that average 180m, including a point-to-point iperf3 test

policy-map outside-in
 class class-default
  police cir 325000000

This results in a burst around 350m, quickly sloping to 160-180m average

Changing the shape or police to something above 380m causes the ISP rate limit to be hit around 350m
Changing it to something below 180m causes the tested speed to match the number in the command.

shape average 60m: tests 55-65m
shape average 120m: tests 110-125m
shape average 180m: tests 170-180m
shape average 250m: tests 170-180m
shape average 350m: tests 170-180m
shape average 390m: tests 350-360m ISP cap

Changing shape to police in the above chart results in the same behavior, with the exception of a burst of double rate for the first second or two of the test.

Setting a simple police 325m on the outside facing interface's input policy behaves normally, with a tested speed of 315-330m.

With the first posted config, the cpu hits 42% max during the speed test.

[3soft-sp · Accepted solution]

Never figured out what was causing the issue. Moved to the ASR1001 platform and now have full speed on all shaping policies.

[Joseph W. Doherty]

Interesting! Perhaps some form of bug or the interaction of Cisco's 7200 shaper/policer with the inbound SP cap of 350 Mbps. This is the kind of issue that's more of a TAC case. (You didn't mention what IOS version being used in your OP.)

With the ASR, inbound is still at 350 Mbps?

[3soft-sp]

Ah my mistake. 7200 was using 152-4.M11

And yes all classes and policies were transferred from the 7200 to the ASR as-is. Inbound still 350

Interesting note, another 7200 at a different site of mine has similar shaping, though 250m on the inbound, and uses the NPE-G1 rather than the G2. Speeds are as expected on that router. Same IOS version

[Joseph W. Doherty]

May be the same IOS version, but I believe the G1 and G2 are different CPUs.