QoS behaviour ?

[tedauction]

Hello, we had a case whereby a client on the LAN initiated a large data transfer with source traffic marked as EF. It then flooded the 100Mbps WAN uplink.No other clients could pass traffic.

I thought the service policy I had on the WAN uplink would prevent that. 

Can someone please tell me the expected behaviour based on my QoS policy below  i.e. should this have happened or not ?

Thank you kindly.

terface GigabitEthernet1/0/1
description WAN_PRI
switchport access vlan 83
switchport mode access
ip flow monitor NETFLOW-TRAFFIC input
load-interval 30
speed 100
duplex full
service-policy output QUEUES************************
end

Policy Map QUEUES
Class Multi-Media
priority
Class DataTrans
bandwidth remaining 70 (%)
Class IA-High
bandwidth remaining 15 (%)
Class class-default
bandwidth remaining 15 (%)

Policy Map AUDIO_CODEC
Class AUDIO_CODEC
set dscp ef

Class Map match-any IA-High (id 6)
Match dscp cs3 (24)
Match dscp af31 (26)
Match dscp af32 (28)
Match dscp af33 (30)

Class Map match-any Multi-Media (id 7)
Match dscp ef (46)
Match dscp cs4 (32)
Match dscp af41 (34)
Match dscp af42 (36)
Match dscp af43 (38)

Class Map match-any class-default (id 0)
Match any

Class Map match-any DataTrans (id 12)
Match dscp cs1 (8)
Match dscp af11 (10)
Match dscp af12 (12)
Match dscp af13 (14)

Class Map match-any IA-Low (id 13)
Match dscp cs2 (16)
Match dscp af21 (18)
Match dscp af22 (20)
Match dscp af23 (22)

Router#sh int gi1/0/1

GigabitEthernet1/0/1 is up, line protocol is up (connected)

  Hardware is Gigabit Ethernet, address is 042a.e299.b601 (bia 042a.e299.b601)

  Description: WAN_PRI

  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,

     reliability 255/255, txload 12/255, rxload 21/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX

  input flow-control is off, output flow-control is unsupported

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input never, output never, output hang never

  Last clearing of "show interface" counters 3w3d

  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 152172358

  Queueing strategy: Class-based queueing

  Output queue: 0/40 (size/max)

  30 second input rate 8598000 bits/sec, 2569 packets/sec

  30 second output rate 4895000 bits/sec, 2445 packets/sec

     5257868770 packets input, 2166220335466 bytes, 0 no buffer

     Received 1739 broadcasts (0 multicasts)

     0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 watchdog, 0 multicast, 0 pause input

     0 input packets with dribble condition detected

     5220816214 packets output, 1811489714995 bytes, 0 underruns

     152172358 output errors, 0 collisions, 0 interface resets

     0 unknown protocol drops

     0 babbles, 0 late collision, 0 deferred

     0 lost carrier, 0 no carrier, 0 pause output

     0 output buffer failures, 0 output buffers swapped out

Router#sh policy-map int gi1/0/1

 GigabitEthernet1/0/1

  Service-policy output: QUEUES

    queue stats for all priority classes:

      Queueing

      (total drops) 219004

      (bytes output) 933252725713

    Class-map: Multi-Media (match-any)

      0 packets

      Match:  dscp ef (46)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp cs4 (32)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af41 (34)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af42 (36)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af43 (38)

        0 packets, 0 bytes

        30 second rate 0 bps

      Priority: Strict,

    Class-map: DataTrans (match-any)

      0 packets

      Match:  dscp cs1 (8)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af11 (10)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af12 (12)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af13 (14)

        0 packets, 0 bytes

        30 second rate 0 bps

      Queueing

      (total drops) 136456275

      (bytes output) 829667994675

      bandwidth remaining 70%

    Class-map: IA-High (match-any)

      0 packets

      Match:  dscp cs3 (24)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af31 (26)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af32 (28)

        0 packets, 0 bytes

        30 second rate 0 bps

      Match:  dscp af33 (30)

        0 packets, 0 bytes

        30 second rate 0 bps

      Queueing

      (total drops) 2827079

      (bytes output) 1560467524

      bandwidth remaining 15%

    Class-map: class-default (match-any)

      0 packets

      Match: any

      Queueing

      (total drops) 12670000

      (bytes output) 53275825712

      bandwidth remaining 15%

[lpassmore · Accepted solution]

This will possibly vary by platform and IOS level, but I think you will need to specify a kbps value in your Multi-media class.  With no restriction, any EF traffic is going to be sent with strict priority and unless you put in the kpbs value it will happily use the entire link. Try something like priority 30000.

The other thing would be to make sure users cannot use EF in any packet by remarking their traffic at the source using an input policy at the switch port.  This should be reserved for your phones and voice apps only.

[Joseph W. Doherty · Accepted solution]

From your interface switchport commands, I assume this is some L3 switch, correct?  (Noting exactly what hardware is being used can help much, as features vary by platforms, IOS and even feature set.)

Many Cisco L3 switches QoS priority feature doesn't implicitly limit transfer rate, so if you have a whole link's worth of that class of traffic, it can starve (from bandwidth) all other class(es) traffic.

As lpassmore has also noted, you probably want to limit how much bandwidth PQ may take and/or validate markings are being appropriately used for that traffic.