Solution for simple QoS shape on int vlan

[Filip Knezevic]

Hello all,

It looks like the QoS service-policy (shape) on the vlan interface is only limiting download, but not upload. That is a huge issue for us, since sometimes we can't segregate the port for the client from the other clients. So I only need to be able to limit the traffic, not to prioritize it.

Any help would be appreciated. 

Thanks.

[Eric101]

Hello,
If you wish to limit inbound traffic (assuming the SVI is the default gateway of your client)
You need to create a qos policy to police the inbound (upload) traffic to a desired data rate. Shaping action is only possible in the outbound direction for most platforms.

If the problem flow is a known conversation (e.g. machine to machine replication) you can create a specific policer for that conversation via an extended ACL. e.g. host a any host b ssh

[Filip Knezevic]

Hi Eric,

Thanks  for the reply. For the sake of the simplicity, let's say the customer's router is connected directly to one of the switch ports. We create an SVI interface and put the port (where the client is connected) to access mode. And we want to limit the traffic to 100/100M. How would that policy look like?

Thanks in advance.

[Joseph W. Doherty · Accepted solution]

Much depends on the QoS capabilities of the device, but maybe something similar to:

policy-map RateLimit100
class class-default
police average 100000000

int x
service-policy in RateLimit100
service-policy out RateLimit100

[Filip Knezevic]

Hello Joseph,

Thank you very much. We mainly use 7600 and 6500 series, so I dont think there should be issues. Ill try this on Monday and I'll let you know if it's working.

[Filip Knezevic]

Hello Joseph,

I was not in front of my PC when you've sent me your response. Basically this is exactly the same as I already did. But it's only affecting the download, upload is unshaped. I have set the 30M policy on SVI (going through 100M port).

This is the result:

Any advice?

[Joseph W. Doherty]

Depending on the sup (?), 6500 have a limit on the number of policers they support (512?). Per chance, do you device have in excess of this number?

[Filip Knezevic]

Hello Joseph,

How can I check that?

We use this SUPs on our 6500:

Supervisor Engine 720 10GE - VS-S720-10G        SAL12362KA1

We use these SUPs on our 7600:

Route Switch Processor 720 10GE - RSP720-3CXL-10GE

6 5 Route Switch Processor 720 10GE - RSP720-3CXL-10GE

[Eric101 · Accepted solution]

The "show platform hardware capacity qos" should show your resource usage.

What version of IOS are you running? There was some significant command changes between 12.2 and 15 on these platforms.

I am assuming that you have a Layer 3 SVI, with a layer 2 LAN port (switchport XX command) connected downstream to a customer.
Have you enabled VLAN based QoS on the port?

config terminal
interface x/x
mls qos vlan-based
end

Confirmation command:
show mls qos | begin QoS is vlan-based
QoS is vlan-based on the following interfaces:
Ifx/x
<...Output Truncated...>

This will allow Layer 3 PFC egress policies configured on an SVI to be applied on a layer 2 port.

Do you have a copy of your configuration available? Relevant class-maps, policy-map, SVI and the layer 2 port.

[Filip Knezevic]

Hello Eric,

It looks it was really the mls qos vlan-based command!!! I've applied it to the physical interface and it looks like it's shaping it now.

Thank you very much, both of you.