QOS seems to not be enforcing on BNG.

[puddingtech]

We apply QOS via Radius but lately we've got reports of customers not being restricted to their bandwidth we set especially on the download side. When i check the customers policy-map it looks like their not getting matched on the outbound. I'm not sure what could be causing it or how to fix it anyone here have experience? 

Customer traffic is over a 4x10GB MC-LAG Bundle (BE100), we're using GeoRedundancy between 2 ASR9001 units.

On AccessAccept we are sending for an example client

cisco-avpair="subscriber:sub-qos-policy-out=10240kb"

cisco-avpair="subscriber:sub-qos-policy-in=3078kb"

show running policy-map has an entry like the following (we have different capacity policy maps for our various packages)...

policy-map 3072kb
  class class-default
  police rate 3072 kbps burst 576 kbytes peak-rate 4608 kbps peak-burst 1152 kbytes
end-policy-map

policy-map 10240kb
  class class-default
  police rate 10240 kbps burst 1920 kbytes peak-rate 15360 kbps peak-burst 3840 kbytes
end-policy-map

An example customer session on pppoe

Mon Nov 9 11:19:41.954 UTC
Interface: Bundle-Ether100.2151.pppoe1993
Circuit ID: Unknown
Remote ID: Unknown
Type: PPPoE:PTA
IPv4 State: Up, Sun Nov 8 13:39:22 2020
IPv4 Address: X.X.X.X, VRF: SUBSCRIBERS
Mac Address: XXXX.XXXX.XXXX
Account-Session Id: XXXXXXX
Nas-Port: Unknown
User name: CUSTOMER
Formatted User name: unknown
Client User name: unknown
Outer VLAN ID: 2151
Subscriber Label: 0x0001314e
Created: Sun Nov 8 13:39:15 2020
State: Activated
Authentication: authenticated
Authorization: unauthorized
Access-interface: Bundle-Ether100.2151
Policy Executed:
policy-map type control subscriber PPP_PM
event Session-Start match-first [at Sun Nov 8 13:39:15 2020]
class type control subscriber PPP_SUB do-until-failure [Succeeded]
10 activate dynamic-template PPPSUB_TPL [Succeeded]
event Session-Activate match-first [at Sun Nov 8 13:39:15 2020]
class type control subscriber PPP_SUB do-until-failure [Succeeded]
10 authenticate aaa list default [Succeeded]
Session Accounting: disabled
Last COA request received: unavailable
[Last IPv6 down]
Disconnect Reason:

A show policy-map for the subscriber interface shows...

Bundle-Ether100.2151.pppoe1993 input: 3072kb
Class class-default
Classification statistics (packets/bytes) (rate - kbps)
Matched : 141410/132267324 0
Transmitted : N/A
Total Dropped : 11848/16176968 0
Policing statistics (packets/bytes) (rate - kbps)
Policed(conform) : 129562/116090356 0
Policed(exceed) : 11848/16176968 0
Policed(violate) : 0/0 0
Policed and dropped : 11848/16176968

Bundle-Ether100.2151.pppoe1993 output: 10240kb
Class class-default
Classification statistics (packets/bytes) (rate - kbps)
Matched : 0/0 0
Transmitted : N/A
Total Dropped : 0/0 0
Policing statistics (packets/bytes) (rate - kbps)
Policed(conform) : 0/0 0
Policed(exceed) : 0/0 0
Policed(violate) : 0/0 0
Policed and dropped : 0/0

[smilstea]

When using a bundle the policy-map gets replicated to each member, so if you have a 100mb output policy and traffic is load-balanced on all 4 links then the user gets 400mb.

To work around this we can force the user to take only one bundle member.

bundle load-balancing hash dst-ip

Add that to the bundle config and it should fix your issue.

Sam

[puddingtech.]

Any other idea? Already have that set in the configs for both unit. And like i said based on policy-map it's not matching somehow (you can see the sample above)

[puddingtech.]

.

[puddingtech]

.

[jawicks]

Try changing your egress policer to a "flat" policer so the config looks something like the following and then check the packet matches on the PPPoE session once it has been re-established with the revised config.

policy-map 10240kb
  class class-default
    police rate 10240 kbps
end-policy-map

Rgds, Jim.W.

[smilstea]

We worked this through a TAC SR and found it to be due to CSCvo43692.

Sam