Comments on: Cisco 877 download rate limiting

By: joseoplmx

joseoplmx — Tue, 05 Mar 2013 00:28:32 +0000

Hello..

I couldn’t make my router work with this configuration, i have a 5Mbits service and want to limit any kind of traffic to 1Mbit, it isn’t important the time nor day of the week. the policy should be active all the time. Could you please help me posting an example?

Thanks in advance.
J.O.

By: iain

iain — Mon, 19 Sep 2011 12:03:31 +0000

Good stuff. If you’re using policing I should mention that you can get stats with:

# sh policy-map int [input|output [class ]]

By: mankool

mankool — Mon, 19 Sep 2011 11:52:42 +0000

ok, I created an L3 port on my switch and then applied the class-map to it and it worked!

Great, thanks alot for your great blog!

By: mankool

mankool — Sun, 18 Sep 2011 13:49:52 +0000

Hi Iain,
Thank you for the prompt reply. I tried the rate limit in my test lab using a 3550 and a 3750 but to no effect. I even set my acl to ‘permit ip any any’ and even that didn’t help cause when I did a show int vlan10 rate-limit I didn’t see the “conform” counter increase :(

Moreover, I did a file transfer across the switches (a laptop connected at each end) and didn’t notice a drop in the transfer rate.

Moving on, I tried the class-map command that you suggested and I’m getting the following error:

%QoS: policy-map with police action at parent level not supported on Vlan10 interface.

Any clue on this? I read this post on cisco forums that talks about using “mls qos vlan-based” but that is for individual ports and not an EtherSVI.

The IOS on my 3750 is 12.2(50)SE1 so it should suport EtherSVI

By: iain

iain — Thu, 15 Sep 2011 11:38:45 +0000

I don’t know about matching directly with an ACL without having to use class-map. If your docs say you can then it’s worth a try.

In any event I wouldn’t recommend using rate-limit. In a later post I commented that I saw better results with police. So it would be something this (your formula looks correct to limit at 512kbps):

class-map match-any Email-0900-1300
match access-group name Email-0900-1300
!
policy-map vlan10-incoming
class Email-0900-1300
police 512000 96000 192000 conform-action transmit exceed-action drop violate-option drop
!
interface Vlan 10
service-policy input vlan10-incoming
!

By: mankool

mankool — Thu, 15 Sep 2011 10:06:49 +0000

Hi,
I’ve been doing some reading on the rate-limit command and I came across your blog. Excellent writeup i have to say …

I’m trying to understand if I can apply the same to a VLAN on my Core switch, which is a Cisco Catalyst 3750G (AdvancedServices IOS image). Based on some Cisco docs that I read, I can match the traffic based on my ACL without using class-map. Can you confirm if my understanding is correct?

Basically, I’m trying to limit incoming email traffic on my LAN to 512Kbps, between 9am and 1pm . Will the below help me achive this:

time-range Email-0900-1300
periodic sundary monday tuesday wednesday thursday 9:00 to 13:00
!
! The IP 1.1.1.1 etc are fictitious ip addresses from which I’m expecting incoming emails
ip access-list extended Email-0900-1300
permit ip host 1.1.1.1 any time-range Email-0900-1300
permit ip host 1.1.1.2 any time-range Email-0900-1300
permit ip host 1.1.1.3 anytime-range Email-0900-1300

interface vlan 10
rate-limit input access-group Email-0900-1300 512000 96000 192000 conform-action transmit exceed-action drop

Thank you for your input …

regards,
mAr