Last year I configured my Cisco 877 router to rate-limit downloads so as not to exceed my ISP’s monthly quota. Later I realised that rate-limiting is not the best method to cap downstream traffic and switched to policing instead. My method worked but with some changes to the implementation I have since been able to simplify the management and get access to more useful stats.

Explaining the difference between what I was doing and what I’m now doing would probably take almost as long as describing everything from scratch and would certainly be confusing let’s go back to the very beginning.

The situation was that my ISP imposed a strict download quota between the hours of 0900 and 1800 on weekdays. I wanted to make sure that I didn’t inadvertently eat into that quota by configuring traffic management policies on the router.

Since the peak period is based on time of day I first configured the local timezone correctly.

    clock timezone GMT 0
    clock summer-time BST recurring last Sun Mar 1:00 last sun Oct 2:00

Then I created a time range to represent peak time.

    time-range peak
     periodic weekdays 9:00 to 17:59

The time range is used inside IP and IPv6 access lists which would match any connection at peak time.

    ip access-list extended peak
     permit ip any any time-range peak

    ipv6 access-list peak6
     permit ipv6 any any time-range peak

We next need a class-map which will categorise any traffic which matches the peak or peak6 access lists. Thus it must be a match-any class-map.

    class-map match-any peak
     match access-group name peak
     match access-group name peak6

Rather than just apply a blanket restriction I wanted to allow different types of traffic to have different speeds. For example I decided that HTTP traffic should be allowed to attain 1Mbps in peak time. Outside peak time I wasn’t applying any throttling at all.

Now we need a class-map to recognise HTTP. That’s achieved with a combination of the router’s own protocol recognition and some custom access lists which match non-standard but commonly-used ports.

    ip access-list extended http-alt
     permit tcp any eq 8080 any
     permit tcp any eq 8443 any

    ipv6 access-list http-alt6
     permit tcp any eq 8080 any
     permit tcp any eq 8443 any

    class-map match-any http
     match protocol http
     match protocol secure-http
     match access-group name http-alt
     match access-group name http-alt6

In order to apply the 1Mbps restriction we need a policy-map. The peak class-map is used to limit the effects of the policy to traffic in peak time.

    policy-map 1Mbps
     class peak
        police rate 1024000
          conform-action transmit
          exceed-action drop
          violate-action drop

The penultimate step is to create a policy, to be applied on the dialer interface, which will match traffic using the class-maps defined earlier and apply the appropriate restriction policies. Any traffic not categorised by a class-map is handled by the class-default rule.

    policy-map from_internet
     class http
      service-policy 1Mbps
     class class-default
      service-policy 512kbps

Finally the from_internet policy is applied to the dialer interface so as to take effect.

    interface Dialer 0
     service-policy input from_internet

By configuring policing this way I am able to see stats for all the traffic classes I define without needing to set up a separate Netflow server.

    # show policy-map interface Dialer 0 input class http
     Dialer0

      Service-policy input: from_internet

        Class-map: http (match-any)
          7880183 packets, 9841690612 bytes
          5 minute offered rate 7000 bps

To keep this post simple I only described one speed for one traffic class. In reality I created several more time-ranges and policy-maps, and nested service policies to allow variable restrictions at different times of day. When my ISP tightened the download quota for evenings and weekends I was able to apply a tiered strategy whereby peak time traffic was severely restricted, nighttime traffic was unrestricted and remaining times were mildly restricted. Then after a month I switched to an uncapped ISP but that's another story.

    time-range off-peak
     periodic daily 2:00 to 5:59

    ip access-list extended off-peak
     permit ip any any time-range off-peak

    ipv6 access-list off-peak6
     permit ipv6 any any time-range off-peak

    class-map match-any off-peak
     match access-group name off-peak
     match access-group name off-peak6

    policy-map 256kbps
     class class-default
        police rate 256000
          conform-action transmit
          exceed-action drop
          violate-action drop

    policy-map unlimited
     class class-default

    policy-map low
     class peak
      service-policy 256kbps
     class off-peak
      service-policy unlimited
     class class-default
      service-policy 512kbps

    policy-map from_internet
     class p2p
      service-policy low
     class http
      service-policy medium