Thanks for your answers, i corrected the rates again (burst sizes in the mail where the last ones configured after trying both 1.5 and 1 sec slots).
Still the same, without any ratelimit applied: 6.2#sh interfaces GigabitEthernet 1/11 | i rate Queueing strategy: fifo 30 second input rate 261948000 bits/sec, 65584 packets/sec 30 second output rate 428618000 bits/sec, 71798 packets/sec 6.2#sh interfaces vlan20 | i rate Queueing strategy: fifo 30 second input rate 255650000 bits/sec, 63221 packets/sec 30 second output rate 54892000 bits/sec, 18180 packets/sec 428m...@gigabit vs 55m...@vlan reported rates (this is without ratelimit configured) i have try the same in another cisco WS-C6509, this one running s72033-advipservicesk9_wan-mz.122-18.SXF4.bin (equip with problems runs s72033-pk9sv-mz.122-18.SXD1.bin): 6.1_2#sh interfaces GigabitEthernet 1/1 | i rate Queueing strategy: fifo 5 minute input rate 21408000 bits/sec, 18199 packets/sec 5 minute output rate 168652000 bits/sec, 21165 packets/sec 6.1_2#sh interfaces vlan20 | i rate Queueing strategy: fifo 5 minute input rate 21759000 bits/sec, 18313 packets/sec 5 minute output rate 167289000 bits/sec, 21033 packets/sec this time reported rates are coherent. Thanks again for your help. On Mon, Jun 29, 2009 at 11:58 AM, Ziv Leyes <[email protected]> wrote: > > I've found that the best results are obtained by using the following formulas > BC = BW / 8 * 1.5 > BE = BC > In your case it will be > 425000000 / 8 * 1.5 = 79687500 > So your rate-limit will look like this: > > interface Vlan20 > rate-limit output 425000000 79687500 79687500 conform-action transmit > exceed-action drop > > Hope this helps, > Ziv > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Manu Chao > Sent: Monday, June 29, 2009 12:21 PM > To: Manuel García Montero > Cc: [email protected] > Subject: Re: [c-nsp] Applying output rate limit at 6500/SUP720 platform > > I think your burst-normal and burst-max values are badly estimated: > > burst-normal is the burst size in byte during 1 second of burst > burst max = burst-normal x2 > > Try that: > > interface Vlan20 > rate-limit output 425000000 80000000 160000000 conform-action transmit > exceed-action drop > R/ > Manu > 2009/6/29 Manuel García Montero <[email protected]> > > > Hi, > > > > we are facing difficulties trying to limit the rate at an interfaz in a > > 6509/SUP720 (IOS image s72033-pk9sv-mz.122-18.SXD1.bin). > > > > We want to limite the output rate at a Gigabit port connected directly to > > Customer Equipment. That port is configured at swithport mode, and we have > > all level 3 configuration at VLAN interface (1) > > > > In that vlan interface we have try 3 different configurations (2) to > > establish the output rate limit, and while all of them should work, they > > dont, beacause the rate seen at the vlan interface is lower than the > > Gigabit > > interface, which is correct: > > > > > > 6.2#sh interfaces GigabitEthernet 1/11 | i rate > > Queueing strategy: fifo > > 30 second input rate 221436000 bits/sec, 60004 packets/sec > > 30 second output rate 456426000 bits/sec, 67772 packets/sec > > 6.2#sh interfaces vlan20 | i rate > > Queueing strategy: fifo > > 30 second input rate 228770000 bits/sec, 61961 packets/sec > > 30 second output rate 89869000 bits/sec, 23914 packets/sec > > > > > > As your can see, input rates are more or less the same in both interfaces, > > but output rate at vlan is a lot lower than the real value (shown at > > physical port), so all packets are getting conform policy applied, > > transmit, > > with no drops to reduce the rate. > > > > Which can be the cause of this issue? > > > > Theres also the chance to move layer3 config to physical interface, which > > would solve the issue as that interface can see correct rates. > > > > > > > > ******************************************* > > (1) Relevant interface / general configuration > > ******************************************* > > > > interface GigabitEthernet1/11 > > description CUSTOMER_Principal > > no ip address > > load-interval 30 > > switchport > > switchport access vlan 20 > > switchport mode access > > end > > interface Vlan20 > > ip address 10.160.0.19 255.255.255.240 > > ip access-group 122 in > > no ip redirects > > ip wccp 97 redirect in > > ip wccp 98 redirect in > > ip multicast netflow egress > > ip route-cache flow > > no ip mroute-cache > > load-interval 30 > > standby 55 ip 10.160.0.17 > > standby 55 priority 150 > > standby 55 preempt > > end > > > > mls ip multicast flow-stat-timer 9 > > mls aging long 64 > > mls aging normal 60 > > mls flow ip destination-source > > no mls flow ipv6 > > mls qos > > mls cef error action freeze > > > > ******************************************* > > (2) Configuration to limit the output rate: > > ******************************************* > > > > 1. rate-limit > > > > interface Vlan20 > > rate-limit output 425000000 212500 212500 conform-action transmit > > exceed-action drop > > > > 2. service-policy with rate-limit > > > > policy-map CUSTOMER_OUT > > class class-default > > police 425000000 conform-action transmit exceed-action drop > > !apply police to interfaz > > interface vlan20 > > service-policy output CUSTOMER > > > > 3. service-policy with aggregate policer > > > > mls qos aggregate-policer CUSTOMER_OUT 425000000 106250 conform-action > > transmit exceed-action drop > > ! > > policy-map CUSTOMER_OUT > > class class-default > > police aggregate CUSTOMER_OUT > > !apply police to interfaz > > interface vlan20 > > service-policy output CUSTOMER > > > > Regards, > > _______________________________________________ > > cisco-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > > ************************************************************************************ > This footnote confirms that this email message has been scanned by > PineApp Mail-SeCure for the presence of malicious code, vandals & computer > viruses. > ************************************************************************************ > > > > > > > ************************************************************************************ > This footnote confirms that this email message has been scanned by > PineApp Mail-SeCure for the presence of malicious code, vandals & computer > viruses. > ************************************************************************************ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
