Limit bandwidth in cisco router with policy-map doesn't work

Question

I have a problem with my scenario in limiting bandwidth of ubuntu PC in GNS3 with class-map and policy-map. this is my topology in GNS3:

The R1 is a cisco 3725 router with c3725-adventerprisek9-mz.124-25d.bin image, and this is my configuration:

access-lists

ip access-list extended UBUNTU_DW
  permit ip any host 10.0.0.51
ip access-list extended UNUNTU_UP
  permit ip host 10.0.0.51 any

class and policy maps

class-map match-all UBUNTU_DW
  match access-group name UBUNTU_DW
class-map match-all UBUNTU_UP
  match access-group name UBUNTU_UP

policy-map UP
  class UBUNTU_UP
    police cir 32000 bc 4000 be 4000
      conform-action transmit 
      exceed-action drop 
      violate-action drop 
policy-map DW
  class UBUNTU_DW
    police cir 32000 bc 4000 be 4000
      conform-action transmit 
      exceed-action drop 
      violate-action drop 

interface FastEthernet0/1

interface FastEthernet0/1
  ip address 192.168.10.254 255.255.255.0
  ip nat outside
  ip virtual-reassembly
  duplex auto
  speed auto
  service-policy input DW
  service-policy output UP

The problem is the 32kbps limitaion for ubuntu does not work.

R1#sh policy-map interface fastEthernet 0/1
 FastEthernet0/1

  Service-policy input: DW

    Class-map: UBUNTU_DW (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: access-group name UBUNTU_DW
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps, violate 0 bps

    Class-map: class-default (match-any)
      905 packets, 812409 bytes
      5 minute offered rate 27000 bps, drop rate 0 bps
      Match: any

  Service-policy output: UP

    Class-map: UBUNTU_UP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: access-group name UBUNTU_UP
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps, violate 0 bps

    Class-map: class-default (match-any)
      979 packets, 154180 bytes
      5 minute offered rate 7000 bps, drop rate 0 bps
      Match: any

Is there any wrong configuration? How can I apply this policy?

Answer 1

I solve the problem with dscp packet marking.here is the configuration for Downloading stream.

the class map as before:

class-map match-all UBUNTU_DW  match access-group name UBUNTU_DW

and the new policy with the help of dscp is:

  Policy-Map DW
    Class UBUNTU_DW
     police cir 32000 bc 1500 pir 64000 be 2000
       conform-action set-dscp-transmit af21
       exceed-action set-dscp-transmit default
       violate-action drop

then I apply the policy to int fa 0/0

service-policy output DW

and it works :)

R1#sh policy-map interface fa 0/0 output
 FastEthernet0/0

  Service-policy output: DW

    Class-map: UBUNTU_DW (match-all)
      1699 packets, 2075517 bytes
      5 minute offered rate 20000 bps, drop rate 8000 bps
      Match: access-group name UBUNTU_DW
      police:
          cir 32000 bps, bc 1500 bytes
          pir 64000 bps, be 2000 bytes
        conformed 964 packets, 1063157 bytes; actions:
          set-dscp-transmit af21
        exceeded 336 packets, 440593 bytes; actions:
          set-dscp-transmit default
        violated 399 packets, 571767 bytes; actions:
          drop
        conformed 10000 bps, exceed 3000 bps, violate 8000 bps

    Class-map: class-default (match-any)
      77 packets, 7490 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any

Answer 2

ip access-list extended UNUNTU_UP

Looks like you have a typo.

EDIT:

I don't know what the rest of your NAT configuration looks like, but if 10.0.0.51 is only local your policies may not be matching because the ACLs see the global address.

• NAT Order of Operation
• QoS Order of Operation

I'd want to test this to be sure, but I believe the QoS operations are all contained within the ACL checking steps of the NAT order.

If so, then UP is evaluated after translation and DW is evaluated before translation.

This would leave you the option of matching on the global address and making sure it's static, or apply the policies on the F0/0 (a safer option). In the wild, you are more likely to see separate routers doing NAT and WAN hand-off.