6

I am trying to split the bandwidth between 2 parties using a C3750-X. It has the Lan base licence and is running on the 12.2 train. The following is my config on an otherwise blank switch:

ip access-list extended ACL_20M  
permit ip any any  
!  
class-map match-all CLASS_20M  
  match access-group name ACL_20M  
!  
policy-map POLICY_20M  
  class CLASS_20M  
    police 20000000 100000 exceed-action drop  
!  
interface GigabitEthernet1/0/1  
 service-policy input POLICY_20M  
!  
ip access-list extended ACL_180M  
 permit ip any any  
!  
class-map match-all CLASS_180M  
  match access-group name ACL_180M  
!  
policy-map POLICY_180M  
  class CLASS_180M  
    police 180000000 100000 exceed-action drop  
!  
interface GigabitEthernet1/0/13  
 service-policy input POLICY_180M

I'm testing with iperf but don't see any effect when applying

service-policy input POLICY_whichever

to an interface. Any assistance on why it doesn't work would be greatly appreciated.

Improve this question
4
  • You don't need any kind of user-defined classes in you configuration. You should replace them with the built class-default for simplicity
    – Marco Marzetti
    Aug 6, 2013 at 15:28
  • Just want to confirm whether this configuration will work on the traffic of vlan 500 passing through a trunk as well ?
    – user2512
    Aug 29, 2013 at 12:52
  • when you don't have vlan l3 into the switch, how it gonna work?
    – user27652
    Jul 5, 2016 at 18:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 1:21

2 Answers 2

Reset to default
4

You're configuring it wrong. In order to get policing working on these switches you need to configure the following (I've taken this from a working switch of mine)

mls qos
!
interface GigabitEthernet1/0/2
 switchport access vlan 500
 switchport mode access
 mls qos vlan-based
!
class-map match-all CUSTOMER_2
 match input-interface  GigabitEthernet1/0/2
!
policy-map VLAN500_POLICE
 class CUSTOMER_2
  police 10000000 1000000 exceed-action drop
!
policy-map VLAN500_PARENT
 class class-default
  set dscp default
  service-policy VLAN500_POLICE
!
interface Vlan500
 ip address 192.168.203.1 255.255.255.248
 ip ospf 1 area 0
 service-policy input VLAN500_PARENT

This is the only way I've ever got policing to work on a 3750

Improve this answer
6
  • 1
    You don't have to 'set dscp default' but you have to have an action in the parent. I've just used set dscp default but you can use anything
    – mellowd
    Aug 5, 2013 at 21:30
  • If it's wrong, how is it wrong, what is not being supported. To me OP's configuration looks valid for ingress policing in 3750. Apart from issue @James pointed, which seemed to be just omitted from config.
    – ytti
    Aug 6, 2013 at 6:33
  • I did see the vlan based option but as I only have a Lan licence that's not an option. As I understand it (although I obviously may well be wrong as it's not working) policing should be supported on L2 ports.
    – anonymous
    Aug 6, 2013 at 7:35
  • Oddly I've never seen a non-queued police policy ever working on a 3750. Creating a queue like above and policing that works all the time
    – mellowd
    Aug 6, 2013 at 7:46
  • The config OP gave are just fine and supported in 3560, 3750, 3750-X etc for /ingress/. Just tested in lab, works. Only explanation for not working appears to be lack of global 'mls qos'. Counters won't work, so it might be also that everything works just fine, but OP is looking at counters.
    – ytti
    Aug 6, 2013 at 7:56
1

You've most likely already done this but wanted to ensure you've enabled QOS on the interface or globally by using the command:

 mls qos
Improve this answer
1
  • Thanks - yes I did have "mls qos" enabled in the config.
    – user2275
    Aug 5, 2013 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.