8

We have a service provider (and we can't change providers) who is giving us a "metro ethernet" style connection between two of our locations. On each end, we plug into an ethernet port on a provider's switch and they ship frames back and forth. We get a certain bandwidth from them and they are dropping packets that burst over the bandwidth.

I'm pretty sure that a good way for us to not burst over their limit and avoid dropped packets is for us to shape our traffic to fit under the limit. I think I'm very close to understanding how to do this, but it's pretty complicated. We have a Cisco Catalyst 3560X on each side of the connection.

If I want to shape traffic down to 50 Mbps across the tunnel, it looks like the right (maybe only?) way to do it is to use shaping on the egress queues of the ports used for the link on each of our 3560s. We do not need to mark or classify any traffic, we just want to shape everything down to 50 Mbps. Here's an example port config right now:

interface GigabitEthernet0/1
 speed auto 10 100
 spanning-tree portfast disable

I know I'll want to do mls qos in global config mode. Then I should see something like this:

[Switch name]# show mls qos int gig0/1 queueing
GigabitEthernet0/1 
Egress Priority Queue : disabled
Shaped queue weights (absolute) :  25 0 0 0
Shared queue weights  :  25 25 25 25
The port bandwidth limit : 100  (Operational Bandwidth:100.0)
The port is mapped to qset : 1

My understanding so far is the following, feel free to correct me:

  • All traffic will be CoS 0/unmarked so will go into egress queue 2 by default.
  • Egress queue 2 is sharing the bandwidth equally with queue 3 and 4, and queue 1's weight is ignored.
  • Egress queue 1 is shaped to 1/25 of the interface bandwidth, so 4 Mbps in this case.

So I get that queues 2 - 4 are each guaranteed 33% of the bandwidth (33 Mbps, right?) and queue 1 is shaped to 4 Mbps. My first question is:

With this default configuration, if only queue 2 is used, how much bandwidth will it get? 100 Mbps? And if all queues were fully utilized, queue 1 would have 4 Mbps and queues 2 - 4 would each have 32 Mbps (100 - 4 = 96/3 = 32)?

And now the real question:

To shape all unclassified egress traffic to fit into 50 Mbps, can I just enter
srr-queue bandwidth shape 0 2 0 0 on the interface in question and be done?

It seems like the queue sharing and shaping limits aren't guaranteed, so I might need to shape down to a nominal 45 Mbps on the egress queue if any burst over 50 Mbps is to be avoided. Can I do that by just running srr-queue bandwidth limit 90 combined with the above shaping? Would it be the same to instead use:

srr-queue bandwidth shape 0 1 0 0
srr-queue bandwidth limit 45

Would that shape queue 2 to 45 Mbps (on a 100 Mbps interface)?

Once I understand that, I'm guessing my next stop is sorting out buffer allocations and thresholds so my shaping is dropping as few packets as possible, right? That can be a separate question if necessary, but actually that seems to make a lot more sense so far.

  • 1
    A side note to your question: based on experience with metro ethernet, you may want to put routers on each side and run a routing protocol and BFD. When the link goes down, both sides will think it's still up since the connection to the telco equipment will still be up. This has given us much frustration in the past. – Ron Maupin Jun 24 '16 at 22:07
  • @RonMaupin Already part of the plan, thanks for the tip! Part of the plan as in we won't be inserting equipment, instead we will be using the layer 3 capability of the switches to route from location to location. We don't want one big broadcast domain going across a relatively slower WAN link. – Todd Wilcox Jun 24 '16 at 22:08
  • OK. I don't know if you can run BFD on those switches. That's really the only solution we found to find out the link is down in short order. The routing protocols will take a while to realize there is no connection to the other end since the links will still show as up/up in the equipment. – Ron Maupin Jun 24 '16 at 22:46
  • Oh I wasn't thinking about resiliency as much as routing rather than broadcasting. We currently have nothing to failover to anyway. If it came to that, I think EIGRP might actually suffice. Anyway, that's further in the future from where we are now. – Todd Wilcox Jun 24 '16 at 23:42
  • OK. I was just trying to pass along some [bad] experience with metro ethernet. This is also a problem with some other carrier ethernet, too. Some of it is really over TDM circuits, and the circuits terminate in carrier equipment which shows up/up, even when the TDM circuit is down. BFD really helps this, but it is limited in the devices which can use it. – Ron Maupin Jun 24 '16 at 23:48
6

And now the real question:

To shape all unclassified egress traffic to fit into 50 Mbps, can I just enter srr-queue bandwidth shape 0 2 0 0 on the interface in question and be done?

It seems like the queue sharing and shaping limits aren't guaranteed, so I might need to shape down to a nominal 45 Mbps on the egress queue if any burst over 50 Mbps is to be avoided. Can I do that by just running srr-queue bandwidth limit 90 combined with the above shaping?

Short answer: Yes, this is all it takes to do egress shaping.

Of course, mls qos must be entered, but once that is configured, egress shaping on a port is as simple as:

  1. Adjust the line rate, if necessary (speed 10 100 1000)
  2. Set the bandwidth limit, if necessary (srr-queue bandwidth limit 10-90, the last argument is the percent of the line rate to limit the bandwidth to)
  3. Enter the shaping weight for queue 2 on the interface (srr-queue bandwidth shape 0 x 0 0 where either the bandwidth limit (if applied) or the line rate (if no limit) divided by x is the bandwidth the traffic is shaped to)

Source:
Earlier today I took an extra 3560, put an extra computer on each of two ports, and started making configuration changes while copying files back and forth between the two computers, watching the estimated copy rate, and doing some math to confirm the numbers match up.

0

It's pretty easy. If you have RTP or some LLQ you might need to do nested policy but if not:

class-map match-any myRate
 match any

policy-map myRatePolicy
 class myRate
  shape average 50m

interface GigabitEthernet0/1
 service-policy output myRatePolicy
  • Can you explain if this method of shaping works differently from the method in my answer? Also, do you know what platforms this is supported on? – Todd Wilcox Jul 22 '16 at 17:10
  • Looks like on Catalyst 3560, match any is not a valid class-map subcommand but I think match protocol ip does the same thing. The shape policy-map class-map subcommand is not available on my Catalyst 3560. So this is good information that doesn't answer my question. Thanks for answering, though. – Todd Wilcox Jul 22 '16 at 17:16
  • @ToddWilcox feature support is a good point. Right, the 3560 (no longer being sold) does not support this newer style of IOS-XE config. Further, a quick Google search turns up some reported issues with shaping on this older switch. You might benefit from upgrading it. – Ron Royston Jul 22 '16 at 18:13
  • We have nine 3560s in service and a budget we have to get under and many other needs in the category of networking equipment. Also.. the only "reported issue" I can find on that link is the caveat that it doesn't actually limit to the exact percentage that you specify, it actually does it in increments of 6.. um.. kbps? Something like that. So you have to leave a little extra headroom. But the difference is actually reported by the output of show mls qos int <type><#> queueing so you don't have to guess. – Todd Wilcox Jul 22 '16 at 18:23
  • Also, even though I did my testing on an EoL 3560E, I'm pretty sure it's configuration compatible with the 3560CX, which is still in production and is the actual switch we have on its way for this application, since we just need a low port-count edge switch for interfacing with our provider. – Todd Wilcox Jul 22 '16 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.