QoS between two VLANs with Cisco 881 Router (IOS)

Question

I'm hoping to get some advice regarding the best practice to delegate a limited Internet connection between two VLANs. In my case, one VLAN is for an office network, and the other is for guests. What I'm hoping to do is allow a certain percentage of bandwidth to the Office network with priority over the Guest network. For example if I have a 10Mbps down speed, I'd like up to 7Mbps of that to always be available to the Office if needed, otherwise, the guest connection could use it.

My main concern is that if I rate limit the guest network to say 3Mbps and the router start to drop packets over that limit, that I am wasting packets from the ISP. If I understand correctly, the ISP would be sending at say 10Mbps, then my router starts dropping anything over that limit to the guest network, isn't that wasted bandwidth that will have to be resent?

In short, rate-limiting the upload makes a lot of sense because I have full control over that with my router, but I'm not sure you can effectively rate limit down-stream traffic from the ISP as I have no control over their routers. So if you can rate limit down-stream traffic without wasting it, how do you recommend going about it?

David

Answer 1

Unfortunately, I don't think there's a good way to do what you want without the provider's involvement. Working within that restriction, your best bet may be to implement an outbound policy on your LAN interface. For example, if you are PATing the business network and guest networks separately, so that the return traffic can be identified by destination IP, then a hierarchical policy that guarantees bandwidth to the business network will help. Essentially, the parent policy would shape all traffic to 10 Mbps. The parent would then call a child policy that guarantees 7 Mbps for the business network. The remaining traffic (guest network) would then be able to use whatever is left over.

Keep in mind that this is imperfect, since the traffic has already traversed the WAN. However, if the guest traffic is TCP, and starts getting dropped by your outbound LAN policy, the TCP session should throttle itself. This won't work for UDP at the transport layer.

A sample policy would look something like this:

ip access-list extended BUSINESS-NETWORK 
 permit ip any host 1.1.1.1
! 
class-map BUSINESS-NETWORK 
 match access-group name BUSINESS-NETWORK 
! 
policy-map PARENT 
 class class-default 
  shape average 10000000
  service-policy CHILD
! 
policy-map CHILD 
 class BUSINESS-NETWORK 
  bandwidth 7000 
! 
interface Fa0/0 
 description LAN interface 
 ip address x.x.x.x 
 service-policy output PARENT

This is an imperfect example, but is the best I can come up with without provider involvement.