I am about to implement a network at a remote office that will also be providing some bandwidth to a sub tenant. We have a 50 Mbps connection terminating to a VLAN on a 3750-X. Each company has an L2 handoff on the same VLAN. I want to shape traffic so that Client A is guaranteed around 30 Mbps, and Client B is guaranteed around 20 Mbps at maximum utilization. If, for example, Client A is using 1 Mbps, Client B should be able to use the rest of the available bandwidth until Client A needs more.
I don't have a spare 3750X to validate this with but I think I got it...
John Kennedy gave a great answer if you want to give a hard limit to the amount of traffic that Client A and B can send but your question was how to guarantee a minimum amount of bandwidth and still allow bursting if BW is available.
In order to accomplish this we will have a policer on each of the Client A and B ingress interfaces. The set of policers will classify the traffic into 4-classes, Client-A conforming (the first 30Mb, set DSCP to AF31, decimal value 26), Client-A non-conforming (everything above 30Mb, set as DSCP AF32, decimal value 28), Client-B conforming (first 20Mb, DSCP AF21, 18), Client-B non-conforming (over 20Mb, set DSCP AF22, 20).
We will then map each of these classes to a queue on egress and allocate the bandwidth in a manner that should allow each client the minimum required bandwidth but still have the ability to use more if it is available.
first let's map dscp values (in decimal) to egress queues
mls qos srr-queue output dscp-map queue 1 threshold 1 26 mls qos srr-queue output dscp-map queue 2 threshold 1 18 mls qos srr-queue output dscp-map queue 3 threshold 1 28 mls qos srr-queue output dscp-map queue 4 threshold 1 20
then we create the map to change af31 to af32 and af21 to af22 when it exceeds the guaranteed rate
mls qos map policed-dscp 26 to 28 mls qos map policed-dscp 18 to 20
create a policy that sets the traffic to af31 for all traffic and if the traffic exceeds 30Mb then set to af32
policy-map reserve-30mb class-default set dscp 26 police 30000000 exceed-action policed-dscp-transmit
create another policy that sets the traffic to af21 for all traffic and if the traffic exceeds 20Mb then set to af22
policy-map reserve-20mb class-default set dscp 18 police 20000000 exceed-action policed-dscp-transmit
apply the policy to the client A input interface
interface GigabitEthernet 1/0/1 service-policy input reserve-30mb
apply the policy to the client B input interface
interface GigabitEthernet 1/0/2 service-policy input reserve-20mb
for the WAN interface we set the ratio to 60/40 on queue 1 & 2 (AF31 and AF21) and then set the overflow queues to small values so that they can share any remaining bandwidth
interface GigabitEthernet 1/0/3 srr-queue bandwidth share 60 40 1 1
The only task this does not accomplish is limit the WAN bandwidth to 50Mb.
srr-queue bandwidth limit should do this, however the documentation says it only supports 10-90%. If the link is FastEthernet you may be able to do this using
srr-queue bandwidth limit 50
I pulled a lot of the configuration details from here
Here is what you can do with a 3750:
class-map match-all CLIENT1 match input-interface GigabitEthernet1/0/1 (or match based off AN ACL for the client networks) class-map match-all CLIENT2 match input-interface GigabitEthernet1/0/2 (or match based off AN ACL for the client networks) ! policy-map BW class CLIENT1 police 30000000 500000 exceed-action drop class CLIENT2 police 20000000 400000 exceed-action drop ! interface GigabitEthernet 1/0/1 srr-queue bandwidth limit 3 ! interface GigabitEthernet 1/0/2 srr-queue bandwidth limit 2 ! ! interface whatever your outbound L3 interface is service-policy input BW
This configuration gives you interface rate-limiting down to the desired bandwith (it is a percentage so 3= 30mbps on a GigE interface) and also checks the traffic being sent thru your outbound L3 interface to make sure that the traffic complies. By outbound L3 interface I am referring generically to whatever L3 gateway is shared by both clients whether it is an SVI (interface Vlan X) or your outbound physical interface.