I understand bandwidth in QOS is use to guarantee a minimum bandwidth

I understand police in QOS is to set a limit to the maximum bandwidth.

class test_out
  police **1608000** 50000 100000 conform-action set-dscp-transmit af31 exceed-action set-dscp-transmit af32 violate-action set-dscp-transmit 28
  **bandwidth 2542**
  random-detect dscp-based
  random-detect exponential-weighting-constant 7
  random-detect dscp 26 50 80 10
  random-detect dscp 28 15 40 5

Can someone tell me if the above configuration is self defeating ?

I have a guarantee bandwidth of 2542Kb, but traffic is being police at 1608000 bits = 1570Kb



q1) With the police value configured lowered then the guarantee bandwidth, is my traffic still able to reach the guarantee bandwidth ?

q2) If it is able to reach the guarantee bandwidth due to the fact that the exceed and violate action does not drop traffic, then what is the difference between the exceed and violate action of set-dscp-transmit af32 and dscp 28 ? (both seems to have the same DSCP value)

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 10:27

1 Answer 1


I understand bandwidth in QOS is use to guarantee a minimum bandwidth

There is really a lot more to QoS than that.

I understand police in QOS is to set a limit to the maximum bandwidth.

Policing is dropping traffic that exceeds certain parameters.

To actually police, you need to drop traffic above your predefined bandwidth. You are still allowing all traffic, only setting the DSCP for traffic exceeding the bandwidth.

Normally, you use a priority queue to guarantee minimum bandwidth for a class, then drop any traffic exceeding the guaranteed minimum bandwidth. Do that in your policy map. For example:

policy-map Test
  class VoIP
    priority percent 23
    police cir percent 23 conform-action transmit exceed-action drop

Your example configuration really isn't doing much for you.


You are simply changing markings in the class map. It is a policy map that would give you the guaranteed bandwidth by using a priority queue. Policing is dropping traffic outside of your parameters.

You want to classify and mark traffic as close to the source as possible, setting up a trust point. After that, you can treat (police, queue, shape) the traffic based on the marking.

Trying to do both on a router will certainly drive up the CPU utilization, and it doesn't allow you to treat the traffic throughout your whole network. In general, you classify and mark on the access switches, then treat on the routers.

See this two-part answer for more about QoS.

  • thanks for the reply. I actually inherit this configuration from a service provider and is trying to see if the configuration make sense. I have edited by original post - hope you can take a look
    – Noob
    Dec 16, 2018 at 18:39
  • We would really need a lot more information about the network and the network device configurations to offer even a valid opinion. Based on the little bit you have there, it looks like a mess. It may be worthwhile for the business to hire a consultant to come up with a comprehensive QoS plan, and then you document it so that this situation does not arise in the future.
    – Ron Maupin
    Dec 17, 2018 at 2:24
  • agreed. but the first and foremost concern would be if i am still able to reach the guarantee bandwidth provided despite having a lower policer cir rate. since the policer is not actualy dropping any excess, can i assume i am able to reach the ganrantee bandwidth of 2542 then ?
    – Noob
    Dec 17, 2018 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.