QoS Policy to not overutilize WAN link

Question

I have a configuration on a Cisco C897VA-K9 router that has a built in DSL modem. It has a simple internet connection via VDSL. There is a VPN configured on the device, that connects back to our main office. In order to have a reliable QoS configuration, I have to make sure the WAN Link is not overutilized at any time. The VDSL2 link has asymetric speeds. I have 41'582 Kbit/s download and 7'719 Kbit/s upload. I have a script that reads the synchronized upload speed, takes 80% of the bandwidth and configured this on a service policy that is then applied to the Dialer interface.

policy-map QOS_OUT
 class class-default
  shape average 6175200   
   service-policy QOS_OUT_CHILD

interface Dialer1
 service-policy output QOS_OUT

So i can manage the upload well. Problem is the download. Best practice would be, to limit the output on the LAN interface to make sure, the WAN link is not overutilized. Problem here is, that there are two LAN interfaces that could draw bandwidth from the WAN. How do I do that?

policy-map QOS_OUT
 class class-default
  shape average 33265600
   service-policy QOS_IN_CHILD

interface Vlan5
 description LAN Interface1 for VPN
 ip vrf forwarding VRFA
 ip address 172.16.1.1 255.255.255.0
 service-policy output QOS_OUT
end

interface Vlan6
 description LAN Interface2 for Internet
 ip vrf forwarding VRFB
 ip address 10.0.0.1 255.255.255.0
 service-policy output QOS_OUT
end

So in this configuration, both Vlan interfaces could take 33 Mbit/s, therefore overutilizing the WAN link. What i could do, is divide the bandwidth by two. Issue here is, if interface Vlan5 is not utilized, Vlan6 can only take 40% of the total WAN bandwidth. This is an ugly solution. Is there some other approach where I can solve this? I did not post the configuration of the child policies, as the question only concerns the bandwidth part.

Answer 1

I think you're limited by physics, more than IOS commands. When you say you're shaping the bandwidth to 80%, in reality you are buffering higher bursts and then metering them out at the desired rate. That works fine for upload, but for download there's a problem:

If you buffer large download bursts, you still exceed your utilization on the WAN -- you just buffer it in your router and meter it out to the local LANs. In other words, you've already used the WAN bandwidth to get the traffic into your buffer so you can apply your policy. The only real solution is to apply the policy on the other side of your WAN link.

That may be impractical with an Internet connection, which leads me to my second point: what are you really going to accomplish by limiting your download bandwidth? Unless the far end buffers traffic bursts, all you're doing is lowering your bandwidth to 80% of what you're paying for. The available bandwidth is already limited by the carrier. You're just putting another lower limit on that. The 20% you don't use is money wasted.

The whole idea of shaping is to buffer bursty traffic so you don't lose it. Unless you shape before you put the traffic on the WAN, you accomplish nothing.

One more minor point: even if what you wanted were possible, you have the policies on your VLAN interface in the wrong direction. Input mean traffic coming into the VLAN interface from the local LAN. That would be upload traffic on the WAN.