I have a configuration on a Cisco C897VA-K9 router that has a built in DSL modem. It has a simple internet connection via VDSL. There is a VPN configured on the device, that connects back to our main office. In order to have a reliable QoS configuration, I have to make sure the WAN Link is not overutilized at any time. The VDSL2 link has asymetric speeds. I have 41'582 Kbit/s download and 7'719 Kbit/s upload. I have a script that reads the synchronized upload speed, takes 80% of the bandwidth and configured this on a service policy that is then applied to the Dialer interface.

policy-map QOS_OUT
 class class-default
  shape average 6175200   
   service-policy QOS_OUT_CHILD

interface Dialer1
 service-policy output QOS_OUT

So i can manage the upload well. Problem is the download. Best practice would be, to limit the output on the LAN interface to make sure, the WAN link is not overutilized. Problem here is, that there are two LAN interfaces that could draw bandwidth from the WAN. How do I do that?

policy-map QOS_OUT
 class class-default
  shape average 33265600
   service-policy QOS_IN_CHILD

interface Vlan5
 description LAN Interface1 for VPN
 ip vrf forwarding VRFA
 ip address
 service-policy output QOS_OUT

interface Vlan6
 description LAN Interface2 for Internet
 ip vrf forwarding VRFB
 ip address
 service-policy output QOS_OUT

So in this configuration, both Vlan interfaces could take 33 Mbit/s, therefore overutilizing the WAN link. What i could do, is divide the bandwidth by two. Issue here is, if interface Vlan5 is not utilized, Vlan6 can only take 40% of the total WAN bandwidth. This is an ugly solution. Is there some other approach where I can solve this? I did not post the configuration of the child policies, as the question only concerns the bandwidth part.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 21, 2020 at 3:14

1 Answer 1


I think you're limited by physics, more than IOS commands. When you say you're shaping the bandwidth to 80%, in reality you are buffering higher bursts and then metering them out at the desired rate. That works fine for upload, but for download there's a problem:

If you buffer large download bursts, you still exceed your utilization on the WAN -- you just buffer it in your router and meter it out to the local LANs. In other words, you've already used the WAN bandwidth to get the traffic into your buffer so you can apply your policy. The only real solution is to apply the policy on the other side of your WAN link.

That may be impractical with an Internet connection, which leads me to my second point: what are you really going to accomplish by limiting your download bandwidth? Unless the far end buffers traffic bursts, all you're doing is lowering your bandwidth to 80% of what you're paying for. The available bandwidth is already limited by the carrier. You're just putting another lower limit on that. The 20% you don't use is money wasted.

The whole idea of shaping is to buffer bursty traffic so you don't lose it. Unless you shape before you put the traffic on the WAN, you accomplish nothing.

One more minor point: even if what you wanted were possible, you have the policies on your VLAN interface in the wrong direction. Input mean traffic coming into the VLAN interface from the local LAN. That would be upload traffic on the WAN.

  • "If you buffer large download bursts, you still exceed your utilization on the WAN" - True. So I would use policing instead of shaping i guess. The Idea of limiting the bandwidth to 80% is just to have some "padding" if some bursts come in.
    – Mario Jost
    Jun 18, 2020 at 5:54
  • "what are you really going to accomplish by limiting your download bandwidth" The idea is that, if a voice packet arrives at the WAN interface (incoming) via VPN, it should not get dropped because of some HTTP download eating all the bandwidth at the same time. I dont have control over the internet, so i cannot make sure my packets dont get dropped. So my only alternative is, to prevent congestion on the WAN link in both directions.
    – Mario Jost
    Jun 18, 2020 at 5:57
  • I don't know how well policing would work, but you would create a new class for TCP, and police it at 80% of the bandwidth. The default class has no restrictions. Apply the policy to the INPUT of the WAN interface. You may have to adjust the percentage to get the performance you want.
    – Ron Trunk
    Jun 18, 2020 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.