I want to perform QoS on specific (or all the) L2TP sessions that establish on ASR1006 router (LNS).

What I have managed already is to set a police at a specific rate for a class that matches access-list 100 with the following code and it is working ok (tried one user and it limits bandwidth to 800 kbps):

class-map match-all class1
 match access-group 100
policy-map child
 class class1
  police 800000 100000 100000 conform-action transmit exceed-action set-qos-transmit 1 violate-action drop
policy-map parent
 class class-default
  service-policy child

Now what I want is to set the police cir as a percentage because I want to apply the policy-map on various pppoe sessions with different speed. But when for example I change the police with "police cir percent 50 pir percent 60" I get the following error: police percent not supported - no bandwidth for percent calculation

One user in cisco community suggested the explicit defining with the use of a RADIUS attribute (Cisco-AVPair += "ip:interface-config=bandwidth qos-reference [value]) but I want the value to be discovered automatically every time a session establishes because I am speaking about many L2TP sessions with different connection rates.

Please your help.

  • Party spoiler: If those L2TP sessions connect across the open Internet, any QoS configuration might not have the desired effects as those flags are all ignored out there.
    – Zac67
    Commented Jun 6, 2022 at 16:42
  • @Zac67 I wrote that I have already managed to set a police at a specific rate and it is working ok (tried one user and it limits bandwidth to 800 kbps). What flag are you talking about, the limit is performed on the ASR, download direction to the pppoe client...
    – vlamb
    Commented Jun 7, 2022 at 10:34

1 Answer 1


What works for us (ASR 1001X) is the following concept (paraphrased config, syntax might be slightly different).

The idea is to have a shaper in the parent class, so the child classes have a reference of what 100% should be in the given context.

On the ASR, we have a handful of parent policies, one each for the bandwidth classes we sell (e.g. 10,20,50,100)

policy-map PMAP_PARENT-50M
 class class-default
  shape average 50M
  service-policy PMAP_CHILD-4CLASS

policy-map PMAP_CHILD-4CLASS
 class CMAP_CLASS1
  priority percent...
 class CMAP_CLASS2
  bandwidth percent... 
 class class-default
  bandwitdh percent ...

And then the radius server returns an AV pair, matching what the user subscribed for:

Cisco-AVPair = "ip:sub-qos-policy-out=PMAP_PARENT-50M"

To verify, we usually just do

show policy-map interface viX.xx
  • Thank you Marc but it is not an option to manually add the bandwidth, because there are many users and rates change constantly.
    – vlamb
    Commented Jun 16, 2022 at 13:58
  • Manually? That radius attribute is of course taken from the user/customer database. User changes their subscribed rate, entry in the DB is updated instantly, Radius config files follow up a few minutes later, and with the next PPP session, the user's viX.XX gets another egress policy. Commented Jun 16, 2022 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.