Enabling MLS QoS on a production 7600

Question

I am looking at a 7609-S with a RSP720-3CXL running 12.2(33)SRE3.

I have been asked to help with rate limiting some servers attached to a couple of ports running as L2 ports (switchport mode access), so this requires me to apply a policy-map to the L3 SVI that is the default gateway in this VLAN. When enabling the service policy under the SVI interface configuration I received the following error;

router(config-if)#service-policy input PM-LIMIT-100M
Warning (QoS): MLS QoS is disabled, marking/policing will be done after 
enabling MLS QoS globally

I have a looked through the config and sure enough, there is no "mls qos" in the global configuration. What potential issues can happen from enabling this global config command on this production device? I can obviously perform this during scheduled maintenance period for safety, but should it even be attempted at all?

If it makes any difference, there were no class maps or policy maps defined on this router until I logged in, to make one to rate limit the previously mentioned server ports (all ports are Gig, I have been tasked with limiting this SVI to 100Mps for a short period). I trying to use the following configuration;

class-map match-any CM-LIMIT-100M
  match access-group name ACL-SERVERS
!
policy-map PM-LIMIT-100M
  class CM-LIMIT-100M
    police 100000000 18750000 31250000 conform-action transmit exceed-action drop violate-action drop
!
int vlan 123
service-policy input PM-LIMIT-100M
service-policy output PM-LIMIT-100M

I would like to think there is no potential issues that will occur if I enable this, but you never know so I'm all ears!

Answer 1

You definitely should enable MLS QoS. It is also prerequisite for CoPP, which you should add in your TODO list to implement.

Enabling 'mls qos' without other config is extremely bad idea in low-end cats, like 3560/3750, due to unexpected default scheduling and due to heavily reduced buffers causing more microbursting.

On 7600/6500 it's comparatively safe to enable, but of course you can crash your router with 'show run'. I would feel comfortable enough to enable it during production hours.

You should monitor 'show queueing interface X' after enabling to see that you're not dropping anything. Long term, you should design QoS policy and implement it, I recommend using as few queues as possible (and assign 100% of buffer to those few queues). Example of possible QoS policy in WS-X6704-10GE:

interface TenGigabitEthernet4/1
 wrr-queue bandwidth percent 30 40 30 0 0 0 0  ## allocate 3 queues (+implied strictpriority) share buffer 30% 40% 30% on thos three queues
 wrr-queue cos-map 1 1 0 7 # map cos values to queues
 wrr-queue cos-map 2 2 3 
 wrr-queue cos-map 3 1 4 
 wrr-queue cos-map 3 2 6 

For advanced config, you may want to supplement that with 'wrr-queue random-detect' with RED curve per queue+threshold. Be sure to mark your traffic correctly when it enters your network.

Answer 2

7600 QoS is not straightforward.

If you enable mls qos on its own you will change the way buffers are allocated on all ports, you may find this gives you unexpected results.

Different line cards will have different queueing capabilities, research the following commands to modify the buffer and queueing config. Some line cards are per port and some are grouped around the asic

 wrr-queue bandwidth 
 wrr-queue queue-limit
 wrr-queue cos-map

Also note that if you have DFC enabled cards any policers will apply per ingress DFC so you may not get the results you want.

Answer 3

7600 QoS is not straightforward.

There is an understatement...

@ytti and @Steve have great answers, just also be very aware that the 7600 has rcv-queue interface commands as well. Like the wrr-queue, you will want to make sure that your mutations are correct or you can see drops. Been burned by that one, just make sure you generate enough test traffic to validate that everything is working properly since issues with QoS and hardware queues don't really appear until there is load.

Answer 4

One thing to be aware of is that due to the way that the 6500/7600 switches in a distributed fashion if you have more than one port int the Vlan you are wanting to limit spread across different line cards you will have a hard time limiting them to 100mbit as the limit will be applied on each line card.