Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
13

You definitely should enable MLS QoS. It is also prerequisite for CoPP, which you should add in your TODO list to implement. Enabling 'mls qos' without other config is extremely bad idea in low-end cats, like 3560/3750, due to unexpected default scheduling and due to heavily reduced buffers causing more microbursting. On 7600/6500 it's comparatively safe ...


10

I would use vlan-based policing which works better on these switches. This is an example matching a speed value of 48Mb mls qos ! interface GigabitEthernet1/0/2 switchport access vlan 500 switchport mode access mls qos vlan-based ! class-map match-all CUSTOMER_1 match input-interface GigabitEthernet1/0/2 ! policy-map VLAN500_POLICE class CUSTOMER_1 ...


9

There is loss, you're just not seeing the impact. The display is only showing 155706 input errors out of 46982598919 packets in the previous three days and four hours. This is .0003% packet loss, which is why it's so difficult to see first hand during testing. If you're not seeing any operational impact, odds are that this can be safely ignored. Such a ...


8

You are looking for the "Logical Interface (Aggregate) Policer": http://www.juniper.net/techpubs/en_US/junos11.4/topics/concept/policer-logical-interface-aggregate-overview.html Unfortunately they are only available on EX9200 (which is a castrated MX) if the information on the EX feature page is correct: http://www.juniper.net/techpubs/en_US/release-...


8

7600 QoS is not straightforward. If you enable mls qos on its own you will change the way buffers are allocated on all ports, you may find this gives you unexpected results. Different line cards will have different queueing capabilities, research the following commands to modify the buffer and queueing config. Some line cards are per port and some are ...


7

I don't think egress policing works on this platform, but you'd need to use SRR, and frankly shaping is always preferable when possible. Enabling 'mls qos' willy-nilly on 3750 can be recipe for disaster, the defaults are horrible, e.g. EF gets policed at 4%. So you should at least read: How to maximize available buffers Cisco Catalyst 3750 QoS ...


7

Your burst values look a bit small. Choosing burst values is not easy and testing might be required to get it right. Also if I remember correctly 3750 does not support policing on egress. Bc works a bit different in policing than it does in shaping. With shaping you buffer packets and you have a token bucket where ever Tc (time interval) you have Bc (...


6

Fair Queuing share the link in equal capacity among the different flow. Weighted Fair Queuing give allows schedulers to specify, for each flow, which fraction of the capacity will be given. This prevent a single flow from using all the link bandwidth, effectively denying other flows. But those mechanisms don't provide a priority system (I.E. which flow ...


4

You're seeing CRC and framing errors and general input errors. If this happened while setting up the port this could be caused by people still fiddling with the fiber. If this happens during normal operation most of the time it indicates a low light level or some other error with the fiber(s) or optics. You can check the light levels with show interfaces ...


4

You're configuring it wrong. In order to get policing working on these switches you need to configure the following (I've taken this from a working switch of mine) mls qos ! interface GigabitEthernet1/0/2 switchport access vlan 500 switchport mode access mls qos vlan-based ! class-map match-all CUSTOMER_2 match input-interface GigabitEthernet1/0/2 ! ...


4

I don't have a spare 3750X to validate this with but I think I got it... John Kennedy gave a great answer if you want to give a hard limit to the amount of traffic that Client A and B can send but your question was how to guarantee a minimum amount of bandwidth and still allow bursting if BW is available. In order to accomplish this we will have a policer ...


3

Here is what you can do with a 3750: class-map match-all CLIENT1 match input-interface GigabitEthernet1/0/1 (or match based off AN ACL for the client networks) class-map match-all CLIENT2 match input-interface GigabitEthernet1/0/2 (or match based off AN ACL for the client networks) ! policy-map BW class CLIENT1 police 30000000 500000 exceed-action ...


3

7600 QoS is not straightforward. There is an understatement... @ytti and @Steve have great answers, just also be very aware that the 7600 has rcv-queue interface commands as well. Like the wrr-queue, you will want to make sure that your mutations are correct or you can see drops. Been burned by that one, just make sure you generate enough test traffic to ...


2

One thing to be aware of is that due to the way that the 6500/7600 switches in a distributed fashion if you have more than one port int the Vlan you are wanting to limit spread across different line cards you will have a hard time limiting them to 100mbit as the limit will be applied on each line card.


2

I also had a similar requirement some time back please see this post which details limiting from the tunnel-group which will catch anything going via that specific VPN, cisco-asa-rate-limit-vpn-tunnel Hope this helps, any questions let me know. Please see more details: The tunnel group should already be in place as per the usual config: tunnel-group 85....


2

Sorry I don't have a system actually in front of me to get you actual output, but look for "show qos interface ..." and that should have the configured hardware values for all the QoS parameters. The CLI is going to be something like: show qos interface gigE 0/0/0/0.101 ingress (it might actually be "input" or "output" instead of "ingress" or "egress" ...


2

The mentioned solution in the link will not do the job, you need to do the below: collect the MAC addresses of devices Creating a device group as mentioned by the link: Go to User & Device > Device > Device Groups and create a new group. Add the new device to the Members list with their MAC addresses 3.Create security policy and configure its action ...


1

In some rate-limit devices, limiting is based on a pool of 'credits'; each packet decreases the pool by x credits and the pool of credits is replenished by y credits per second, up to a maximum value z. A connection can use all of its credits as quickly as it likes, but packets will be dropped if there are no credits remaining in the pool. In ...


1

Its seems that your NetScreen has its operational mode configured to route and NAT. In that case, you cannot access any computer in the trust zone by setting the destination IP as 192.168.2.X. In fact the 192.168.2.X net is unreachable from the untrusted interface. In order to fullfill your requirements, you have to configure port forwarding on the ...


1

So you need two dynamic profiles. A VLAN and an IP profile. The VLAN profile is for creating dynamic profiles and the IP profile is for applying filters to them. Notice the use of $junos-underlhing-interface-unit which is basically the dynamically created unit by the VLAN profile. VLAN profile: DYNINTF-VLAN-DHCP-INET-KPN { interfaces { "$junos-...


1

It depends on what the real bottleneck is, where it is located and if you have any QoS treatments in place. Assuming the bottleneck is the available bandwidth by the provider and you have no treatments in place, both packets will exit out of your Firewall and the provider makes a decision on whether to drop the traffic. Both packets ingress their ...


1

Unless your circuit provider is honoring QoS over the entire path between you and the other end of the tunnel, your traffic is at the mercy of the traffic control of every network you transit. Once the traffic enters this uncontrolled space (think the Internet) packet behavior is unpredictable. There is nothing that can be done to prevent packet drops ...


1

First, check if your client has correct routes. Asumming windows, execute route print in cmd. You should see a line containing a route for your LAN throught your VPN interface. Something like 192.168.10.0 (your lan) 255.255.255.0 192.168.10.200 (your VPN asigned IP) Does this route exist on your client routing table? In case not, your SonicWall fw is not ...


1

You've most likely already done this but wanted to ensure you've enabled QOS on the interface or globally by using the command: mls qos


Only top voted, non community-wiki answers of a minimum length are eligible