1

I’m the chairman of the wiring committee for a hundred-unit condominium, and not a Cisco expert. We have a trio of Cisco Catalyst 3550 switches, connected to an old Cisco 1417 router, connected to a DSL connection which we realize we need to upgrade. Our consultants configured, but did not enable, policing on each switch, so that each owner gets a guaranteed amount of bandwidth; once I enabled it (with mls qos), this seemed to work as documented: 

policy-map USER_INGRESS
 class ANY
    police 32000 8000 exceed-action drop
policy-map USER_EGRESS
 class DSCP0
    police 96000 24000 exceed-action drop

But we were sold the switches on the basis that rationing would be more flexible when all the bandwidth wasn’t being used up, which this doesn’t seem to do.

Cisco IOS Quality of Service Solutions Command Reference 12.2 seems to suggest that set-dscp-transmit 0 might mark excess packets as best-effort, which I’d hoped would act sensibly at times of low usage. But it looks like this isn’t supported on our switches; trying to enable it gives % Invalid input detected at '^' marker at the beginning of set-dscp-transmit.

I might be able to offer more than just reputation points for hand-holding on followup issues; I’ve got a budget for some consulting hours, and might get approval for ongoing consulting. But for that, since we’ve had some bad experience with previous consultants, and I’m responsible to our directors, you’d need Cisco certification as well as reputation points here, and a public means of verifying your identity and reputation, since at some point I might need to trust you with our passwords.

References

Improve this question
1
  • I’m starting a bounty, for a (perhaps impossible) solution, not just for (no doubt correct) refutations of non-solutions. It is of course possible that the Recurrent consultants sold us the wrong equipment for our goal. This stumped the Cisco Ask The Expert (supportforums.cisco.com/thread/2075425), except for confirmation of the omission of set-dscp-transmit from the 3560 [sic] manual; I’ve re-asked the question in a non-closed Cisco forum, supportforums.cisco.com/thread/2078079.
    – Flash Sheridan
    Apr 9, 2011 at 17:59

4 Answers 4

Reset to default
4

This strikes me as the wrong way to handle traffic shaping in your environment -- you are effectively limiting an unlimited resource (internal bandwidth - on your local switches) to try to prevent exhausting a limited resource (upstream bandwidth - on your DSL line).

Your router (or barring that, a decent router/firewall appliance like pfSense) should probably be doing the traffic shaping. You can assign each unit/owner an IP or subnet, limiting them to a proportionate share of the total bandwidth but letting them borrow from other queues (See http://www.openbsd.org/faq/pf/queueing.html and read about the "borrow" keyword - handy feature!).
As a bonus if you take this route your more tech-savvy residents can share files with each other at wire speed since the switch ports won't be restricted.

A Cisco expert may be better able to advise you on how to set that up for your environment/hardware, or how to accomplish what you're asking for with your existing hardware if possible.

Improve this answer
2
  • Thanks, perhaps we should have listened to you rather than the consultants recommended by Recurrent. (In their defense, switch-port rationing isn’t spoofable, and our experience with the previous HP switches suggested that bandwidth tended to get hogged by one or two evildoers. File-sharing between apartments is a non-goal; another failed justification for upgrading the switches was port isolation.) We will be upgrading our router before too long, but before that, I need to get our current setup working as well as it can.
    – Flash Sheridan
    Apr 6, 2011 at 23:30
  • The switch-based policing actually works quite well, except for its severity; ping times now usually seem quite reasonable, whereas before I enabled QoS, it was often over a second. So we do need a Cisco expert. Employment tip: reliable ones willing to do rather than just talk seem to be remarkably rare, even in Silicon Valley, even in the current economy.
    – Flash Sheridan
    Apr 6, 2011 at 23:30
2

I have experience of these switches and their policing.

IMHO it's not that bad doing your policing (shaping) using the 3550s.

A couple of things to realise. The exceed-action drop isn't that draconian relative to the way other bandwidth throttlers work but it probably won't affect UDP just TCP. It relies on TCP's ability to 'back off' essentially telling the visiting client software that the connection is congested and to send less data. We found it works well, add a reasonable percentage to the peak capacity and you'll find most connections will back off seamlessly.

Be aware that although they let you do ingress and egress filtering there's a limit of eight (yes, really) policies on each device to force you spend a small fortune with Cisco for higher spec devices.

Improve this answer
2
  • Thanks; do you mean that it won’t affect UDP on downloads, since we can’t control what gets sent from outside to our DSL connection? (Presumably we can control what we send from inside.) The eight-policy limit probably won’t affect us; currently we’re only using one for all three switches.
    – Flash Sheridan
    Apr 8, 2011 at 0:43
  • I'm fairly certain that was the case, UDP wasn't policed, but it's over 6 years since I used these switches so I'm willing to be corrected.
    – Jonathan Ross
    Apr 8, 2011 at 6:36
0

Oh also port isolation should absolutely be possible on these switches. I'm an IOS noob too but I think access lists and vlan settings will get you there, a CCNP level cisco guy should be able to configure this easily.

Improve this answer
1
  • Ouch, thanks; the consultants said they realized they couldn’t isolate ports since we had three connected switches. What they ended up doing, to fight rogue routers, was zapping DHCP servers—including both my old Zyxel and the replacement (a Time Machine) which I got when they told me it wasn’t their fault.
    – Flash Sheridan
    Apr 8, 2011 at 0:46
0

The Cisco expert (Sarala Akella, https://supportforums.cisco.com/message/3332606) was wrong; the 3550 does support policed-dscp-transmit, though I haven’t gotten it to work usefully yet, since I need to figure out mls qos map policed-dscp first.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .