[c-nsp] policing question
Leslie Meade
lmeade at signal.ca
Wed Jul 29 11:30:36 EDT 2009
I have a question, I have over 50 vlans and each needs to be policed at different speeds. I have a cat 6509 with sup32's
Creating access-lists, class maps etc. are no issues for me. To my understanding that I can only police in one direction on any given interface. So I put a service-policy output on a vlan and another service-policy input on the other. But when I add more than 4 class’s to a policy map on my transit internet network it crawls to a dead stop. Anyone tell me why ? I gather the sup32’s/int cannot handle the output. To give you an idea of how much data I push out, in one week I will do over a Terabyte of data.
Here is an example of the standard ACL’s and policy-maps that I am using..
ip access-list extended VLAN14_WWW
10 permit tcp any eq www any
20 permit tcp any any eq www
class-map match-any VLAN14_WWW-CL
match access-group name VLAN14_WWW
policy-map VLAN14_OUTBOUND-PM
class VLAN14_WWW-CL
police cir 2097000 bc 66406 be 66406 conform-action transmit exceed-action drop violate-action drop
policy-map Internet-Access-PM
class VLAN14_WWW-CL
police cir 2097000 bc 66406 be 66406 conform-action transmit exceed-action drop violate-action drop
class VLAN15_WWW-CL
police cir 2097000 bc 66406 be 66406 conform-action transmit exceed-action drop violate-action drop
class VLAN16_WWW-CL
police cir 2097000 bc 66406 be 66406 conform-action transmit exceed-action drop violate-action drop
class VLAN17_WWW-CL
police cir 2097000 bc 66406 be 66406 conform-action transmit exceed-action drop violate-action drop
interface Vlan14
description VFS
ip address 10.1.14.2 255.255.255.0
ip helper-address 10.1.6.10
no ip redirects
no ip unreachables
ip flow ingress
ip route-cache flow
no ip mroute-cache
mls netflow sampling
standby 15 ip 10.1.14.1
standby 15 priority 250
standby 15 preempt
service-policy output VLAN14_OUTBOUND-PM
interface Vlan254
description Transient
ip address 10.1.254.2 255.255.255.0
no ip redirects
no ip unreachables
ip flow ingress
ip route-cache flow
no ip mroute-cache
mls netflow sampling
standby 15 ip 10.1.254.1
standby 15 priority 250
standby 15 preempt
service-policy input Internet-Access-PM
Cheers
Leslie
More information about the cisco-nsp
mailing list