Limit bandwidth in cisco router with policy-map doesn't work
Sadly the NAT is happening before the policing I believe; thus making all traffic appear as the NAT'ted address instead of the internal address you have specified in your ACL / Class Map.
One idea is to mark the traffic coming in on FA0/0 matching the Ubuntu server with a DSCP value. Then police based on that DSCP value. That will solve your outbound issue.
For downstream I'm not quite sure why that policy is missing. I suspect the NAT issue again even though the order of operations seems to indicate it should be a non factor. http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6209-5.html
If it turns out to be NAT problem for downstream as well, then you can use an outbound policer on fa0/0 and have the same effect of choking the stream down.
Related videos on Youtube
Ahmad
Updated on September 18, 2022Comments
-
Ahmad over 1 year
I have a problem with my scenario in limiting bandwidth of ubuntu PC in GNS3 with class-map and policy-map. this is my topology in GNS3:
-----------cisco-3725-router----------->Internet | | | | | Switch | | | | | | | UBUNTU-PC XP-PC
The R1 is a cisco 3725 router with c3725-adventerprisek9-mz.124-25d.bin image, and this is my configuration:
! ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! ! no aaa new-model ! resource policy ! memory-size iomem 5 no ip icmp rate-limit unreachable ip cef ip tcp synwait-time 5 ! ! no ip domain lookup ! ! class-map match-all UBUNTU_DW match access-group name UBUNTU_DW class-map match-all UBUNTU_UP match access-group name UBUNTU_UP ! ! policy-map UP class UBUNTU_UP police cir 32000 bc 4000 be 4000 conform-action transmit exceed-action drop violate-action drop policy-map DW class UBUNTU_DW police cir 32000 bc 4000 be 4000 conform-action transmit exceed-action drop violate-action drop ! ! interface FastEthernet0/0 ip address 10.0.0.254 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface Serial0/0 no ip address shutdown clock rate 2000000 ! interface FastEthernet0/1 ip address 216.65.200.143 255.255.255.0 ip nat outside ip virtual-reassembly duplex auto speed auto service-policy input DW service-policy output UP ! interface FastEthernet1/0 no ip address shutdown duplex auto speed auto ! interface Serial2/0 no ip address shutdown serial restart-delay 0 no dce-terminal-timing-enable ! interface Serial2/1 no ip address shutdown serial restart-delay 0 no dce-terminal-timing-enable ! interface Serial2/2 no ip address shutdown serial restart-delay 0 no dce-terminal-timing-enable ! interface Serial2/3 no ip address shutdown serial restart-delay 0 no dce-terminal-timing-enable ! ip route 0.0.0.0 0.0.0.0 216.65.200.3 ! ip flow-top-talkers top 10 sort-by bytes ! no ip http server no ip http secure-server ip nat inside source list 1 interface FastEthernet0/1 overload ! ip access-list extended UBUNTU_DW permit ip any host 10.0.0.51 ip access-list extended UBUNTU_UP permit ip host 10.0.0.51 any ! access-list 1 permit 10.0.0.0 0.0.0.255 no cdp log mismatch duplex ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! end
The problem is the 32kbps limitaion for ubuntu does not work.
R1#sh policy-map interface fastEthernet 0/1 FastEthernet0/1 Service-policy input: DW Class-map: UBUNTU_DW (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: access-group name UBUNTU_DW police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps, violate 0 bps Class-map: class-default (match-any) 905 packets, 812409 bytes 5 minute offered rate 27000 bps, drop rate 0 bps Match: any Service-policy output: UP Class-map: UBUNTU_UP (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: access-group name UBUNTU_UP police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps, violate 0 bps Class-map: class-default (match-any) 979 packets, 154180 bytes 5 minute offered rate 7000 bps, drop rate 0 bps Match: any
Is there any wrong configuration? How can I apply this policy?