Alright guys, for me to get a better understanding of something that I'm getting ready to do, I want to open some discussion on the best way to go about it and what the outcome may be. At one of my locations I currently have two Cisco 3745's that each have a connetion to the internet through different ISP's. One is an ATM 4.5Mbit link and the other is a 4.5Mbit multipoint frame link. Both are setup redundant with BGP to fail over between them. Now, at this location, I currently have about 33 branch offices that have GRE tunnels that terminate on another router setting behind these two that comes into the internal LAN. Here's the problem, we have a large contracted Help Desk setup that does Help Desk services for different companies. They are young agents that, with nothing better to do with their time while waiting for phone calls, they have a tendency to download or internet surf to a point that can cause some performance problems for our branch offices that run Citrix over the GRE tunnel. I currently, due to their management not cooperating fully, have a way to police their behavior. What I would like to do is do some traffic shaping on my routers so that I can allow GRE traffic to take precedence over any other traffic on the router so that I can attempt some internal QOS. Now currently I have applied a rate-limit to each WAN interface that drops FTP and TFTP downloads to 64K max.
Now, to make sure that I'm on the same page of music, when I rate limit an interface using the rate-limit command, this applies to the the interface itself no matter how many sessions, correct? In other words if three users were attempting to download a file via FTP at the same time, the maximum bandwidth for this would be 64K.
Next, what would the be the best way to traffic shape the router so that GRE (tunnel) traffic would take precedence over everything else going through the router? What commands would be used? Examples and documentation is a good thing.
Something else I was thinking of, since HTTP downloads and web browsing is synonymous and you can't break one without the other, I was thinking of rate limiting it also. Since the Help Desk is the biggest users of the internet I figured that taking away some bandwidth might help do the trick to. Something like the following applied to each interface.
rate-limit input access-group 199 512000 512000 512000 conform-action transmit exceed-action drop
access-list 199 permit tcp any any eq 80
access-list 199 permit udp any any eq 80
It won't limit the actual HTTP download but it will limit the amount of total bandwidth that can be consumed. My biggest thing like I said though is I need to have GRE traffic take precedence through the routers so that I can give some QOS so that these Help Desk guys don't overload the bandwidth. This is affecting the Citrix performance for our branch offices every time it happens. This way I can guarantee a certain amount of bandwidth for this. This is a semi new arena for me since I haven't done very much of this and I want to make sure that I'm doing it correctly and quickly with as little interference to my branches as possible. I'm open for any and all suggestions at this point. The better an understanding I have, the more the points.
Michael
