travisryan

asked on 3/28/2017

Cisco 3750 switch throttling and prioritizing traffic

My company has run of 100 Mbps private between two locations. On either end is a 3750 switch. I believe there is finally enough traffic between the locations that I need to do some throttling and prioritizing so critical applications can still talk during the time our backups run.

I realize this would be better served by plugging both ends into routers but I'd like to try and make it work with the switches as I'd need to change my network architecture around.

Below is my code. My two questions are: 1) The policy is applied to the interface connecting to the fiber, yet when I run sh policy-map int gig 4/0/47 I get 0's for everything like nothing's being processed. 2) How do I prioritize Class A traffic?

ip access-list extended priority_list
permit ip host 15.5.5.31 any
permit ip host 15.5.5.39 any
permit ip host 15.5.5.10 any

ip access-list extended non_priority
permit ip any any

class-map Class-A
match access-group name priority_list

class-map Class-B
match access-group name non_priority

policy-map priority-policy
class Class-A
police 95000000 8000 exceed-action drop
*prioritize this traffic*
class Class-B
police 40000000 8000 exceed-action drop
*do not prioritize this traffic*

int Gig 4/0/47
service-policy input priority-policy

CiscoSwitches / HubsNetworking

Last Comment

travisryan

8/22/2022 - Mon

kevinhsieh

3/29/2017

First of all, you need a policy to classify traffic. You have most of it, but not all of it. My classification policies actually mark traffic with DSCP tags. I don't know if what I have will work.

policy-map classify-policy
class Class-A
class Class-B

! on all interfaces where traffic can arrive on, you need to classify the traffic on ingress
interface range g4/0/1-48
service-policy input classify-policy

! on the egress interface where you want to control the traffic, apply your output policy
int g4/0/47
desc fiber connection to mpls
service-policy output priority-policy

Open in new window

travisryan

3/29/2017

ASKER

Kevin, I'm not sure I follow. I have an access list, a class map, a policy map, then I apply that policy to an interface with these lines:

int gig 4/0/47
service-policy input priority-policy

What else am I missing?

travisryan

3/29/2017

ASKER

These are the guides I used to help me out:

http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/91862-cat3750-qos-config.html
https://supportforums.cisco.com/discussion/10795966/bandwidth-restrict-port-cisco-ws-3750g-12s-12
https://supportforums.cisco.com/discussion/10944941/how-do-i-limit-bandwidth-cisco-3550-switch

All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat

William Peck

SOLUTION

kevinhsieh

3/29/2017

Become an EE member today7-DAY FREE TRIAL

Members can start a 7-Day Free trial then enjoy unlimited access to the platform

Learn why we charge membership fees

We get it - no one likes a content blocker. Take one extra minute and find out why we block content.

Not exactly the question you had in mind?

Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.

ask a question

travisryan

3/29/2017

ASKER

Kevin, on a switch (at least the 3750) you can't put an egress policy on an interface:

LocationASwitch(config-if)#service-policy output priority-policy
police command is not supported for this interface
Configuration failed!
Warning: Assigning a policy map to the output side of an interface not supported

travisryan

3/29/2017

ASKER

Let me also add that from some of my bandwidth monitoring it looks like the policy is in effect eventhough when I run "sh policy-map int gig 4/0/47" it's showing "0 packets, 0 bytes" & "5 minute offered rate 0 bps, drop rate 0 bps" which makes me even more confused.

travisryan

3/31/2017

ASKER

I applied a policy to the other end of our fiber connection between locations thinking this was a directional problem, but that didn't change anything. Also, running a "sh policy-map" on this interface showed the same "0 packets, 0 bytes" results as the other policy. Below is that configuration. Any help is appreciated.

ip access-list extended LocationB_priority_list
permit ip any host 10.1.1.31
permit ip any host 10.1.1.39
permit ip any host 10.1.1.10

ip access-list extended LocationB_non_priority
permit ip any any

class-map LocationB-Class-A
match access-group name LocationB_priority_list

class-map LocationB-Class-B
match access-group name LocationB_non_priority

policy-map LocationB-priority-policy
class LocationB-Class-A
police 95000000 8000 exceed-action drop
*prioritize this traffic*
class LocationB-Class-B
police 40000000 8000 exceed-action drop
*do not prioritize this traffic*

int Gig 1/0/47
service-policy input LocationB-priority-policy

Get an unlimited membership to EE for less than $4 a week.

Unlimited question asking, solutions, articles and more.

travisryan

3/31/2017

ASKER

Since I'm not familiar with any part of the process I'm breaking it down into it's parts. I tried a simple:

ip access-list extended test
permit ip host *computer a* any
deny ip host *computer b* any

conf t
int gig 1/0/40
ip access-group test in

And that works, so I know I've got my ip access list section configured correctly so it has to be something down the line.

travisryan

4/4/2017

ASKER

After speaking to a consultant that specializes in Cisco it seems like he's stumped for the moment as well. That makes me feel better and worse at the same time.

ASKER CERTIFIED SOLUTION

Get an unlimited membership to EE for less than $4 a week.

Unlimited question asking, solutions, articles and more.

travisryan

6/26/2017

ASKER

This was the clear solution to the problem.

Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!

James Murphy