Per Wlan - Rate-Limit

Hello, anyone know if its possible to set a maximum bandwidth for the entire wlan or for entire Vlan in the WLC 5508 ?
Thanks

This is a big desire for us too.
You can do this multiple ways on the infrastructure:
if using 6500s, you can use user-based rate limiting
you can do this on various firewall products such as pfsense.
You can use ingress & egress queuing on the switch, but it may not work as desired.
We settled on using ip-nbar & policy routing for now to clamp down on file sharing protocols and also download urls with various extensions such as .iso, .dmg, .zip.....
The challenge we found with per user limiting was that few solutions support the client count/demand that we see.
If your environment is more spread out, you may have better luck with traffic policing and/or shaping at the switch level.
As per wlan rate limiting, it will really depend on your infrastructure hardware & IOS supported functions.
I agree about not shaping over the air, keep as much extraneous traffic off the air as possible.

Similar Messages

  • Per user bandwidth rate limit.

                       How to configure per user bandwidth rate limit for wireless guest client, authentication server is ISE 1.2 & wireless controller is 5760.

    The Cisco 5760 WLC supports better QoS than other c
    ontrollers, allowing prioritization of mission-crit
    ical
    applications:
    ●
    The Cisco 5760 WLC supports four wireless hardware
    queues and priority-based queuing compared to
    software-based queuing in existing controllers.
    ●
    The Cisco 5760 WLC follows MQC based commands, allo
    wing usage of exact commands for configuring
    QoS on different types of network devices.
    ●
    The Cisco 5760 WLC supports QoS policies to be appl
    ied in a hierarchical fashion with more granularity
    per SSID per radio, while on the current controller
    s granularity is per WLAN.
    ●
    The Cisco 5760 WLC supports approximate fair bandwi
    dth to make sure of fairness at client, SSID, and
    radio levels for Non-Real Time (NRT) traffic. There
    fore, if one user consumes excessive bandwidth, we
    can
    limit the amount of bandwidth that user receives an
    d thereby not deprive other users.

  • Can CAR on router rate-limit per address?

    Hi, everyone
    I have a question about CAR on router. The router have a G703 E1 WAn interface and an ethernet interface. My goal is to rate-limiting access-rate of every ip address under ethernet, that is, for example, every PC under the ethernet interface cannot over 1Mb/s.
    Can CAR on the router achieve this goal? If be, how to achieve it?
    Very Thanks.
    Tao

    Farrukh
    Very thanks for your reply.
    My purpose is to put a maximum access-rate limit for every PC in a LAN. So if there are 100 PCs in the LAN, with the above CAR, I have to make 100 ACL, as below:
    access-list 101 permit ip host 192.168.1.1 any
    access-list 102 permit ip host 192.168.1.2 any
    If so, there will be too many acl items. And I don't know how many acl can we applied under FastEthernet0/0. So it maybe unreasonable.
    I know Huawei's Quidway router can support this feature, as below:
    qos carl 1 source-ip-address range 192.168.0.2 to 192.168.0.200 per-address
    I want to know Cisco can support this feature, or have some methods to achieve it.
    Very Thanks
    Tao

  • WLC user rate limit on guest ssid anchor controller

    Hi,
    I have been looking through the forums & some cisco documents but not found a good example similar to what I am seeking to do so now I am turning to the expertise of my peers.
    We have been deploying 3502 APs remotely to locations with full T1s that backhaul to where I sit at HQ.
    Both the foreign and anchor controller are here at my location.
    I am seeking to rate limit per user the bandwidth each client will get on the guest internet ssid.
    As you know this traffic is encapsulated in capwap between the AP and the controller so I cant use a standard ACL on the switch or router.
    We are trying to keep the guest internet access usage in check on the T1 at any given site so the other ssid's & local lan traffic is not overly competing for the bandwidth.
    I found the place to edit the default profiles in the controller but the documentation really isnt clear on best practices.
    So I put it to you my fellow wireless engineers to suggest how you are implementing bandwidth management on your wireless guest internet.
    Thanks guys!           
    Oh and here is my hardware & software levels.
    5508wlc - forgeign
    4402wlc - anchor
    Software Version
    7.0.230.0

    Amjad,
    Thank you for taking the time to respond as well as the document link.
    It was pretty clear on the steps and what it would impact.
    Two things that push me for a different solution (assuming their is one).
    Note The values that you configure for the per-user bandwidth contracts affect only the amount of bandwidth going downstream (from the access point to the wireless client). They do not affect the bandwidth for upstream traffic (from the client to the access point).
    As you can see from the above note taken out of the linked document the roll based rate limit doesnt really rate limit the T1 traffic any guest user consumes it only limits usage from the AP down to the client.
    #1 I am looking for a solution that limits the users up & down streams (if possible) & also before it leaves the AP for the T1.
    The idea is to limit WAN utilization.
    #2 I read in the forums here others asking about the "user role" and saw some comments saying it is not considered "best practice" to use user roles.
    Let me clarify that our guest ssid's are using the http webpage pass through for authentication and it is really only the tic mark to indicate they understand the terms and conditions of using our internet as a guest service. No actual user accounts are used on the guest ssid's.
    ***One last question about this and any other changes***
    Will any change I make be on the "Foreign, Anchor" or both Controllers?

  • Rate-limit command 3560 does it exist?

    I have just come across a command in my router IOS which might be useful too me. I was wondering if the following command is available on a 3560 Switch. I don't see it on my 3550 but the IOS is quite old. I don't have a 3560 avaiable currently to check.
    Config t > int vlan x > rate-limit input/output
    does this exist on the 3560? I am also interest if it does in the Bits per second range and if available input/output.
    Thanks for any help

    Hello,
    what kind of feature are you looking for?
    CAR?
    http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_command_reference_chapter09186a0080087f26.html#wp1037428
    For command list check the following link:
    Catalyst 3560 Switch Command Reference, Rel. 12.2(25)SEE
    http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225see/cr/index.htm
    For QOS configs:
    http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225see/scg/swqos.htm
    If you need to rate limit traffic on an interface check:
    Limiting the Bandwidth on an Egress Interface
    http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225see/scg/swqos.htm#wp1253412
    Hope this help a bit,
    if it does, please rate this post.
    Vlad

  • Rate-limit on eompls VCs

    hello guys,
    is it possible to rate limit an eompls circuit between to PE (rate-limit per VC) ?

    Yes you can try with MQC. Have a class-map which matches any traffic and police the bandwidth
    policy-map l2test
    class l2test
    police 2048000 c t e d
    class l2test
    match any
    Let me know if it works

  • Cisco SG300 VLAN rate-limit

    I have a Cisco SG300 small business switch and 541 APs. There are 2 VLANs in our network. One must be limited by bandwidth. Does anyone have an idea for configure vlan rate-limiting on SG300? And please describe CIR & CBS for me. Thanks.

    http://www.cisco.com/en/US/partner/products/ps10898/prod_command_reference_list.html
    Cisco Small Business 300 Series Managed Switches Command Line Interface Guide Release 1.3
    Select CIR and CBS according to your design. You can use a larger CBS when performance is not ideal.
    49.23 rate-limit (VLAN)
    Use the Layer 2 rate-limit (VLAN) Global Configuration mode command to limit the
    incoming traffic rate for a VLAN. Use the no form of this command to disable the
    rate limit.
    Syntax
    rate-limit vlan-id committed-rate committed-burst
    no rate-limit vlan
    Parameters
    • vlan-id—Specifies the VLAN ID.
    • committed-rate—Specifies the average traffic rate (CIR) in kbits per second
    (kbps). (Range: 3-57982058)
    • committed-burst—Specifies the maximum burst size (CBS) in bytes.
    (Range: 3000-19173960)
    Default Configuration
    Rate limiting is disabled.
    Committed-burst-bytes is 128K.
    Command Mode
    Global Configuration mode
    User Guidelines
    Traffic policing in a policy map takes precedence over VLAN rate limiting. If a
    packet is subject to traffic policing in a policy map and is associated with a VLAN
    that is rate limited, the packet is counted only in the traffic policing of the policy
    map.
    This command does not work in Layer 3 mode. It does not work in conjunction with
    IP Source Guard.
    Example
    The following example limits the rate on VLAN 11 to 150000 kbps or the normal
    burst size to 9600 bytes.
    switchxxxxxx(config)# rate-limit 11 150000 9600

  • 5508-DHCP per WLAN basis

    dear all, 
    kindly guide me  how to configure WLC 5508 internal DHCP  per WLAN basis , i read the following document it is clearly mentioned that we can configure DHCP on WLC 5508 per WLAN basis. but i did not find the configuration  per WLAN basis 
    http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-0/configuration/guide/c70/c70wlan.html#wp1293808
    need your kindly response 
    my email address 
    [email protected]

    When you configure dynamic interfaces on your 5508, you can specify DHCP server IP address. Later on you will map a dynamic interface to WLAN.
    Also under WLAN advanced setting, you can specify DHCP server IP, if you want to override dynamic interface configured DHCP server to a particular WLAN.
    HTH
    Rasika
    **** Pls rate all useful responses ***

  • Upstream traffic rate limit

    Hi all,
    Upstream traffic rate limit is not supported by WLC . It will be done by AP.
    We have setup of Auto anchor for both corporate and guest(but authentication mechanism is diffrent) . They wont access any internal resouce .Only interner traffic is permitted.
    So can we limit the internet traffic for guest users .? If we limiting the upstream traffic at the AP level what would be the concerns we may face?
    Kindly help on this.
    Thanks,
    Regards,
    Vijay

    Hello Vijay,
    As per your query i can suggest you the following solution-
    Please refer table 1 of the given link-
    http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bd3900.shtml
    Hope this will help you.

  • Rate-limit Burst explanation

    Hi All - I need your help to understand the Burst value in the Rate-Limit
    Example: rate-limit input access-group 101 20000000 24000 32000
    I understand the above configuration limit the traffic to 20Mbps. How to calculate the Burst-Normal (as per example above 24000 Bytes) and Burst-Max(as per above example 32000 Bytes). What is the logic for arriving the Burst-Normal & Burst-Max?
    Thanks in advance
    SAIRAM

    Hi Sairam,
    below are definitions of few terms which are involved here
    CIR : committed information rate, in bits per second, defines the rate defined in the traffic contract.
    Tc : Time interval,measured in miliseconds, over which the committed burst (Bc) can be sent.
    Bc : Committed burst size,measured in bits. This is the amount of traffic that can be sent over the interval Tc.
    Be : Excess burst size, in bits. This is number of bits beyond Bc that can sent after a period of inactivity.
    Formula to calculate Bc is 
    Bc = CIR*Tc
    Now to understand Bc and Tc, say suppose you have applied 20mbps rate-limit on a 100mbps fastethernet link. Now link can send data (bits) with clock-rate only which is 100mbps so to achieve 20mbps rate on that link router needs to send traffic for 1/5th of a sec and remain idle for 4/5th of a second. 1/5th of sec is 200 msec. If router will send traffic for 200msec and not sending traffic for next 800msec, it can achieve rate of 20mbps but a packet arrived at 199th sec will need to wait for 800msec and this will add unnecessary latency to the packet. To avoid this, router sends few bits for short duration and then does not send for some duration. For the period it sends traffic is called Tc value. and the number of bytes it can send during that interval is called Bc  value. So CIR = Bc/Tc (bits per interval).
    Now we dont have option to configure Tc but we can configure CIR and Bc, and Tc will automatically be calculated. If we do not configure Bc then router takes default Tc of 125ms and calculates the Bc. 
    What value to choose for Bc
    If we configure Bc too large then Tc will go high for same CIR and this may cause delay or jitter for delay sensitive traffic. For delay sensitive traffic cisco recommends to have Tc 10ms or less.
    If i calculate Tc in the given example, it is coming as 9.6ms which is close to 10ms that is why Bc is set as 24000.
    Tc = Bc/CIR
       = 24000(bytes)/20000000(bits/sec)
       = 192000(bits)/20000(bits/ms)
       = 192/20
       = 9.6 msec
    Now Be is to give extra bandwidth for small interval(Tc) to cater some bursty traffic. Assume there is a bucket which gets filled with Bc amount of token in every Tc interval and router can send traffic if there is sufficient  amount of token available in the bucket, equal to the packet size. After forwarding packet router reduces same amount of token from the bucket. Size of bucket is also equal to Bc which means if there is no traffic for Tc interval, bucket can not hold more token. Be is to increase the size of bucket to (Bc + Be). Now in every Tc interval bucket will be filled with Bc token and if there is a period of inactivity then in next interval bucket can be filled with extra Bc amount of token till it reaches to (Bc + Be) and if there is any bursty traffic (more than Bc) same can be adjusted. So for a very small period router may send traffic with more rate (higher than CIR, since sending Bc+Be in Tc interval) but over a period does not cross CIR.
    You can also use below "Ask the expert" event for QoS to further queries related to QoS.
    https://supportforums.cisco.com/discussion/12259571/ask-expert-quality-service-qos-cisco-ios-routers
    Please dont forget to rate post if it has been helpful.
    Regards,
    Akash

  • Ace Module logging rate limit

    Hi All,
    I have tried to configure the above parameter but it doesn't seem to be working.
    The version running on the ACE is 2.3.4 and I am running multiple contexts.
    The below configuration was tried on one of the contexts, not being Admin.
    The command I used was :
    logging rate-limit 42 60 message 251010
    What I am trying to achieve here is receive notification that a rserver has failed its connectivity check, therefore alerting the relevant people.
    The issue I am encountering is that every second I receive all the alerts again.
    I am only wanting to receive the alert once if possible and gain once the rserver has come back online.
    Is this possible, if so please explain how I can do it?
    TIA.
    Jack.

    your rate limit should be giving you 42 of those messages per 60 seconds. But this is health probe failure which depending on how many does not necessarily mean server is down. (depends on fail count). also it is level 6 message. the message you really want is:
    Error Message    %ACE-4-442001:  Health probe probe name detected real_server_name
    (interface interface_name) in serverfarm sfarm_name changed state to UP
    Explanation    The state of a  real server changed from down to up.
    Recommended Action    None  required.
    442002
    Error Message    %ACE-4-442002:  Health probe probe name detected real_server_name
    (interface interface_name) in serverfarm sfarm_name changed state to DOWN
    suggest you do logging at level 4  and you will only see the message when server state changes

  • Nexus 5548 rate limit

    Hello,
    I am trying to setup a rate limit on fex ports (modl is N2K-C2248TP-1GE ) of a 5548UP (non L3)  -  Software version is : version 6.0(2)N2(2)
    I have tried the following setup without success  :
    ip access-list ACL_CUST
      10 permit ip 10.100.100.1/32 10.100.100.2/32
      20 permit ip 10.100.100.2/32 10.100.100.1/32
    class-map type qos match-all CMQOS_CUST
      match access-group name ACL_CUST
    policy-map type qos PMQOS_CUST
    class CMQOS_CUST
        police cir percent 1 bc 200 ms conform transmit violate drop
    interface Ethernet161/1/11 - 12
      service-policy type qos input PMQOS_CUST
    And also tried to use this confioguration :
    class-map type qos match-all CMQOS_LIMIT_BP_CUST
      match cos 0-7
    policy-map type qos PMQOS_LIMIT_BP_CUST
      class CMQOS_LIMIT_BP_CUST
        police cir percent 1 bc 200 ms conform transmit violate drop
    interface Ethernet161/1/11 - 12
      service-policy type qos input PMQOS_LIMIT_BP_CUST
    The problem is that the bandwith restriction (1 percent of 1Gbit/s shoud be 10Mbit/s) is not working and apparently no restriction is applied
    If someone could help me to resolve this issue it would be greatly appreciated
    I do have followed this guide
    http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/qos/503_n1_1/cisco_nexus_5000_qos_config_gd_503_chapter3.html
    Thanks !

    http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5600/sw/verified_scalability/702N11/b_N5600_Verified_Scalability_702N11/b_N6000_Verified_Scalability_700N11_chapter_01.html
    Maximum FEXs per Switch
    24
    24
    Maximum FEXs dual-homed to a vPC Switch Pair
    24
    24

  • ICMP unreacheble, rate-limit

    Hi !
    I'm currently working on projet of network hardening.
    Based on Cisco security best pratice, I see it's recommand to rate limit genaration of ICMP unreachable message to prevent DoS attack. (according to document : http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080825564.pdf page 74)
    On Catalyst 6509 run IOS 12.2(17r)SX5 I see to possible way to rate-limit ICMP messages if mls QoS is running.
    1- mls rate-limit unicast ip ICMP unreachable acl-drop 100 10 (enable by default, according to document : http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080825564.pdf page 74)
    mls rate-limit unicast ip ICMP unreachable no-route 100 10
    2- ip ICMP rate-limit unreachable <millisecond> (500 ms is default parameters, which permit 2 paquets per seconds, also enable by default if I'm base on : http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml, ACL for IOS section)
    Which one of those command have precedence over the other one ?
    Which one is better over the other one ?
    With the mls rate-limit option, we have the possibility to check default parameter with : "show mls rate-limit" command is exist equivalent for : "ip ICMP rate-limit unreachable"
    We have also Catalyst 3550 switches, on which we have to rate-limit genaration of ICMP unreachable message for same reason as 6509. I understand the :"ip ICMP rate-limit unreachable" command is my only option "under "mls " the only option I have is QoS or aclmerge. Under thoses parameter I have no way to rate-limit ICMP message generation....
    I have check in running-configuration I did not find any reference to ICMP rate-limit command, I hope this is active like explain in document http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml, ACL for IOS section, (Version 12.2(44)SE3) but I would like to be able to confirm if any show command exist to confirm this.
    thanks a lot !

    Hello Marcus,
    On the ASA as you are already aware we only have the choice of modifying the ICMP unreachable rate,
    With the IOS the rate-limit for ICMP unreachable replies  will be rate limited to one every 500ms
    use:
    show ip icmp rate-limit
    Besides that I have not seen any other information that you could customize.
    Regards

  • ICMP unreachable, rate-limit command

    Hi !
    I'm currently working on projet of network hardening.
    Based on Cisco security best pratice, I see it's recommand to rate limit genaration of ICMP unreachable message to prevent DoS attack. (according to document : http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080825564.pdf page 74)
    On Catalyst 6509 run IOS 12.2(17r)SX5 I see to possible way to rate-limit ICMP messages if mls QoS is running.
    1- mls rate-limit unicast ip ICMP unreachable acl-drop 100 10 (enable by default, according to document : http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080825564.pdf page 74)
    mls rate-limit unicast ip ICMP unreachable no-route 100 10
    2- ip ICMP rate-limit unreachable <millisecond> (500 ms is default parameters, which permit 2 paquets per seconds, also enable by default if I'm base on : http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml, ACL for IOS section)
    Which one of those command have precedence over the other one ?
    Which one is better over the other one ?
    With the mls rate-limit option, we have the possibility to check default parameter with : "show mls rate-limit" command is exist equivalent for : "ip ICMP rate-limit unreachable"
    We have also Catalyst 3550 switches, on which we have to rate-limit genaration of ICMP unreachable message for same reason as 6509. I understand the :"ip ICMP rate-limit unreachable" command is my only option "under "mls " the only option I have is QoS or aclmerge. Under thoses parameter I have no way to rate-limit ICMP message generation....
    I have check in running-configuration I did not find any reference to ICMP rate-limit command, I hope this is active like explain in document http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml, ACL for IOS section, (Version 12.2(44)SE3) but I would like to be able to confirm if any show command exist to confirm this.
    thanks a lot !

    This is now showing up with running ssh over this tunnel. I can get the initial connection, but certain commands are not going through.

  • Dynamic ARP inspection rate limit issues with Windows Vista Systems

    Good Day to everybody.
    I had implemented DHCP Snooping & Dynamic ARP inspection feature to mitigate ARP spoofing attacks to one of customer location where we have mix of Windows vista & XP systems. By default DAI feature rate limit ARP packets on un-trusted ports to 15 Packets per second. With this value I was facing some issue to access file shares where port will go in error-disabled state due to ARP broadcast from system was crossing 15 PPS limit of DAI. For the same, I had increased the DAI limit to 64 & after that we had not facing this problem from windows XP systems, but windows vista systems are still giving problem. Also this probem is very random in nature & not all the windows Vista system will face same issue even though they are accessing same file share & are configured with same DAI rate limit.
    That's why I am not able to figure out baseline values for DAI rate limits. I had already search microsoft documentation for limiting this ARP broadcast from Windows Vista system, but no luck.
    Is there any way to find out correct settings for this DAI packet rate limiting in Windows Vista enviorement ?

    Hello bensyseng,
    check out this thread.
    As topmahof said already it could correlate with a wrong Intel driver.
    Follow @LenovoForums on Twitter! Try the forum search, before first posting: Forum Search Option
    Please insert your type, model (not S/N) number and used OS in your posts.
    I´m a volunteer here using New X1 Carbon, ThinkPad Yoga, Yoga 11s, Yoga 13, T430s,T510, X220t, IdeaCentre B540.
    TIP: If your computer runs satisfactorily now, it may not be necessary to update the system.
     English Community       Deutsche Community       Comunidad en Español

Maybe you are looking for