Police and prioritize traffic

i have an mpls service from provider that provides a guaranteed bandwidth of 200 mbps (total) to traffic marked af11 or af12 and best effort for unmarked traffic.
i want to create a marking / policing policy that allows customer to prioritize af11 over af12 in ce facing provider.
ce device should transmit af11 traffic up to 200 mbps and if it exceeds 200 mbps mark down before sending to provider.
if no af11 traffic is present ce device should transmit af12 traffic up to 200 mbps and if it exceeds 200 mbps mark down
before sending to provider.
If both af11 and af12 traffic are present however, af11 should be prioritised over af12 traffic.
i.e. if af11 traffic is at 150 mbps and af12 at 50 mbps and af11 traffic increases to 160 mbps this should now cause af12
traffic in excess of 40 mbps to be marked down before sending to provider.
Not sure if this is possible but would really appreciate your input.

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
I think you'll find the matching rate-limit will "win", i.e. it's not recursive.
I believe I understand what you want to accomplish, but still don't see a way to accomplish it, even across multiple devices.
Also, I cannot see how it can be done with "stock" QoS features, because to do this, a process really needs to analyze a packet stream before it's transmitted. Basically given a set of packets with the AF11 and AF12 markings, you need to "look" ahead at the packets that will "fit" in the Tc for the physical egress rate. Once that's determined, you can allow up to Bc of AF11 packets. If Bc isn't fully consumed by AF11 packets, you allow what's left over to AF12 packets.
Policers/rate-limiters don't look ahead.

Similar Messages

Is Cisco Nexus 5596UP support vlan base Policing and traffic shaping on code NX OS version: 5.1(3)N1(1)

Is Cisco Nexus 5596UP support vlan base Policing and traffic shaping on code NX OS version: 5.1(3)N1(1)
where i couldn't see any police command under the policy map

I have tested this issue on another 5548UP with L3 running the same NX-OS version and get the same problem. Show CDP from the switch is not discovering devices, but the neightbors can see the 5K in question. Reboot sometimes will fix it, but not always. I suspect a problem with the software since that doesn't happen in NX-OS 5.2. The one I am using is
Software
BIOS:      version 3.6.0
loader:    version N/A
kickstart: version 5.1(3)N2(1)
system:    version 5.1(3)N2(1)

Prioritize traffic based on destination IP?

Hi all, we're looking to use an ASA5505 or 5510 as our firewall but want to see if one of them can help us prioritize traffic. I know it does QoS but we're wanting to dedicate x amount of our bandwidth to traffic based on destination IP address. Is that possible and does it take a license upgrade?
Thanks!

Jerry, i would try something like in the second config example I mentioned. keep in mind, if ISP doesn't support marking packets, it may be hard to QoS inbound. if you assign the VOIP traffic high priority, it should go out interface first during congestion. Don't need to dedicate a certain amount of bandwidth in any way. Make sure in the design to keep the VOIP traffic, VPN traffic and User PAT (outbound NAT) traffic on separate IP's. That will help when defining the access-lists. This QoS stuff is kind of tricky and is bit confusing. I have setup a few configs according to the above examples and they _seem_ to work. I ran a policing queue on the edge router for traffic leaving to ASA, and ran a priority queue on the ASA. When i test big download from a major site, which could consume all bandwidth, it doesn't appear to clobber VOIP traffic. The same results apply, when I test a big upload to internet. The QoS stuff is tricky though, and i _didn't_ see what I expected when i use the show QoS commands to see traffic drops, etc. so YMMV!
Take a look at this link for ASA 7.X release, which may give you some ideas:
"QoS based on ACL with VPN Configuration" You can change ACL to include the outside interface IP as long as you have separated the NAT's, VPN, etc. like i mentioend earlier.
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008080dfa7.shtml
Will

(AVC) Is there Any way to prioritize traffic from wireless client (laptop in my case) to AP

Is there any way to prioritize traffic from wireless client (laptop in my case) to AP …. if i explain the issue in a broad way there is no congestion going on in wired network. When multiple users connect to real presence and all share the same AP. they get real-time output over the call BUT if someone start file-transfer over the same AP the real presence call voice/video get stuck.
I applied the AVC feature on WLC but as i tested, i think prioritization from my laptop to AP will not happen and the situation remains same.
Please share if there is any way to prioritize traffic from wireless client (Laptop) to AP only ?

Hi Vinod,
Here is the AVC & QoS interaction for upstream & downstream traffic. For downstream it is important you have configured your WLAN with correct QoS profile & 802.1p values as that play a role even though you marking traffic using AVC.
Upstream1. Packet comes with or without inner DSCP from wireless side (wireless client).2. AP will add DSCP in the CAPWAP header that is configured on WLAN (QoS based config).3. WLC will remove CAPWAP header.4. AVC module on the controller will overwrite the DSCP to the configured marked value in the AVC profile and send it out.Downstream 1. Packet comes from switch with or without inner DSCP wired side value.2. AVC module will overwrite the inner DSCP value.3. Controller will compare WLAN QoS configuration (as per 802.1p value that is actually 802.11e) with inner DSCP value that NBAR had overwritten. WLC will choose the lesser value and put it into CAPWAP header for DSCP.4. WLC will send out the packet to AP with QoS WLAN setting on the outer CAPWAP and AVC inner DSCP setting.5. AP strips the CAPWAP header and sends the packet on air with AVC DSCP setting; if AVC was not applied to an application then that application will adopt the QoS setting of the WLAN.
I am not sure which controller software version you are running. From AVC perspective, it is good if you could install latest NBAR protocol pack (4.1 for WLC 7.5.x code or 6.3 for WLC 7.6.x code) on your controller.
Here is the 7.5.x AVC deployment guide which should help you on this
http://www.cisco.com/en/US/docs/wireless/controller/technotes/7.5/AVC_dg7point5.html
Like others mentioned, it is very little you can do with respect to upstream direction as AVC kicks in only when traffic hits WLC & not at the AP level.
HTH
Rasika
**** Pls rate all useful responses ****

WAAS- Optimization for OCS and Wireless traffic

Hi,
I have been trying to find some information regarding optimization of Microsoft Office Communicator and Wireless traffic across a WAN environment via WAAS and its acceleration/optimization capabilities.
So far, I have seen the case studies section for WAAS but no case offers what I am looking for...
Do you have any information/documentation that can be shared with customers regarding OCS and Wireless as key business application that were benefited after a WAAS deployment?
Thanks
Regards,
M.

Hi Manuel,
Answers for you:
So we can say that wireless traffic across a WAN link could not obtain any benefits from any WAN optimization solution, in this case WAAS?
Ans: Nope. I do nto mean that. What I am trying to say is - it's a different thing. Wireless or no Wireless, optimization can be done when the traffic passes thru edge and core side WAEs. If it passes thru only one WAE, it will go in pass thru.
If a wireless controller at a remote site needs to send traffic to another wireless controller in a centralized or HUB site, can we optimize this traffic or it will just benefit from the overall reduction in bandwidth as a result of any TCP based application getting optimized?
Ans: It really does not matter. The traffic really needs to pass thru WAEs on both sides in order to optimize. Whether it is from wireless controller or from any other devices, it really does not matter. Further the type of traffic and policies on WAEs will determine how much optimization can be done, if any.
OCS uses SIP which is TCP based or ports 506x so I am assuming that SIP could be benfited by WAAS unless OCS uses a secured session were SIP is encrypted.: Yes, WAAS can help you but SIP is a voice traffic and there are default policies like VoIP on WAAS which will pass thru this traffic for port 5060. It's not a good idea to optimize voice traffic due to various reasons.

Local Policies and FlexConnect

Hello,
My customer has a traditional guest access desgin with foreign and anchor WLC without an ISE.
It works fine.
Now he plans to install a new WLC5508 for remote offices.
All APs in these remote offices will be in FlexConnect mode connected to the central WLC which is also an foreign WLC.
The guest traffic is central switched and corporate SSIDs will be local switched.
Now our problem is, is it possible to limit the guest bandwidth on each remote office with different values?
Example:
Office 1: Guest Bandwidth should be 1000k
Office 2: Guest Bandwidth should be 2000k
and so on....
All APs in remote office 1 will be in FlexConnect Group 1 and the APs in remote office 2 in FlexConnect 2.
Further I will create AP Groups for each remote office and add the belonging APs to this AP Group.
Then I will create "local policies" and map the decided policy in AP group to the Guest SSID.
So my question is; is this supported and does it work?
I've read the config guide for 8.0 and didn't find anything about FlexConnect and local policies, I mean there are no Restrictions for Local Policy Classification
Or is there another option available?
thanks
Martin

Thanks for your help Scott. I'm not in full agreement with all you say, but you have helped me figure it out.
You said the article was related only to 802.1x, but the article states that "802.1X is used in the example, but other mechanisms are equally applicable.".
The article you linked regarding FlexConnect groups also states that central switching is only valid in "connected mode", i.e., when the WAN is up.
However, I have found the following, which kind of explains the purpose of a central switched FlexConnect deployment
http://www.cisco.com/en/US/products/ps11635/products_tech_note09186a0080b7f141.shtml#central
Thanks again.

I left my iPhone in bathroom last night and it was gone this morning. I notified the police and no one has turned it in. How do I find it and how do I find my serial number. I went to iTunes on my macbook but could not find a preferences or devices tab

I left my iphone in a bathroom last night and it was gone this morning when it was unlocked. I notified the police and no one turned it in. How do I find where it is located? Also, how do I find my serical number? I went to itunes on my macbook but could not find a preferences or devices button. Finally, I know my password but don't know my apple id. How do I find it?

Answered here:
https://discussions.apple.com/thread/6157706?tstart=0
Don't double post.
To locate the SN:
http://support.apple.com/kb/ht4061

Converting a delete statement using VPD policies and context

Hello,
I'm trying to convert a delete statement in a update statement using VPD policies and context.
+/* Supose the user 'user1' already exists. This is an application user */+
conn user1/pwd
create table user1.test_a (
id                number(4),
description       varchar2(100),
deleted           number(1)
+);+
alter table user1.test_a add constraint test_a_pk primary key (id);
insert into user1.test_a (1, 'abc', 0);
insert into user1.test_a (2, 'def', 0);
commit;
I'd like to convert each physical deletion into a logical deletion: statements like "delete from user1.test_a where id = 1" must be converted into "update user1.test_a set deleted = 1 where id = 1".
I've found the following way: I will create a policy to avoid physical deletion. Additionally, the policy function should update the deletion flag too.
conn user1/pwd
+/* Create context package */+
create or replace package user1.pkg_security_context is
procedure p_set_ctx(
i_test_a_id      in   user1.test_a.id   %type
+);+
end;
+/+
create or replace package body user1.pkg_security_context is
procedure p_set_ctx (
i_test_a_id      in   user1.test_a.id   %type
+) is+
begin
dbms_session.set_context( 'user1_ctx', 'test_a_id', i_test_a_id );
end;
end;
+/+
show errors
+/* Create trigger to set the context before deletion */+
create or replace trigger user1.test_a_bef_trg
before delete on user1.test_a
for each row
declare
pragma autonomous_transaction;
begin
-- only commits the preceding update, not the delete that fired the trigger.
commit;
user1.pkg_security_context.p_set_ctx( :old.id );
end;
+/+
show errors
create context user1_ctx using user1.pkg_security_context;
+/* Policy function */+
create or replace function user1.f_policy_chk_dels (
object_schema in   varchar2,
object_name   in   varchar2
+) return varchar2+
is
out_string                 varchar2(400)   default '1=2 ';
+/*+
* out_string is the return value.
* - 'WHERE 1=2' means 'nothing to access'
begin
if ( loc_logged_usr_authorized > 0 ) then
+/*+
* Set the flag deleted to 1
update user1.test_a set deleted = 1 where id = sys_context( 'user1_ctx', 'test_a_id' );
out_string := out_string || 'or 1=1 ';
end if;
return out_string;
end;
+/+
show errors
+/*+
* Create policy
begin
dbms_rls.add_policy(
object_schema   => 'user1'                   ,
object_name     => 'test_a'                  ,
policy_name     => 'policy_chk_dels'         ,
function_schema => 'user1'                   , -- function schema
policy_function => 'f_policy_chk_dels'       , -- policy function
statement_types => 'DELETE'
+);+
end;
+/+
When I try to delete a record of the table test_a:
conn user1/pwd
SQL> delete from ilogdia.oplsimulaciones sim       where sim.id = 9999;
+0 rows deleted+
No rows has been deleted, but the update stmt does not work. That means, the "deleted" flag has not been updated.
Any ideas?
Thank you in advance.
Marco A. Serrano
Edited by: albrotar on Oct 15, 2012 8:42 AM
Edited by: albrotar on Oct 15, 2012 8:42 AM
Edited by: albrotar on Oct 15, 2012 8:43 AM

The policy function is applied once per statement execution. The policy function executes first and the UPDATE statement, presumably, updates no rows because the context is not yet populated. The row-level populates the context (I'm assuming that your session can even see context values populated by an autonomous transaction-- I would guess it could but I'd have to test that) after the UPDATE statement is already complete. The COMMIT in the row-level trigger is also pointless-- it only applies to changes made by the current autonomous transaction, of which there are none-- it cannot apply to changes made in other autonomous transactions. Declaring the row-level trigger to use autonomous transactions doesn't seem to accomplish anything other than to open the question of whether the values set in the context by the autonomous transaction are visible in the caller's transaction.
Even if this, somehow, did work, using autonomous transactions would be a very bad idea since Oracle is free to roll-back a partially executed statement (and the work done by its triggers) and re-execute it. Oracle does that with some regularity to maintain write consistency.
Justin

My ipad was stolen. I reported it to the Toronto Police and put it as lost mode. Now what?

I reported it to the Toronto Police and put it as lost mode. Now what?

If the iPad was running iOS 7, the thief will not ever be able to use it.
iCloud: Find My iPhone Activation Lock in iOS 7
http://support.apple.com/kb/HT5818
Apple (and no one else) can not assist (with serial number or iCloud) in finding a lost or stolen iPad.
Report to police along with serial number. Change all your passwords.
These links may be helpful.
How to Track and Report Stolen iPad
http://www.ipadastic.com/tutorials/how-to-track-and-report-stolen-ipad
Reporting a lost or stolen Apple product
http://support.apple.com/kb/ht2526
What to do if your iOS device is lost or stolen
http://support.apple.com/kb/HT5668
iCloud: Locate your device on a map
http://support.apple.com/kb/PH2698
iCloud: Lost Mode - Lock and Trace
http://support.apple.com/kb/PH2700
iCloud: Remotely Erase your device
http://support.apple.com/kb/PH2701
Report Stolen iPad Tips and iPad Theft Prevention
http://www.stolen-property.com/report-stolen-ipad.php
How to recover a lost or stolen iPad
http://ipadhelp.com/ipad-help/how-to-recover-a-lost-or-stolen-ipad/
How to Find a Stolen iPad
http://www.ehow.com/how_7586429_stolen-ipad.html
What NOT to do if your iPhone or iPad is lost or stolen
http://www.tomahaiku.com/what-not-to-do-if-your-iphone-or-ipad-lost-or-stolen/
Apple Product Lost or Stolen
http://sites.google.com/site/appleclubfhs/support/advice-and-articles/lost-or-st olen
Oops! iForgot My New iPad On the Plane; Now What?
http://online.wsj.com/article/SB10001424052702303459004577362194012634000.html
If you don't know your lost/stolen iPad's serial number, use the instructions below. The S/N is also on the iPad's box.
How to Find Your iPad Serial Number
http://www.ipadastic.com/tutorials/how-to-find-your-ipad-serial-number
iOS: How to find the serial number, IMEI, MEID, CDN, and ICCID number
http://support.apple.com/kb/HT4061
 Cheers, Tom

Can an Ironport work in both WCCPv2 and L4 Traffic monitoring modes at the same time?

Hello Ciscoers,
We have an ironport installed and we use WCCPv2 to redirect the traffic. And as it occurs, I have a need to forward the traffic for another network, that uses another path to the Internet.
So I was thinking using the L4 Traffic Monitoring.
To the best of your knowledge, is there a way to have the appliance use both WCCPv2 and L4 Traffic monitoring at the same time? From the configuration, it's one or the other.
Thanks,
J.

Ok. I'll try.
As a matter of fact, I plan to use policy-based routing to forward all the "interesting" traffic to the appliance.
For your TCP-Resets not seen, do you allow ingress on the span session?
J.

Copp and management traffic

Good afternoon fellow Ciscorians.
I have configured a Copp to rate limit ICMP traffic and fragmented traffic from saturating the RP via the control-plane and also ignore the same traffic class from our trusted IP addresses. But i am wondering about management traffic such as telnet and SSH, we have an access list on the VTY lines dropping traffic from un-trusted sources on 22+23, i am wondering what the benefits are to employing a Copp policy as well as the access-list on the VTY lines?
Could an attack still saturate the RP with an access-list dropping the un-trusted traffic on the VTY lines? (6509-Sup720)
Matthew.

Hi Matthew,
access-list applied on interface is applicable for all traffic, data traffic (transit traffic) and control-plane traffic (destined to router or punted to RP), while CoPP is only applicable to traffic punted to RP.
Access list will either permit or drop but CoPP is service-policy and you can rate-limit the traffic. So if we take example of ICMP traffic, and requirement is we want to allow ICMP traffic to router (ICMP is useful tool to check reachability and latency) but not more than 500kbps (to avoid any DDOS attack), in this case blocking ICMP with ACL on interface will not solve the purpose but CoPP will do the job.
If you are blocking some traffic via ACL, it should not saturate the RP.
--Pls dont forget to rate helpful posts--
Regards,
Akash

SRP521W - Local and Remote Traffic Cannot be the Same Subnet Address

I support an existing VPN infrastructure with PIX, Juniper NS5GT, and Netopia devices used as VPN endpoints. In all cases, I can create a VPN where the location's internal subnet, 10.x.y.0/24 sends traffic to 10.0.0.0/8 out the VPN tunnel. In the case of this 521W that we are evaluating, it appears that I cannot do this. Insteadm when creating the IPSEC policy I get this error "Local and Remote Traffic Cannot be the Same Subnet Address." Which, while strictly true, has never been an issue with all the above devices. Is there a workaround or other methodology to support this?
Thanks.

We have extactly the same problem with the SRP527W. Other Cisco small business products work like.
Cisco RV 120W
http://www.cisco.com/en/US/products/ps10852/index.html
Cisco WRV210
http://www.cisco.com/en/US/products/ps9929/index.html
We need a device with that supports one IPSec VPN and one ADSL interface and is easy to use like these devices.

Understanding (default) archiving and retention policies and tags

I am taking a look at archiving and policies and tags and am a bit confused.
If I look at the "Default Archive and Retention Policy", I see a lot of Tags assigned to this policy. On the Mailboxes tab, I see no mailboxes listed.
although no mailboxes are listed in there, are all users that (will) have archive enabled still using this default Policy?
I see a lot of Personal Tags in there assigned. 1 Month Delete, 1 Week Delete; Are all these tags active, or is the list you see there all tags that a user CAN personally use and assign to his folder?
For example, what does the tag do: "1 Month Delete", Personal Tag, Delete and Alllow Recovery, Age limit for Retention 30, Retention Enable True?
there is also a tag called "Default 2 year move to archive", with type All other folders in the mailbox. Does this mean that all users that have this policy assigned, that all their mail older than 2 years will be moved to their archive? Or can
the user enable this tag?
The longer I look at this list, the less I understand.... Maybe someone can give a short explanation?
Thanks!
Olaf

Hi,
For the question 1:
Yes. Exchange Setup creates the retention policy Default Archive and Retention Policy. When you enable a personal archive for a mailbox, the Default Archive and Retention Policy is automatically applied to the mailbox if it doesn't already have a retention
policy.
For the question 2:
Users can apply these personal tags to folders they create or individual items.
For the question 3:
First, we should know what the "Delete and Allow Recovery" retention action do.
Delete and Allow Recovery: This action emulates the behavior when the Deleted Items folder is emptied. Tags that have this action applied are known as deletion tags. When this action occurs, and deleted item retention is configured for the mailbox database
or the user, messages move to the Recoverable Items folder. The Recoverable Items folder (previously known as the dumpster) provides the user another chance to recover deleted messages.
So about the tag you mentioned above, it's a personal tag, when a mailbox item reaches its retention age(here is 30 days), the items will be deleted in the source folder and moved to the Recoverable Items folder.
For the question 4:
If you choose the type "All other folders in the mailbox", then this would be a Default Policy Tag (DPT). This DPT is applied to all other items where a RPT is not applied.
For example, if you have created a retention policy tag and apply it to default folder Inbox, then Inbox folder won't be affected by a default policy tag whose type is "All other folders in the mailbox".
Please note that a mailbox can't have more than one retention policy. If you later apply a retention policy to the mailbox, tags from the Default Archive and Retention Policy are no longer available to the mailbox.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Best way to pass IPv4 and IPv6 traffic over a GRE Tunnel

Hello,
We have two 3825 routers with Advanced Enterprise IOS 12.4.9(T). Each of them serves many IPv4 (private and public) and IPv6 networks on their respective site.
We have created a wireless link between the two, using 4 wireless devices, with IP Addresses 10.10.2.2, 3, 4, 5 respectively (1 and 6 are the two end Ethernet interfaces on the routers).
Then we created a GRE tunnel over this link using addresses 172.16.1.1 and 2 (for the two ends) to route traffic over this link.
Now we want to route IPv6 traffic over the same link. However, we found that simply routing the IPv6 traffic over the above GRE / IP tunnel did not work.
Questions:
Is there a way we can use the same (GRE / IP) tunnel to transport both IPv4 and IPv6 traffic?
If not, can we setup two GRE tunnels over the same wireless link, that is, one GRE / IP for IPv4 traffic and a second one GRE / IPv6 for IPv6 traffic?
In brief, what is the suggested way to transport IPv4 and IPv6 traffic over the aforementioned (wireless) link?
I have read http://www.cisco.com/c/en/us/td/docs/ios/12_4/interface/configuration/guide/inb_tun.html#wp1061361 and other Internet material, however I am still confused.
Please help.
Thanks in advance,
Nick

We have set up two tunnels over the same link, one GRE / IP for the IPv4 traffic and one IPv6 / IP ("manual") for the IPv6 traffic. This setup seems to be working OK.
If there are other suggestions, please advise.
Thanks,
Nick

Can apple help me find my iPod touch 5g??? I have already reported it to the police and they haven't called back, i also have the find my iPhone app in it but I don't have the location thingy turned on so what else can I do to locate it pleazz help

Can apple help me find my iPod touch 5g??? I have already reported it to the police and they haven't called back, i also have the find my iPhone app in it but I don't have the location thingy turned on so what else can I do to locate it pleazz help this iPod is relly valuable to me I had gotten it for Christmas and now I proved that I can't be trusted with it HELP :c

Police don't "track down" lost items, per se. They'll keep your information on file in the event that someone finds your iPod and turns it in. Otherwise, there's nothing the police can or will do in regards to finding lost property.
Sorry, but your iPod is most likely gone for good.
Regards.

Police and prioritize traffic

Similar Messages

Maybe you are looking for