Rate Limiting

Hi to All
I hav a 128k DSL link, and i want to use 64k to my smtp traffic and rest 64K to the rest of traffic.
Please help me in this matter

Here's how you could do it:
class-map smtp
match protocol smtp
policy-map PolOut
class smtp
bandwidth 64
interface atm0.32
ip address x.x.x.x y.y.y.y
pvc 1/32
vnr-nrt 128 128 1
service-policy output PolOut
Pls do remember to rate posts.
Paresh

Similar Messages

Rate limiting on Catalyst 2950T switches

Hi,
I would like to allow some users full access to internal servers, but only provide them with 2 Mbps access to the Internet. As far as I understand I cannot use the deny statement when defining the access-list for the class-map and therefore I am asking for your help. (The config below work well for rate-limiting all traffic, but I would need full access for traffic matching access-list 111):
access-list 111 remark [ Traffic not to be rate limited ]
access-list 111 permit ip 10.0.0.0 0.255.255.255 192.168.0.0 0.0.255.255
access-list 112 remark [ Traffic to be rate limited ]
access-list 112 permit ip 10.0.0.0 0.255.255.255 any
class-map match-all Internet-Class
match access-group 112
policy-map Internet
description [ Rate limit Internet access ]
class Internet-Class
police 2000000 65536 exceed-action drop
interface FastEthernet0/1
service-policy input Internet
interface FastEthernet0/24
service-policy input Internet
Any help would be very appreciated!
Regards,
Harald

Thanks again for the reply!
My "working" configuration is as follows:
access-list 111 remark [ Traffic not to be rate limited ]
access-list 111 permit ip 10.0.0.0 0.255.255.255 192.168.0.0 0.0.255.255
access-list 112 remark [ Traffic to be rate limited ]
access-list 112 permit ip 10.0.0.0 0.255.255.255 172.16.0.0 0.0.255.255
class-map match-all Local-Class
match access-group 111
class-map match-all Internet-Class
match access-group 112
policy-map Internet-Policy
description [ Rate limit Internet access ]
class Internet-Class
police 2000000 65536 exceed-action drop
class Local-Class
police 98000000 65536
interface FastEthernet0/1
description [ Local LAN facing interface ]
service-policy input Internet-Policy
interface FastEthernet0/24
description [ Internet facing interface ]
service-policy input Internet-Policy
However, I would like to change "172.16.0.0 0.0.255.255" in access-list 112 to "any" since it should apply to all Internet traffic. If I try to do that I get the mask error I previously mentioned.
Regards,
Harald

Policy-map based rate-limiting per vlan

Hi
I was thinking if someone could help me to come up with solution to a problem. Scenario as follow:
I have a trunk interface with multiple vlans on:
interface GigabitEthernet2/0/3
description TRUNK-to-*********
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 415,416,610,1191-1193,1195
switchport mode trunk
duplex full
storm-control broadcast level pps 1k
storm-control multicast level pps 3k
storm-control unicast level pps 250k
storm-control action trap
spanning-tree portfast trunk
spanning-tree bpdufilter enable
I'm trying to rate limit two of the vlans that are present on this trunk interface - vlan 415 and vlan 1192.
So I'm putting the class-map (to be later applied under the policy-map which is not significant here):
(config)#class-map match-any 120-mbps-class
(config-cmap)#match input-interface vlan 415
(config-cmap)#match input-interface vlan 1192
Now, when you show the class-map I created, I can see this:
sh class-map 120-mbps-class
Class Map match-any 120-mbps-class (id 1)
   Match input-interface Vlan415
   Match input-interface FastEthernet0
For some bizzare reason class-map is matching the Fa0. I have researched this, and this is most probably because you can only match 1 vlan instance under the class-map.
And here's my problem - I can't police whole interface as the other vlans should not be policed - how can I police those two vlans ?
Any thoughts ? All help appreciated as always.
Rob.

Hi Daniel,
I have labed it and unfortuantely it does not work as expected. I have put 1x 3750 and 1x 2960 trunk between them, each box had an access port for laptop to create some traffic across. All vlan-based qos has been applied on 3750G.
3750G config
Interface g1/0/20
descriprion trunk
swicthport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 100,120
Interface g1/0/1
description access
switchport mode access
switchport access vlan 100
Interface vlan 100
ip address 192.168.100.254
service-policy input PARENT-POLICER
Interface vlan 120
ip address 10.10.10.1
Policy-map PARENT-POLICER
class PERMIT-ANY-CLASS
trust COS
service-policy CHILD-POLICER
class-map match-any PERMIT-ANY-CLASS
match access-group name POLICY-LIST
Extended IP access list POLICY-LIST
    10 permit ip any any
Policy-map CHILD-POLICER
class INTERFACE-POLICE-CLASS
police 100000 8000 exceed-action drop
Class Map match-any INTERFACE-POLICE-CLASS
Match input-interface GigabitEthernet1/0/20
2960 config:
interface g0/20
switchport mode trunk
switchport trunk allowed vlan 100,120
interface g0/1
switchport mode access
switchport access vlan 100
interface vlan 100
ip address 192.168.100.253
interface vlan 120
ip address 10.10.10.2
So as you can see vlan 100 is the one it need to be rate limited (I have only rate limited to 100kbps just to see if it's working) and vlan 120 is only on the trunk ports to confirm if the traffic for this one is not affected.
Unfortunately when the policing is applied on 3750 vlan 100 (and policing is working fine) then I can see the packet loss while pinging between switches on vlan 120 suggesting that the policy is affecting the other vlan as well. When I take the policy out of the vlan 100 I cannot observe the packet loss on vlan 120 meaning is no longer affected.
Not sure if I have explained this clear enough so far, if not let me know.
Do you have any suggestions ?
Thanks!

EMAIL RATE LIMITATION error msg

I sent an email to my sis [whom I email on a regular basis] and 3 days later it came back undelivered with the following message:
Temporary error returned by SMTP partner.
smtp;421 RP-001 The mail server IP connecting to Windows Live Hotmail server has exceeded the rate limit allowed.
Reason for rate limitation is related to IP/domain reputation problems.
Does this mean I might have a virus that's using my email client to spam other people? What does it mean?

A valid email address should have the form "[email protected]" with only one "@" character and no spaces.

Major bug in SMTP rate-limiting implementation

I use my home computer to, among other things, host a mailing-list for a fan-club of a contemporary Russian poet. The total list of subscribers is about 40 people and messages are, on average, rare.
However, when a discussion picks up, the number of e-mails can briefly spike easily exceeding Verizon's "you must be spamming" threshold. Imagine: one person asks a question and two others respond. Both the question and the responses get sent to the list, so that's 3x40=120 e-mails. If the discussion gets any longer, the e-mail account gets suspended for several days for exceeding the quota...
I understand, why Verizon rate-limits the outgoing e-mail sending and don't object to it in principle. However, the current implementation has a major flaw. When the threshold is exceeded, instead of blocking all subsequent messages with a permanent error (5xx in SMTP-speak), the server ought to issue a temporary failure (4xx in SMTP-speak).
This would block any spam-bots just as effectively, but allow legitimate messages to be properly queued by the sender's computers for resending. The 5xx code signals a permanent error so instead of being queued, the innocent message is suddenly bounced.
A friend of mine is an RCN-subscriber and we know, that RCN implements rate-limiting exactly this way: if you are sending "too much", your messages will start being temporarily rejected for a while.
Solved!
Go to Solution.

Anthony, this is not a "disagreement" -- I'm pointing out a bug. The bug manifested itself with the following two problems:
Although none of the e-mails sent by my computer were spam, I was "identified" as a spammer and my access to SMTP was suspended for days. For no good reason.
Even if it were possible to appeal such automatic verdict (and I did try to talk to a customer support representative), permanent rejections in the case of a temporary error are wrong -- and in violation of SMTP specifications.
I did post the same text under the "New Ideas", but I don't think, "new idea" is the good place for this. I'm not suggesting a new service, but demanding a fix to the existing one.

Current outbound rate limiting capabilities

Hello All,
I have recently reviewed this thread from back in January-March: https://supportforums.cisco.com/thread/2002325?tstart=60 . I have been facing the same predcament decrsibed be people in this thread. That being end user machines get compromised and then send out large volumes of spam via legitimate accounts on our servers. In our cases, the outbound from addresses have all been the actual user address. The end user environment is ActiveDirectory & Exchange.
If I cannot rate limit based on a sender address, then I am wondering if the 370D model would allow me to somehow define virtual gateways which would correspond to users found within a specific portion of my Active Directory environment. For example, if all sales dept. staff were within a single AD OU, could I create a virtual gateway that corresponds to just these people and have that gateway set with different rate limits than another gateway which corresponds to a different group of users?
Lastly, is it possible with any of the appliance models to define specific outbound rate limits for recipient domains? For example, messages destined for hotmail.com would have a different rate limit than messages destined for gmail.com. Would this functionality work with mixed recipient domains in the To: field?
Thanks,

Yes, you can define outgoing mail policy or outgoing content filter based on sender's LDAP group (e.g. CN=West,OU=Sales,....) and then use a filter action "Deliver from IP interface" to choose to deliver the emails from selected IP interface.
You can define delivery rate limit based on destination domain under 'Mail Policies'-'Destination Controls'.
I recommend to enable antispam scanning for outgoing emails. You can add custom header if the message is a positively-identified spam. Then you can use an outgoing content filter action to redirect spams to be delivered from another IP interface or another mail host if outgoing message contains the custom header. This can allow good and bad emails to be delivered from different IP interfaces.

WLC - Rate-limiting with QoS Roles

We have a large number of locations that we would like to deploy the 2100 series wireless controllers. Among other things, we would like to provide generic rate-limiting to all users(per-user bandwidth limits). This is a hospitality guest access environment and content filtering is really not a concern. We would, however, like to prevent one or a few users from saturating the circuit at the expense of other users. It looks like the WLCs can handle this with a QoS Profile assigned to the guest wlan and bandwidth-limiting QoS Roles applied to each user. The issue we may run into is web-authentication needs to be disabled. There is another device on these locations that will be providing those services.
Is it possible to apply a QoS Role by default to all users who associate to a controller without authentication? Also, if anyone has attempted this design model I would greatly appreciate some input on any unexpected or undesirable results you may have noticed.
I appreciate everyones help.

Thanks so much for such a quick response. I may be misunderstanding some of the documentation and would really appreciate some clarity. I am understanding a QoS Profile to be applied to one or more WLANs and all user traffic from clients of those WLANs will fall under the qos policy as a group(bandwidth limitations would be applied to all of the user traffic combined). For example, a profile capping downstream bandwidth at 1544kbps would limit all user traffic from all of the clients associated to that ssid at 1544kbps. If we were to assume some degree of fair bandwidth distribution and there are 10 users receiving traffic at a given time, then each user would receive no more than 154.4kbps. Or, are QoS Profiles actual templates that are applied to each user that associates to that ssid? For instance, if we consider a profile capping 1544kbps downstream applied to a WLAN with 10 users associated. Each user would be able to download up to 1544kbps and the full bandwidth usage for that WLAN would be 15440kbps.
Thanks again for your help.

Virtual WLC 7.5 - AP Enforced Rate Limiting

In the vWLC 7.5 deployment guide in the enhancments section, there is a feature called "AP Enforced Rate Limiting"
But I cannot find any information beyond that.
Here is the guide:
http://www.cisco.com/en/US/docs/wireless/controller/technotes/7.5/Cisco_VirtualWirelessController75.html#wp43370
Looking how this might be implemented.
In particular to rate limit traffic by WLAN.
My understanding is that the Bandwidth Contracts under the WLAN QOS settings do not apply.
Thanks

Rate limiting is enforced at the AP level. It is not possible to enforce rate limiting at the virtual controller level because per client downstream rate limiting is not supported for central switching WLANs when traffic is terminated at the virtual controller.
Per client downstream rate limiting is supported if the virtual controller is a foreign controller tunneling traffic to another controller platform, for example, a Cisco 5500 Series Wireless LAN Controller.
Table 3 Rate Limiting with Cisco Virtual Wireless LAN   Controller
Traffic
FlexConnect   Central Switching
Flex   Connect Local Switching
Flex   Connect Standalone
Per client Downstream
Not Supported
Supported
Supported
Per SSID Downstream
Supported
Supported
Supported
Per client Upstream
Supported
Supported
Supported
Per SSID Upstream
Supported
Supported
Supported
Please check the below guide which may be helpful for you
http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn75.html

Rate Limiting - Will Content Engine 590 solve my problem?

We have a Cache Engine 550 deployed in our network which is great for reducing traffic on the Link to the Internet, however I have now run into a little problem with the device as we are now trying to implement Bandwidth Shaping using the existing Cisco infrastructure and thus the Cisco IOS.
One of the IOS features concerned is Committed Access Rate (CAR).
We would like to do some traffic shaping according to certain IP Protocols such as FTP, HTTP as well as rate limiting certain of our customers (IP Blocks) so that they dont saturate the Serial link to our ISP.
The problem we have is that the Cache Engine 550 replaces the original requestors IP with its own as it (the CE) now takes over as the requestor to the Internet thus we have all HTTP traffic via our ISP having the source as that of the Cache Engine.
Due to this we cannot Rate-Limit a particular customer (IP range).
Question-------
Does the Content Engine 590 (ACNS, ICDN) enable me to complete my task and control the Serial connection the way I would like to?
Can I do a sort of IP Spoofing so that the original IP is still in place, but the Content Engine still does its job of Caching?
I have already looked at the Packeteer unfortunately it only has Ethernet ports.
The WiseWan 401 with HSSI port looked promising, but I feel that even though it will do great shaping and graphs it will still not solve the problem of a saturated link upstream to the ISP (from the boxes point of view), I will still sit with packets being dropped and thus bandwidth wasted.
Anyone out there with any other solution?
Thanks in advance.
Lutz.

Hi,
We have just implemented IP spoofing in version 4.2 of ACNS code. (Caching) which will only run on a 590/560/507/7320 cache.
Version 4.2 sould be available at the end of July early August. This will slove you problem with identifing traffic to rate limit.
Cheers
Phil

Cisco firewall rate limited syslogs and MARS

We're getting a ton of informational packets (tcp build / teardown) from firewalls here. I can kill this at the source (drop to "notification" level, filter out the build / teardown events, etc.) but would rather not throw this stuff away (good clues in an investigation).
I can filter this on the MARS side so rules don't fire, but that doesn't address the performance hit at the firewall, or the traffic on the network.
I can rate limit at the firewall - if I do will MARS be able to parse this out properly - i.e if there's a rule that fires on a 100 count for example, and a firewall that's set to rate limit a certain event to, say, every 200 instances of the event, and single syslog shows up at MARS with rate limited information in the packet, will the MARS rule fire?
hope this makes sense - thanks

What kind of firewall are you running? ASA? FWSM? Something else?
If you're running an ASA, the ideal solution would be to implement Netflow Secure Event Logging (NSEL). This feature uses Netflow v9 to handle security event logging along with traffic flow data. Using NSEL can provide performance improvements over syslog, both on the ASA, and on your network.
Part of the configuration process includes a command to disable the redundant syslog types already handled by NSEL. Many of those are the same types of logs you mentioned (buildups/teardowns, etc). It's very simple to configure - you can read more about it here, in the ASA 8.2 CLI Configuration Guide:
Configuring Network Secure Event Logging (NSEL)
If you're running a FWSM, the same option isn't available. Instead, you might want to reconsider disabling some of the log types that aren't really providing much benefit relative to the load. In fact, Cisco themselves recommend disabling some of the more unimportant (but frequent) log types.
From the "Cisco SIEM Deployment Guide", one of the "Smart Business Architecture" design guides (emphasis mine):
At logging level Informational, Cisco recommends disabling the following messages, as they are of little interest for SIEM analysis: 305010: The address translation slot was deleted 305011: A TCP, UDP, or ICMP address translation slot was created 305012: The address translation slot was deletedTo disable these messages, use the following configuration commands: no logging message 305010 no logging message 305011 no logging message 305012For more aggressive tuning, you may also consider disabling the following messages: 302014: A TCP connection between two hosts was deleted 302016: A UDP connection slot between two hosts was deletedIf dynamic Network Address Translation (NAT) is not configured on the appliance, message 302013 (for TCP connection slot creation) can also be disabled.
So, that's at least 6 possible log types that can be disabled with no impact: 302013, 302014, 302016, 305010, 305011, and 305012. And that's straight from Cisco's own documentation.
Now, to expand on that ...
- if 302016 (UDP teardown) can be disabled, why not 302015 (UDP create)?
- similarly, what about 302020 and 302021 (ICMP)? Disable those as well?
Final list:
302013
302014
302015
302016
302020
302021
305010
305011
305012
In the end, though, only you can determine which options are acceptable for your environment.
Note: all 3020xx log types listed are disabled automatically during the NSEL configuration process.

Hardware rate-limiter OID

Hello,
Are the values supplied by show hardware rate-limiter available via SNMP for the Nexus 7010?
Thanks!

Unfortunately, No.
There is no such OID avaialble.

Rate Limited CNiSlider control

I have a need to limit the rate that the slider control can be moved. What I have done so far is subclassed the CNiSlider control and created a CRateLimit template class to handle the slider moves. This works pretty well, except that the slider pointer continually jumps between the mouse pointer position to the rate limited position as the mouse is moved.
The way I am doing this is trapping the OnPointerValueChanged message to my application, and then processing the requested pointer position value with the CRateLimit class. The CRateLimit calss has a Sleep() delayed while loop which programmatically sets the pointer position in increments until it reaches the value requested by the OnPointerValueChanged message. What I would like to do be able to process the message BEFORE the slider position is updated and painted so that I can get rid of the annoying flicker. Is there any way to do this, or perhaps handle a rate limit better than this??
TIA
Eric

I can't post the whole application, but here is a simplified version of it. I capture the mouse down and mouse up events and set the m_bMouseIsDown flag appropriately.
I basically just creep the pointer along until I get to the proper point. The problem is this callback happens after the pointer is painted at the new position. m_lpControlKnob is a pointer to the slider.
Eric
#define CHECK_FOR_PARENT_MESSAGES(hwnd)   MSG msg;\
   while(:eekMessage(&msg, hwnd,0,0,PM_REMOVE))\
{TranslateMessage(&msg);DispatchMessage(&msg);}
#define LOOP_DELAY_MS (20)
void CCMCSimulatorDlg:nPointerValueChangedLF(long Pointer, VARIANT FAR* Value)
   static double lastVal = 0;
   double valueDiff = Value->dblVal - lastVal;
   double rateDirection = (fabs(valueDiff)/valueDiff);
   double maxRateChange = 10;
   maxRateChange = maxRateChange * LOOP_DELAY_MS/1000;
   DWORD dwStart = GetTickCount();
   DWORD dwDelayed = dwStart;
   if(rateDirection < 0)
      while(m_bMouseIsDown && m_CurrentValue > Value->dblVal - maxRateChange)
         m_CurrentValue-= maxRateChange;
         m_lpControlKnob->SetValue(m_CurrentValue);
         CHECK_FOR_PARENT_MESSAGES(m_ParentWnd);
         dwDelayed = GetTickCount() - dwStart;
         if(dwDelayed < LOOP_DELAY_MS)
            Sleep(LOOP_DELAY_MS - dwDelayed);
         dwStart = GetTickCount();
   else
      while(m_bMouseIsDown && m_CurrentValue< Value->dblVal + maxRateChange)
         m_CurrentValue+= maxRateChange;
         m_lpControlKnob->SetValue(m_CurrentValue);
         CHECK_FOR_PARENT_MESSAGES(m_ParentWnd);
         dwDelayed = GetTickCount() - dwStart;
         if(dwDelayed < LOOP_DELAY_MS)
            Sleep(LOOP_DELAY_MS - dwDelayed);
         dwStart = GetTickCount();
   if(m_bMouseIsDown)
      m_CurrentValue= lastVal = Value->dblVal;
   m_lpControlKnob->SetValue(m_CurrentValue);

AirPort Extreme Multicast Rate limitation

I am currently using an iMac G5 which has an AirPort Extreme card with firmware 405.1. I have an AirPort Extreme (802.11n) base station that is running firmware version 7.1.1. My Radio Mode is "802.11n (802.11b/g compatible)." My wireless security is WPA/WPA2 personal.
When I go into my Wireless Options, my Country is United States, my Transmit power is 100% and my WPA Group Key Timeout is one day. It is not a closed network and I do not use interference robustness.
When I open the options for "Multicast Rate," the highest available rate is 11 Mbps. From what I understand, wireless G is capable of 56 Mbps (and that is how Apple advertised the Airport Extreme card when I bought it). Why is my multicast rate limited to 11 Mbps and how can I raise it to 56 Mbps?

I've always been a little foggy on multicast. The apple support article seems to imply that it only matters when "certain audio and video streaming servers or other applications with multicast capability" are on your network. (http://docs.info.apple.com/article.html?path=Airport/5.0/en/ap2087.html)
What if you don't have one of these multicast servers or applications on your network? Does the multicast rate have any effect on your network performance?
My understanding is that the answer is YES - regardless of whether you have one of these multicast servers or not, setting your multicast rate to X means that only airport clients that can achieve a speed of X or greater will be able to connect to the base station. If you set it to 1, then you will extend the range of your network. But sometimes, in a WDS, where multiple base stations on the same channel overlap, I find that my clients have trouble deciding which base station to connect to. So actually, it works better to set the rate a little higher. But I am never quite sure if this is true, or if its just my imagination.
At any rate (no pun intended) , I'm still foggy on multicast and would really appreciate if someone out there could clear things up or direct me to a link that explains what i need to know (starting with an actual definition of multicast).
Thanks

SCCM 2012 R2 Rate Limits

I have a SCCm 2012 set up. Got a primary site and a secondary site. My distribution point for the secondary site is on the Secondary Site Server. I need to set the rate limits for this distribution point. How can I do this? The
rate limits tab i snot available on the distribution point as this DP is on the secondary site server. Also, if I go to Hierarchy Configuration, I do not see ADDRESSES to set it there. How do I do this? Thanks

It's not there because the primary site does not distribute content to a DP co-located on a secondary site server. The primary site server only distributes content to DPs in the primary site and secondary site servers. Thus, you need to configure
the rate limits going to the secondary site. This got renamed at some point but I'm pretty sure its under the File Limits node under Hierarchy configuration (this is what used to be the Addresses node but addresses didn't really make sense anymore).
Jason | http://blog.configmgrftw.com | @jasonsandys

Wireless Rate Limiting via Radius

We have a setup as 1 SSID in air , authentication via LDAP
One user login as aaa to VLAN 51
other user login as bbb to VLAN 52
I want to setup different rate limiters for those users.As i know thera are 2 methods of rate limiting available in WLC
a)per User in the same SSID
b)per SSID for any user
In this case there is only one WLAN so we cant use b , as i dont want all users to get same bandwidth contract rate limiting method a isnt useful for us.Because i want to seperate employee / guest / admin bandwidth limits.
How can i overcome of this case ?

For the first question ;
What do you mean with "maybe depends on your equipment" ?
For the second question ;
Sorry it has to be "VLAN" assignment , and i have found the solution.
As i read
IETF 64 (Tunnel Type)—Set this to VLAN.
IETF 65 (Tunnel Medium Type)—Set this to 802
IETF 81 (Tunnel Private Group ID)—Set this to VLAN ID.
Three types of attribute has to be returned from ldap server.All three of these has to be returned or just Private group id is enough ?

702W Access Point and Bi-Directional Rate Limiting

Has anyone checked whether BDRL (Bi-Directional Rate Limiting) is supported on relatively new 702W APs.
I need it to work in FlexConnect mode.
Thanks,
Nick

It is not supported,
http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113682-bdr-limit-guide-00.html

Rate Limiting

Similar Messages

Maybe you are looking for