Service-policy output not working in Cisco 3560 switch

We got some Cisco catalyst 3560 that we want to control the bandwidth
on the ports. Can this be done, and how do i do it?
Ive got 3550s that can do policy-map with the interface command;
service-policy output(and input) <policyname>
But 3560 only seems to handle service-policy input.
If i try to configure output, it says the following:
SW(config-if)#service-policy output 4mbit-out
police command is not supported for this interface
Configuration failed!
Warning: Assigning a policy map to the output side of an interface not
supported
Any workarounds or new ways to accomplish bandwith-control on a 3560 ?
regards,
Rajib

The 3560 & 3750 (& 2960) don't support egress policy-maps. They do however support queueing so it is possible to achieve similar results by applying an ingress policer to your user ports to classify (& police?) the traffic, at the egress port you can then queue the traffic based on it's DSCP or CoS value that it was classified with (same as 3550).
It is also possible to restrict the bandwidth in use at an egress port with the interface command 'srr-queue bandwidth limit <10-90>' where 10-90 represents a percentage of the links bandwidth. For example if you want to restrict a 100Mbps port to 10Mbps you would use the command 'srr-queue bandwidth limit 10'
HTH
Andy

Similar Messages

Service policy counters not working..

I have a service policy on a 6509 interface so I can see what the packets per second of a video stream coming out of a DVR (digital video recorder) is. This DVR has 16 security cameras attached and I'm concerned that when someone views all 16 cameras the video stream is going to be huge.
So I create a service policy to match an access list for all IP from the DVR. But no counters increment unless I add in some other match statement. I added in a match protocol telnet and the service policy counters started to work. I removed the match on telnet and the counters stopped. Telnet has nothing to do with the DVR. Here is the config of the class map, policy map and show commands: (By the way video is streaming through this interface continually during this excercise)
MATCHING ACCESS LIST ONLY:
class-map match-any DVR
match access-group 130
policy-map DVR-test
class DVR
ROC-6509-DU-A#sh access-list 130
Extended IP access list 130
10 permit ip host 164.72.2.125 any
ROC-6509-DU-A#sh policy-map int
GigabitEthernet2/5
Service-policy output: DVR-test
Class-map: DVR (match-any)
0 packets, 0 bytes
30 second offered rate 0 bps
Match: access-group 130
0 packets, 0 bytes
30 second rate 0 bps
Class-map: class-default (match-any)
0 packets, 0 bytes
30 second offered rate 0 bps, drop rate 0 bps
Match: any
ADDING IN TELNET:
class-map match-any DVR
match access-group 130
match protocol telnet
policy-map DVR-test
class DVR
ROC-6509-DU-A#sh policy-map int
GigabitEthernet2/5
Service-policy output: DVR-test
Class-map: DVR (match-any)
524025 packets, 70724866 bytes
30 second offered rate 3991000 bps
Match: access-group 130
523896 packets, 70689220 bytes
30 second rate 3991000 bps
Match: protocol telnet
129 packets, 35646 bytes
30 second rate 0 bps
Class-map: class-default (match-any)
18696 packets, 11180265 bytes
30 second offered rate 129000 bps, drop rate 0 bps
Match: any
If I remove the 'match protocol telnet' and clear the counters, no longer do the counters for the access-list 130 increment - put back in match telnet and they start to increment.
This is a Sup720 with IOS 12.2(18)SXE3
Is this a bug or do I not have my class map or policy map correct?

The hardware ASICs do not support collecting the individual policer information.
Try:
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/1216ea1/3550scg/swqos.htm#xtocid1990743

Cisco cat 3560 service-policy output problem

I have just use the 3560 to replace 3550 switchs, but the cat3560 does not support the command "service-policy output" which was supported by 3550,
we have already use this command in 3550 to control the network traffic.
so there somebody knows if there an schedule to implement this command?
Thank you very much.

"service-policy output" is not supported in 3560/3750 due to ASIC limitation. See if "srr-queue bandwidth limit" command will work for you
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225sed/scg/swqos.htm#wp1253412

C3750-48ts Service-Policy Output Like Command

Hello,
I'm having an issue trying to find a way to make a QOS or limiting of network traffic on a cisco 3750 that we have at a client site.
What the end goal is to make the network traffic 10x5mbs on some ports and 5x1mbs on others.
From how I normally do traffic shaping on routers is Class-map, policy-map and service-policy. However as I found out with with this project I can't run the Service-policy Output command on the 3750 model. The other way that I know how to limit bandwidth on these switches is to use the srr-queue bandwidth limit % command. However, this isn't going to work for the clients that have 30x5mbs connection though us.
Here is what I have programmed:
mls qos
vlan 100
class-map match-any IN
match access-group 100
class-map match-any OUT
match ip dscp default
policy-map 5M_IN
class IN
police 5000000 256000 exceed-action drop
policy-map 1M_IN
class IN
police 1000000 256000 exceed-action drop
policy-map 30M_OUT
class OUT
police 30000000 512000 exceed-action drop
policy-map 5M_OUT
class OUT
police 5000000 256000 exceed-action drop
interface FastEthernet1/0/36
description TEST
switchport access vlan 100
servic-policy input 1M_IN
(This is where I would like to run the service-policy output 5M_OUT)
If you have any idea on how to limit traffic per port please let me know so that this may help others.
Thank you,
Michael

The 3560 & 3750 (& 2960) don't support egress policy-maps. They do however support queueing so it is possible to achieve similar results by applying an ingress policer to your user ports to classify (& police?) the traffic, at the egress port you can then queue the traffic based on it's DSCP or CoS value that it was classified with (same as 3550).
It is also possible to restrict the bandwidth in use at an egress port with the interface command 'srr-queue bandwidth limit <10-90>' where 10-90 represents a percentage of the links bandwidth. For example if you want to restrict a 100Mbps port to 10Mbps you would use the command 'srr-queue bandwidth limit 10'
HTH
Andy

Service-policy output voice-only

Hi, when i enter "service-policy output voice-only" in int BVI1 on a Cisco 878 (G.SHDSL), it throws an error saying, "Class Based Weighted Fair Queueing not supported"
Can i put this line in int ATM0 ?

Hi,
It should be done as follows:
Remove BVI and "bridge irb". Configure an ATM subinterface point-to-point with the IP address, "atm route-bridging" and PVC. Under PVC apply the service policy.
please rate post if it helps!

Fault policy does not work when throwing remoteFault in bpel

Hi
I have a BPEL-proces in which I throw a remoteFault.
In the fault-policy there is a condition for this fault
<faultName xmlns:bpelx="http://schemas.oracle.com/bpel/extension"
name="bpelx:remoteFault">
<condition>
<action ref="ora-java"/>
</condition>
</faultName>
But the fault-policy does not work if I throw this remoteFault in de bpel. But when I invoke another service (which is shutdown), then I get a remoteFault and for this remoteFault the fault-policy works well.
Any idea why the fault-policy does not work when I throw the remoteFault?
Regards

BPEL fault works only on invocation failures.
Fault management will work based on the remote fault from the remote service, you cannot throw remote fault from bpel and capture that in fault management and process.
The following are the actions that we can take on faults.
1. Human Intervention
2. Rethrow [rethrowFault]
3. Termination [abort]
4. Replay Fault [replayScope]
5. Custom Java Action [javaAction]
6. Retry [retry]
Hope this helps !!!
Thanks,
Vijay

I've become increasingly frustrated with the ipad adobe app. I've subscribed to be able to convert my pdf files into word documents and it has yet to work I've paid for a service that does not work which in turn makes me a disgruntled customer to say the

I've become increasingly frustrated with the ipad adobe app. I've subscribed to be able to convert my pdf files into word documents and it has yet to work I've paid for a service that does not work which in turn makes me a disgruntled customer to say the least very disappointed with such horrible service

Which service did you subscribe to? Adobe PDF Pack?
Once I know the service that you subscribed to, I can move this post to the right forum so that you can get in touch with the folks who can assist you.

HT5594 I upgraded to iOS 7 and my location service button does not work. How can I turn it back on?

I upgraded to iOS 7 and my location service button does not work. How can I turn it back on?

Settings>General>Restrictions>Privacy>Location Services. Have you restricted it?

Service-policy output statement interface vs interface .500 point-to-point

We are running AutoQoS but have recently migrated our WAN service that puts our IP connectivity to a sub-interface (interface serial0/1:0.500 point-to-point and a frame-relay interface-DLCI). In our prior WAN configuration we bound the IP address directly to the interface s0/1:0.
After the migration, the auto qos statement service-policy output AutQoS is still on the interface serial 0/1:0 . Should this service-policy statement be moved down to the serial 0/1:0.500 point-to-point in order to be effective? We have been experiencing QoS problems but I understand it could be many different places, but I wanted to start here.
Thanks
ryan

as a rule those are applied in a frame relay policy map.
Create the LLC policy
Create the Frame Relay Policy map (and refer to the LLC policy map in the Frame Relay Config)
Apply the Frame Relay Policy Map to the subinterface (to the DLCI).

Embeded Event Manager on cisco 3560 switch

Can someone help me please? I have EEM configured on cisco 3560 switch. The configuration is below. I want that switch inform me through email when device with particilular IP address become unavailable. For some reason this configuration is not good and I can't tell why. I already try to debug this with debug event manager action mail but didn't see any output .
ip sla 11
icmp-echo ip address
frequency 20
ip sla schedule 11 life forever start-time now
event manager applet device-TEST
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.11 get-type exact entry-op lt entry-val "2" poll-interval 20
trigger occurs 5 period 120
action 02.0 mail server "ip address" to "[email protected]" from "[email protected]" subject "device is down"

The mail part looks good, I'm not sure you are hitting the trigger right.
Why not do a track on the ip sla instead of the snmp stuff?
Here's a good example of that.
https://learningnetwork.cisco.com/blogs/network-sheriff/2009/06/19/writing-your-first-eem-applet

Ipv6 HSRP gloabl unicast address on cisco 3560 switch

Dear Team,
We are using cisco 3560 switch. Now we are going to implement ipv6 in our network. But we are not disturbing to existing ipv4. my question is 1) Can we confiure the global unicast ipv6 address in ipv6 HSRP and 2) can cisco 3560 switch will support ipv4 and ipv6 standby group on same SVI ?

YES

MTU Size Issue on Cisco 3560 Switch

Could anybody tell me how to change MTU Size on a Cisco 3560 Switch.i mean to say whether it is to be changed on FastEthernet Interfaces or on VLAN 1 or on Global Configuration Mode and with which Command to change it.

I am using MPLS on my Routers and the MTU size i have set on my Router Interfaces is 1524.
When i do a normal ping from Customer's one site to another (where my Traffic has to pass through this Switch VLAN)i get a reply , but when a Ping with a Byte Size of 1500 or more the Packets get completely dropped.
I think due to MTU Mistach bet. Switch and Router the Packets r getting droped,that is why i was trying to change it.
could the Packets get dropped because of this reason.Please suggest.

DHCP and voice vlan on Cisco 3560 switch

Greetings,
I'm setting up a Cisco 3560 switch for voice and data comms. I'm looking for documentation with best practice guidelines for the following requirements.
1. Using the Cisco 3560 as a DHCP server - Config examples. Do I need to use different subnets for the voice and data vlans?
2. Layer 2 CoS QoS - I'm connecting Aastra phones as well as notebooks - I've been told that Aastra also makes use of the voice vlan config through LLDP and that Aastra phones supports CDP.
Your assistance will be appreciated.

Hi ,
Cisco recommends that you have a separate vlan for voice and data with different ip subnets for voice and data. You will need to configure the dhcp pool accordingly.
Here is the config guide for setting up IOS DHCP server:
http://www.cisco.com/en/US/docs/ios/12_0t/12_0t1/feature/guide/Easyip2.html
Here is the LAN qos recommendations:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/7x/netstruc.html#wp1044009

ACE Policy is not working

Hi,
I have ACE 4710 in context mode. I am doing internet browsing (Port 80) redirection to two proxy servers (Transparent Proxy) as well as I am using this ACE box for multiple other servers load balancing.
I have multiple policies applied on my LAN interface (VLAN 300) where all the users and servers are connected.
Now I am facing problem with one application (PLATTS) which is oil company related application. This application is working fine while directly connected with Internet (extrenal internet connection) or by giving explicit proxy in the user browser.
But In transparent proxy This application is not working and my company policy only allow the transparent proxy not explicit proxy.
Now if on my interface vlan 300 i will remove the service-policy input PM_MAIN_BCPROXY my application will start working but i cant redirect the port 80 traffic to my proxy servers which is also my requirement.
interface vlan 300
description ACE-INSIDE CONTEXT RACK1
ip address 192.168.0.65 255.255.255.224
alias 192.168.0.73 255.255.255.224
peer ip address 192.168.0.66 255.255.255.224
no normalization
mac-address autogenerate
no icmp-guard
access-group input acl-in
nat-pool 5 172.23.16.5 172.23.16.5 netmask 255.255.255.255 pat
nat-pool 4 172.23.16.4 172.23.16.4 netmask 255.255.255.255 pat
nat-pool 3 172.23.16.3 172.23.16.3 netmask 255.255.255.255 pat
nat-pool 1 172.23.16.2 172.23.16.2 netmask 255.255.255.255 pat
service-policy input PM_BYPASS_PLATTS
service-policy input PM_ENOC_Servers
service-policy input PM_RT_FAX
service-policy input PM_ITSM_Web_Server
service-policy input PM_ITSM_MAPP_Server
service-policy input PM_BYPASS_FOR_LAN_HTTP
service-policy input PM_BYPASS_HTTP
service-policy input PM_MAIN_BCPROXY
=============================================================================================
This application use multiple destinations for connectivity and I have even tried by passing the destination IP addresses by making bypass policy but still no luck.
I want this application to work as well as redirection of port 80. I even try re-ordering the policy sequence but no luck. Can you please help me out how to achieve this application to work as well as redirectino of port 80 for Internet.
I have attached the full configuration as welll.
I will be very thankful if someone can help me on this.

Hi,
This application has no VIP and serverform.
My traffic is passing through the ACE and when traffic passing ACE policy for redirection of port 80 is droping traffic. If i remove my last service policy on the interface this application will start working
Sent from Cisco Technical Support iPhone App

Simple ws-policy demo not working

Hi Gurus,
It's been quite awhile, I could not work it out though. I guess your help would be the last change to stop it from driving me crazy~
The goal is to implement a simple ws-seurity enabled webservice demo using only username/password token as the policy. username/password in the ones listed in "myrealm" (might have SQL Authentication provider as well),and X509 is not the thing to be considered in this simple test.
Env:
WebLogic Server Version: 10.3.0.0
JVM: Sun one installed with weblogic
WebLogic Eclipse plugin: 1.0.0.2008.0808135653
Windows XP sp3
After reading that much docs, it came to below procedure and code:
1. Eclipse -> new Dynamic web project "WSTest3"
2. create file: example.ws.HelloW1.java
package example.ws;
import javax.jws.WebService;
import weblogic.jws.Policy;
import weblogic.jws.Policies;
@WebService(serviceName="HelloW1")
@Policies( { @Policy(uri = "policy:usernametoken.xml") } )
public class HelloW1 {
     public String sayHi(String hi){
          System.out.println("Already here: " + hi);
          return "Welcome, you said: " + hi;
3. add "weblogic.jar" to build path
4. create WEB-INF/policies/usernametoken.xml
<?xml version="1.0"?>
<wsp:Policy
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200512"
>
<sp:SupportingTokens>
<wsp:Policy>
<sp:UsernameToken
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200512/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssUsernameToken10/>
</wsp:Policy>
</sp:UsernameToken>
</wsp:Policy>
</sp:SupportingTokens>
</wsp:Policy>
5. Publish the project WSTest3 to weblogic server
6. Test the webservice within weblobic admin console, get below response which is expected since there is no input for user/pass in the simple test web page:
~~~~~~~~~~~~~~~~~~~
<faultcode>wsse:InvalidSecurity</faultcode>
<faultstring>Error on verifying message against security policy Error code:1000</faultstring>
~~~~~~~~~~~~~~~~~~~
7. create the WSTest3Client project
8. new "web service client"
9. input the WSDL "http://127.0.0.1:7001/WSTest3/HelloW1?WSDL" and have the webservice related stub files created.
10. create java file: example.ws.client.Main.java
package example.ws.client;
import java.rmi.RemoteException;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.security.cert.X509Certificate;
import javax.xml.rpc.ServiceException;
import org.apache.axis.client.Stub;
import example.ws.HelloW1_PortType;
import example.ws.HelloW1_Service;
import example.ws.HelloW1_ServiceLocator;
import weblogic.jws.jaxws.ClientPolicyFeature;
import weblogic.jws.jaxws.policy.InputStreamPolicySource;
import weblogic.security.SSL.TrustManager;
import weblogic.wsee.security.unt.ClientUNTCredentialProvider;
import weblogic.xml.crypto.wss.WSSecurityContext;
import weblogic.xml.crypto.wss.provider.CredentialProvider;
public class Main {
     public static void main(String[] args)
     throws ServiceException, RemoteException{
          String username = "weblogic";
          String password = "weblogic";
          CredentialProvider cp = new ClientUNTCredentialProvider(username.getBytes(), password.getBytes());
          List credProviders = new ArrayList();
          credProviders.add(cp);
          HelloW1_Service service = new HelloW1_ServiceLocator();
          HelloW1_PortType port = service.getHelloW1Port();
     Stub stub = (Stub)port;
     stub._setProperty(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders);
//Map rc = ((BindingProvider)port).getRequestContext();
//rc.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders);
     System.out.println(port.sayHi("nihao"));
11. add weblogic.jar to build path and let it go.
The expected output string was not coming, but still the exception there:
~~~~~~~~~~~~~~~
Exception in thread "main" AxisFault
faultCode: {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}InvalidSecurity
faultSubcode:
faultString: Error on verifying message against security policy Error code:1000
faultActor:
faultNode:
faultDetail:
     {http://xml.apache.org/axis/}stackTrace:Error on verifying message against security policy Error code:1000
     at org.apache.axis.message.SOAPFaultBuilder.createFault(SOAPFaultBuilder.java:222)
     at org.apache.axis.message.SOAPFaultBuilder.endElement(SOAPFaultBuilder.java:129)
{WITH MANY OTHER LINES BELOW}
~~~~~~~~~~~~~~~~~~
use below code suggested from reference link (2)
Map rc = ((BindingProvider)port).getRequestContext();
rc.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders);
to replace stub._setProperty, but I was told can not make the CAST from stub to BindingProvide, seems it's something in Jdeveloper11, not for my env.
if I comment "@Policies( { @Policy(uri = "policy:usernametoken.xml") } ) " off and republish the webservcie, the test would be running good, but defniately there is no anthentication, which is not what I want.
reference link (1): http://e-docs.bea.com/wls/docs103/webserv_sec/message.html
reference link (2): http://kingsfleet.blogspot.com/2008/12/simple-custom-policy-example-using-jax.html
I am grateful to have your input, thanks in advance and wish you a good day!
Regards,

Hi, it comes to episode2.
Now the WS client's very smoothly working in my Jdev10.1.3, the code is very alike, but it uses
stub._setProperty(Stub.USERNAME_PROPERTY, "weblogic");
stub._setProperty(Stub.PASSWORD_PROPERTY, "weblogic");
// This source file is generated by Oracle tools and is subject to change
// It is a utility client for invoking the operations of the Web service port.
// For reporting problems, use the following
// Version = Oracle WebServices (10.1.3.1.1, build 070111.22769)
package proj2.proxy;
import oracle.webservices.transport.ClientTransport;
import oracle.webservices.OracleStub;
import javax.xml.rpc.ServiceFactory;
import javax.xml.rpc.Stub;
public class HelloW1PortClient {
private proj2.proxy.HelloW1_PortType _port;
public HelloW1PortClient() throws Exception {
ServiceFactory factory = ServiceFactory.newInstance();
port = ((proj2.proxy.HelloW1Service)factory.loadService(proj2.proxy.HelloW1_Service.class)).getHelloW1Port();
* @param args
public static void main(String[] args) {
try {
proj2.proxy.HelloW1PortClient myPort = new proj2.proxy.HelloW1PortClient();
System.out.println("calling " + myPort.getEndpoint());
// Add your own code here
myPort.setUsername("weblogic");
myPort.setPassword("weblogic");
System.out.println( myPort.sayHi("Hello") );
} catch (Exception ex) {
ex.printStackTrace();
* delegate all operations to the underlying implementation class.
public String sayHi(String arg0) throws java.rmi.RemoteException {
return _port.sayHi(arg0);
* used to access the JAX-RPC level APIs
* returns the interface of the port instance
public proj2.proxy.HelloW1_PortType getPort() {
return _port;
public String getEndpoint() {
return (String) ((Stub) port).getProperty(Stub.ENDPOINT_ADDRESS_PROPERTY);
public void setEndpoint(String endpoint) {
((Stub) port).setProperty(Stub.ENDPOINT_ADDRESS_PROPERTY, endpoint);
public String getPassword() {
return (String) ((Stub) port).getProperty(Stub.PASSWORD_PROPERTY);
public void setPassword(String password) {
((Stub) port).setProperty(Stub.PASSWORD_PROPERTY, password);
public String getUsername() {
return (String) ((Stub) port).getProperty(Stub.USERNAME_PROPERTY);
public void setUsername(String username) {
((Stub) port).setProperty(Stub.USERNAME_PROPERTY, username);
public void setMaintainSession(boolean maintainSession) {
((Stub) port).setProperty(Stub.SESSION_MAINTAIN_PROPERTY, Boolean.valueOf(maintainSession));
public boolean getMaintainSession() {
return ((Boolean) ((Stub) port).getProperty(Stub.SESSION_MAINTAIN_PROPERTY)).booleanValue();
* returns the transport context
public ClientTransport getClientTransport() {
return ((OracleStub) _port).getClientTransport();
the weird thing is when I moved "
stub._setProperty(Stub.USERNAME_PROPERTY, "weblogic");
stub._setProperty(Stub.PASSWORD_PROPERTY, "weblogic");
into Eclipse, it still complains the same error: "Error on verifying message against security policy Error code:1000", meanwhile the server outputs:
<WSEE:18>Trying to validate identity assertion token http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#UsernameToken<SecurityMessageInspector.inspectIdentity:629>
Thanks,

Service-policy output not working in Cisco 3560 switch

Similar Messages

Maybe you are looking for