Total drops for class-map class-default

Hi,
I have a gigabit ethernet interface on a 2951 configured with 4x sub interfaces providing connectivity to our four WAN sites. Each sub interface services a 100mb connection to another site.
I have configured a QoS policy and attached to each sub interface with the primary function of limiting each sub interface to 100mbs. I am now seeing drops (total drops) on the class default and not sure why. I would not expect to see any drops on this interface as it never even reaches 15mb (15%) capacity.
Any ideas?
        Class-map: class-default (match-any)
          175934881 packets, 95319007968 bytes
          5 minute offered rate 23000 bps, drop rate 0000 bps
          Match: any
          queue limit 64 packets
          (queue depth/total drops/no-buffer drops) 0/340/0
          (pkts output/bytes output) 314212026/180287074028
policy-map PM-Branch-QoS
class CM-OAM
  set dscp af11
class CM-Network
  set dscp cs6
class CM-VC
  bandwidth percent 5
class CM-Citrix
  set dscp af21
class CM-CAPWAP
  set dscp af22
policy-map PM-WAN
class class-default
  shape peak 100000000
   service-policy PM-Branch-QoS

Disclaimer
The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.
Liability Disclaimer
In  no event shall Author be liable for any damages whatsoever (including,  without limitation, damages for loss of use, data or profit) arising out  of the use or inability to use the posting's information even if Author  has been advised of the possibility of such damage.
Posting
I would not expect to see any drops on this interface as it never even reaches 15mb (15%) capacity.
Your expectations might be incorrect.  Often percentage of bandwidth capacity measurements are misunderstood.
Let's assume your ingress is 100 Mbps.  Let's also assume your measuring over a five minute period.  Lastly, assume the ingress transmits at 100% for 1 minute and then stops for 4 minutes.  Bandwidth utilization across the 1 minute would be 100% and 0% for the other 4 minutes, but it would be 20% for the 5 minutes.
But if the 100 Mbps was sent at 100% for each 12 seconds, and not sent for each 48 seconds, 5 minute utilization would still be 20% but unlike the prior 1 minute stats of 100% and 0%, each minute would now also be 20%.
So these first two examples show how bandwidth utilization don't reveal what's happening within the measured time period.
Since ingress was same bandwidth as egress, in the above, there would be no queuing.
If ingress is gig, though, suppose gig ingress arrives for 6 seconds and stops for a remaining 4 minutes and 54 seconds.  This too would measure as 20% usage across 5 minutes, but since it will take 60 seconds to transmit the same traffic at 100 Mbps, packets will need to be queued.  If queuing buffers are insufficient to hold all the packets, some will be dropped.
The above is a long way of saying, if your ingress rate exceeds your egress rate, there can be a need to queue packets, and if queuing is insufficient, packets will be dropped, this even if utilization is "low".  Most likely, you have occasional "bursts" if ingress bandwidth exceeds the egress bandwidth.
From your actual stats, the drop rate percentage is so low, you might not need to concern yourself with the few drops you're seeing.  If it is a concern, you might be able to reduce the drop rate by increasing egress buffering, but doing so, also increases egress queuing delay.

Similar Messages

  • Query: Missing tablename in generated SQL for vertical mapped classes

    Hi,
    I am playing with Kodo 3.1.4 / Postgres 7.4 and could not find any
    solution for this problem:
    I have one class calles "Clipfragment" which represents video clips and
    has a long - field named "lengthInMinutes". It extends a baseclass
    called "Categorizablefragment", which has a field "id" and some others.
    I use vertical mapping, thus having one table per class. The identity
    type is 'application'. The table for the class "Categorizablefragment"
    contains fields for jdoclass and jdoversion and IMHO correct entries.
    Everything works really fine except for Querys against subclass fields
    with aggregate functions. E.g. counting all clips works:
    KodoQuery q = (KodoQuery) getJdoPm().newQuery(ClipFragment.class);
    q.setResult ("count(id)");
    Number count = (Number) q.execute ();
    But: Querying for the sum of the field 'lengthInMinutes' fails:
    KodoQuery q = (KodoQuery) getJdoPm().newQuery(ClipFragment.class);
    q.setResult ("sum(lengthInMinutes)");
    Number count = (Number) q.execute ();
    The exception is:
    kodo.util.UserException: com.solarmetric.jdbc.ReportingSQLException:
    ERROR: syntax error at or near "WHERE"
    {prepstmnt 16398807 SELECT AVG(t0.lengthinminutes) FROM  WHERE
    t1.jdoclass = ? [reused=0]} [code=0, state=42601]
    NestedThrowables:
    com.solarmetric.jdbc.ReportingSQLException: ERROR: syntax error at or
    near "WHERE"
    {prepstmnt 16398807 SELECT AVG(t0.lengthinminutes) FROM  WHERE
    t1.jdoclass = ? [reused=0]} [code=0, state=42601]
    at kodo.query.AbstractQuery.executeWithMap(AbstractQuery.java:865)
    at kodo.query.AbstractQuery.execute(AbstractQuery.java:728)
    atde.jk.buvas.model.impl.DefaultClipManager.getTotalTime(DefaultClipManager.java:43)
    And the SQL - Trace:
    5766 TRACE [main] kodo.jdbc.SQL - <t 17089909, conn 31908613 (1
    errors)> [0 ms] executing prepstmnt 17226426 SELECT
    SUM(t0.lengthinminutes) FROM WHERE t1.jdoclass = ? [params=(String)
    de.jk.buvas.model.fragments.ClipFragment] [reused=0]
    I tried both 'base-tables' and 'per-subclass' for the property
    kodo.jdbc.VerticalQueryMode, without any results.
    Any ideas?
    Thanks,
    Jochen

    Hi Stephen,
    here are the excerpts from the .jdo and the .mapping files. The .jdo
    file was generated by XDoclet.
    ..jdo
    <class name="ClipFragment"
    identity-type="application"
    objectid-class="CategorizableFragment$Id"
    persistence-capable-superclass="CategorizableFragment"
    > <!-- end class tag -->
    <extension vendor-name="kodo"
    key="jdbc-class-map-name"
    value="vertical">
    <extension vendor-name="kodo" key="table" value="Clip"/>
    </extension>
    <field name="title"
    > <!-- end field tag -->
    <extension vendor-name="kodo"
    key="jdbc-size"
    value="100">
    </extension>
    </field>
    <field name="lengthInMinutes"
    > <!-- end field tag -->
    </field>
    <field name="description"
    > <!-- end field tag -->
    <extension vendor-name="kodo"
    key="jdbc-size"
    value="3000">
    </extension>
    </field>
    <field name="recordingDate"
    > <!-- end field tag -->
    </field>
    <field name="actors"
    > <!-- end field tag -->
    <collection
    element-type="de.jk.buvas.model.fragments.ActorFragment"
    > <!-- end collection tag -->
    </collection>
    <extension vendor-name="kodo"
    key="jdbc-element-delete-action"
    value="exception-deferred">
    </extension>
    <extension vendor-name="kodo"
    key="inverse-owner"
    value="clips">
    </extension>
    </field>
    <field name="media"
    > <!-- end field tag -->
    <collection
    element-type="de.jk.buvas.model.fragments.MediumFragment"
    > <!-- end collection tag -->
    </collection>
    <extension vendor-name="kodo"
    key="jdbc-element-delete-action"
    value="exception-deferred">
    </extension>
    </field>
    </class>
    <class name="CategorizableFragment"
    identity-type="application"
    objectid-class="CategorizableFragment$Id"
    > <!-- end class tag -->
    <extension vendor-name="kodo"
    key="jdbc-class-map-name"
    value="base">
    <extension vendor-name="kodo" key="table" value="Categorizable"/>
    </extension>
    <field name="id"
    primary-key="true"
    > <!-- end field tag -->
    </field>
    <field name="category"
    > <!-- end field tag -->
    <extension vendor-name="kodo"
    key="jdbc-delete-action"
    value="exception-deferred">
    </extension>
    </field>
    </class>
    ..mapping
    <class name="ClipFragment">
    <jdbc-class-map type="vertical" ref-column.ID="ID" table="CLIPFRAGMENT"/>
    <field name="actors">
    <jdbc-field-map type="many-many" element-column.ID="ID"
    ref-column.ID="CLIPS_ID" table="ACTOR_CLIPS"/>
    </field>
    <field name="description">
    <jdbc-field-map type="value" column="DESCRIPTION"/>
    </field>
    <field name="lengthInMinutes">
    <jdbc-field-map type="value" column="LENGTHINMINUTES"/>
    </field>
    <field name="media">
    <jdbc-field-map type="many-many" element-column.ID="MEDIA_ID"
    order-column="MEDIA_ORDER" ref-column.ID="ID" table="CLIPF_MEDIA"/>
    </field>
    <field name="recordingDate">
    <jdbc-field-map type="value" column="RECORDINGDATE"/>
    </field>
    <field name="title">
    <jdbc-field-map type="value" column="TITLE"/>
    </field>
    </class>
    <class name="CategorizableFragment">
    <jdbc-class-map type="base" table="CATEGORIZABLEFRAGMENT"/>
    <jdbc-version-ind type="version-number" column="JDOVERSION"/>
    <jdbc-class-ind type="in-class-name" column="JDOCLASS"/>
    <field name="category">
    <jdbc-field-map type="one-one" column.ID="CATEGORY_ID"/>
    </field>
    <field name="id">
    <jdbc-field-map type="value" column="ID"/>
    </field>
    </class>
    Thanks,
    Jochen
    Stephen Kim wrote:
    Can you post the mapping/metadata files for the two classes?
    Jochen Kressin wrote:
    Hi,
    I am playing with Kodo 3.1.4 / Postgres 7.4 and could not find any
    solution for this problem:
    I have one class calles "Clipfragment" which represents video clips
    and has a long - field named "lengthInMinutes". It extends a baseclass
    called "Categorizablefragment", which has a field "id" and some
    others. I use vertical mapping, thus having one table per class. The
    identity type is 'application'. The table for the class
    "Categorizablefragment" contains fields for jdoclass and jdoversion
    and IMHO correct entries.
    Everything works really fine except for Querys against subclass fields
    with aggregate functions. E.g. counting all clips works:
    KodoQuery q = (KodoQuery) getJdoPm().newQuery(ClipFragment.class);
    q.setResult ("count(id)");
    Number count = (Number) q.execute ();
    But: Querying for the sum of the field 'lengthInMinutes' fails:
    KodoQuery q = (KodoQuery) getJdoPm().newQuery(ClipFragment.class);
    q.setResult ("sum(lengthInMinutes)");
    Number count = (Number) q.execute ();
    The exception is:
    kodo.util.UserException: com.solarmetric.jdbc.ReportingSQLException:
    ERROR: syntax error at or near "WHERE"
    {prepstmnt 16398807 SELECT AVG(t0.lengthinminutes) FROM  WHERE
    t1.jdoclass = ? [reused=0]} [code=0, state=42601]
    NestedThrowables:
    com.solarmetric.jdbc.ReportingSQLException: ERROR: syntax error at or
    near "WHERE"
    {prepstmnt 16398807 SELECT AVG(t0.lengthinminutes) FROM  WHERE
    t1.jdoclass = ? [reused=0]} [code=0, state=42601]
    at kodo.query.AbstractQuery.executeWithMap(AbstractQuery.java:865)
    at kodo.query.AbstractQuery.execute(AbstractQuery.java:728)
    atde.jk.buvas.model.impl.DefaultClipManager.getTotalTime(DefaultClipManager.java:43)
    And the SQL - Trace:
    5766 TRACE [main] kodo.jdbc.SQL - <t 17089909, conn 31908613 (1
    errors)> [0 ms] executing prepstmnt 17226426 SELECT
    SUM(t0.lengthinminutes) FROM WHERE t1.jdoclass = ? [params=(String)
    de.jk.buvas.model.fragments.ClipFragment] [reused=0]
    I tried both 'base-tables' and 'per-subclass' for the property
    kodo.jdbc.VerticalQueryMode, without any results.
    Any ideas?
    Thanks,
    Jochen

  • Default class map is dropping all Packets

    Hello I have a Cisco 871 router that used to have Access list based security. now I am trying the ZBFW for the first time.  I thought I had a pretty good program until I found all my traffic was getting dropped. This is my first stab at ZBFWs and I am a bit confused esp with the default class part. Any help is greatly appreciated!!!!
    The router is for my house and thus also has to have priority for gaming. I will add the gaming and voice QOS once I get it working,
    Guest VLAN has access to 2 IP's in Data for printing.
    Cisco871#sh run
    Building configuration...
    Current configuration : 8005 bytes
    version 12.4
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    service sequence-numbers
    hostname Cisco871
    boot-start-marker
    boot-end-marker
    logging buffered 4096
    no logging console
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa session-id common
    clock summer-time PST recurring
    crypto pki trustpoint TP-self-signed-4004039535
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4004039535
    revocation-check none
    rsakeypair TP-self-signed-4004039535
    crypto pki certificate chain TP-self-signed-4004039535
    certificate self-signed 01
      3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 34303034 30333935 3335301E 170D3038 30323037 30373532
      32375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 30303430
      33393533 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100CEC2 7B89C73F AB4860EE 729C3B64 82139630 239A2301 8EA8B4C4 05505E25
      B0F24E7F 26ECEC53 3E266E80 F3104F61 BDDC5592 40E12537 2262D272 08D38F8E
      147F5059 7F632F5E 635B9CDF 652FFE82 C2F45C60 5F619AF0 72E640E0 E69EA9EF
      41C6B06C DD8ACF4B 0A1A33CF AF3C6BFB 73AD6BE0 BD84DD7F 435BD943 0A22E0E5
      F4130203 010001A3 74307230 0F060355 1D130101 FF040530 030101FF 301F0603
      551D1104 18301682 144C7570 696E2E44 61627567 61626F6F 732E6F72 67301F06
      03551D23 04183016 801473C6 E0784818 29A89377 23A22F5E BDD430CE E282301D
      0603551D 0E041604 1473C6E0 78481829 A8937723 A22F5EBD D430CEE2 82300D06
      092A8648 86F70D01 01040500 03818100 299AD241 442F976F 4F030B33 C477B069
      D356C518 8132E61B 1220F999 A30A4E0C D337DCE5 C408E3BC 0439BB66 543CF585
      8B26AA77 91FA510B 14796239 F272A306 C942490C A44336E0 A9430B81 9FC62524
      E55017FA 5C5463D7 B3492753 42315BEC 32B78F24 D10B0CA7 D1844CD5 C3E466B9
      3543BD68 A4B2692D 05CBF6DC C93C8142
                quit
    ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 10.0.0.1 10.0.0.5
    ip dhcp excluded-address 172.16.15.1 172.16.15.5
    ip dhcp excluded-address 172.16.15.14
    ip dhcp excluded-address 172.16.17.1 172.16.17.5
    ip dhcp excluded-address 192.168.19.1 192.168.19.5
    ip dhcp pool MyNetNative
       import all
       network 10.0.0.0 255.255.255.248
       default-router 10.0.0.1
       domain-name MyNetNet.org
       dns-server 4.2.2.1 4.2.2.6 8.8.8.8 208.67.220.220
       lease 0 2
    ip dhcp pool MyNetData
       import all
       network 172.16.15.0 255.255.255.240
       dns-server 172.16.15.14 4.2.2.1 4.2.2.6 8.8.8.8 208.67.220.220
       default-router 172.16.15.1
       domain-name MyDomain.org
    ip dhcp pool MyNetVoice
       import all
       network 172.16.17.0 255.255.255.240
       dns-server 172.16.15.14
       default-router 172.16.17.1
       domain-name MyDomain.org
    ip dhcp pool MyNetGuest
       import all
       network 192.168.19.0 255.255.255.240
       default-router 192.168.19.1
       domain-name MyNetGuest.org
       dns-server 4.2.2.1 4.2.2.6 8.8.8.8 208.67.220.220
    ip domain name MyDomain.org
    ip name-server 172.16.15.14
    ip name-server 4.2.2.4
    ip inspect log drop-pkt
    multilink bundle-name authenticated
    parameter-map type inspect TCP_PARAM
    parameter-map type inspect global
    username MyAdmin privilege 15 secret 5 MyPassword
    archive
    log config
      hidekeys
    class-map type inspect match-all MyNetGuest-access-list
    match access-group 110
    class-map type inspect match-any Base-protocols
    match protocol http
    match protocol https
    match protocol ftp
    match protocol ssh
    match protocol dns
    match protocol ntp
    match protocol ica
    match protocol pptp
    match protocol icmp
    match protocol tcp
    match protocol udp
    class-map type inspect match-all MyNetGuest-Class
    match class-map MyNetGuest-access-list
    match class-map Base-protocols
    class-map type inspect match-all MyNetNet-access-list
    match access-group 100
    class-map type inspect match-any Voice-protocols
    match protocol h323
    match protocol skinny
    match protocol sip
    class-map type inspect match-any Extended-protocols
    match protocol pop3
    match protocol pop3s
    match protocol imap
    match protocol imaps
    match protocol smtp
    class-map type inspect match-all MyNetNet-Class
    match class-map MyNetNet-access-list
    match class-map Voice-protocols
    match class-map Extended-protocols
    match class-map Base-protocols
    policy-map type inspect MyNetNet-zone_to_MyNetWAN-zone_policy
    class type inspect MyNetNet-Class
      inspect
    class class-default
    policy-map type inspect MyNetNet-zone_to_MyNetGuest-zone_policy
    class type inspect MyNetNet-Class
      inspect
    class class-default
    policy-map type inspect MyNetGuest-zone_to_MyNetNet-zone_policy
    class type inspect MyNetGuest-access-list
      inspect
    class class-default
    policy-map type inspect MyNetGuest-zone_to_MyNetWAN-zone_policy
    class type inspect MyNetGuest-Class
      inspect
    class class-default
    policy-map type inspect MyNetNet-zone
    class class-default
      pass
    zone security MyNetNet-zone
    zone security MyNetGuest-zone
    zone security MyNetWAN-zone
    zone-pair security MyNetNet->MyNetGuest source MyNetNet-zone destination MyNetGuest-zone
    service-policy type inspect MyNetNet-zone_to_MyNetGuest-zone_policy
    zone-pair security MyNetNet->MyNetWAN source MyNetNet-zone destination MyNetWAN-zone
    service-policy type inspect MyNetNet-zone_to_MyNetWAN-zone_policy
    zone-pair security MyNetGuest->MyNetWAN source MyNetGuest-zone destination MyNetWAN-zone
    service-policy type inspect MyNetGuest-zone_to_MyNetWAN-zone_policy
    zone-pair security MyNetGuest->MyNetNet source MyNetGuest-zone destination MyNetNet-zone
    service-policy type inspect MyNetGuest-zone_to_MyNetNet-zone_policy
    interface FastEthernet0
    description Cisco-2849-Switch
    switchport mode trunk
    speed 100
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    description SBS-Server
    switchport access vlan 10
    spanning-tree portfast
    interface FastEthernet4
    description WAN
    no ip address
    ip mtu 1492
    ip nat outside
    ip virtual-reassembly
    zone-member security MyNetWAN-zone
    ip tcp adjust-mss 1452
    duplex auto
    speed auto
    no cdp enable
    interface Vlan1
    description MyNetNative
    ip address 10.0.0.1 255.255.255.248
    ip nat inside
    ip virtual-reassembly
    zone-member security MyNetNet-zone
    ip tcp adjust-mss 1452
    interface Vlan10
    description MyNetData
    ip address 172.16.15.1 255.255.255.240
    ip nat inside
    ip virtual-reassembly
    zone-member security MyNetNet-zone
    interface Vlan20
    description MyNetVoice
    ip address 172.16.17.1 255.255.255.240
    ip nat inside
    ip virtual-reassembly
    zone-member security MyNetNet-zone
    interface Vlan69
    description MyNetGuest
    ip address 192.168.19.1 255.255.255.240
    ip nat inside
    ip virtual-reassembly
    zone-member security MyNetGuest-zone
    ip http server
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    access-list 100 remark MyNetnet
    access-list 100 permit ip 10.0.0.0 0.0.0.7 any
    access-list 100 permit ip 172.16.15.0 0.0.0.31 any
    access-list 100 permit ip 172.16.17.0 0.0.0.15 any
    access-list 110 remark MyNetGuest
    access-list 110 permit ip 192.168.19.0 0.0.0.15 host 172.16.15.2
    access-list 110 permit ip 192.168.19.0 0.0.0.15 host 172.16.15.3
    access-list 110 deny   ip 192.168.19.0 0.0.0.15 10.0.0.0 0.0.0.7
    access-list 110 deny   ip 192.168.19.0 0.0.0.15 172.16.15.0 0.0.0.31
    access-list 110 deny   ip 192.168.19.0 0.0.0.15 172.16.17.0 0.0.0.15
    access-list 110 permit ip 192.168.19.0 0.0.0.15 any
    control-plane
    banner login ^CC
    You know if you should be here or not.
             if not please leave
    NOW
    ^C
    line con 0
    no modem enable
    line aux 0
    line vty 0 4
    privilege level 15
    transport input telnet ssh
    scheduler max-task-time 5000
    ntp server 172.16.15.14
    webvpn cef
    end
    Cisco871#sh zone security
    zone self
      Description: System defined zone
    zone MyNetNet-zone
      Member Interfaces:
        Vlan1
        Vlan10
        Vlan20
    zone MyNetGuest-zone
      Member Interfaces:
        Vlan69
    zone MyNetWAN-zone
      Member Interfaces:
        FastEthernet4
    Cisco871#sh zone-pair security
    Zone-pair name MyNetNet->MyNetGuest
        Source-Zone MyNetNet-zone  Destination-Zone MyNetGuest-zone
        service-policy MyNetNet-zone_to_MyNetGuest-zone_policy
    Zone-pair name MyNetNet->MyNetWAN
        Source-Zone MyNetNet-zone  Destination-Zone MyNetWAN-zone
        service-policy MyNetNet-zone_to_MyNetWAN-zone_policy
    Zone-pair name MyNetGuest->MyNetWAN
        Source-Zone MyNetGuest-zone  Destination-Zone MyNetWAN-zone
        service-policy MyNetGuest-zone_to_MyNetWAN-zone_policy
    Zone-pair name MyNetGuest->MyNetNet
        Source-Zone MyNetGuest-zone  Destination-Zone MyNetNet-zone
        service-policy MyNetGuest-zone_to_MyNetNet-zone_policy
    Cisco871#sh int faste4
    FastEthernet4 is up, line protocol is up
      Hardware is PQUICC_FEC, address is 0016.9d29.a667 (bia 0016.9d29.a667)
      Description: WAN
      Internet address is 10.38.177.98/25
      MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive set (10 sec)
      Full-duplex, 100Mb/s, 100BaseTX/FX
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input 00:00:00, output 00:34:50, output hang never
      Last clearing of "show interface" counters never
      Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/40 (size/max)
      5 minute input rate 2000 bits/sec, 3 packets/sec
      5 minute output rate 0 bits/sec, 0 packets/sec
         593096 packets input, 73090812 bytes
         Received 592752 broadcasts, 0 runts, 0 giants, 0 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 watchdog
         0 input packets with dribble condition detected
         9940 packets output, 1016025 bytes, 0 underruns
         0 output errors, 0 collisions, 3 interface resets
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier
         0 output buffer failures, 0 output buffers swapped out
    Zone-pair: MyNetNet->MyNetWAN
      Service-policy inspect : MyNetNet-zone_to_MyNetWAN-zone_policy
        Class-map: MyNetNet-Class (match-all)
          Match: class-map match-all MyNetNet-access-list
            Match: access-group 100
          Match: class-map match-any Voice-protocols
            Match: protocol h323
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol skinny
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol sip
              0 packets, 0 bytes
              30 second rate 0 bps
          Match: class-map match-any Extended-protocols
            Match: protocol pop3
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol pop3s
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol imap
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol imaps
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol smtp
              0 packets, 0 bytes
              30 second rate 0 bps
          Match: class-map match-any Base-protocols
            Match: protocol http
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol https
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol ftp
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol ssh
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol dns
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol ntp
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol ica
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol pptp
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol icmp
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol tcp
              0 packets, 0 bytes
              30 second rate 0 bps
            Match: protocol udp
              0 packets, 0 bytes
              30 second rate 0 bps
          Inspect
            Session creations since subsystem startup or last reset 0
            Current session counts (estab/half-open/terminating) [0:0:0]
            Maxever session counts (estab/half-open/terminating) [0:0:0]
            Last session created never
            Last statistic reset never
            Last session creation rate 0
            Maxever session creation rate 0
            Last half-open session total 0
        Class-map: class-default (match-any)
          Match: any
          Drop (default action)
            5196 packets, 256211 bytes
    Cisco871#sh log
    Syslog logging: enabled (1 messages dropped, 0 messages rate-limited,
                    0 flushes, 0 overruns, xml disabled, filtering disabled)
    No Active Message Discriminator.
    No Inactive Message Discriminator.
        Console logging: disabled
        Monitor logging: level debugging, 0 messages logged, xml disabled,
                         filtering disabled
        Buffer logging:  level debugging, 1745 messages logged, xml disabled,
                         filtering disabled
        Logging Exception size (4096 bytes)
        Count and timestamp logging messages: disabled
        Persistent logging: disabled
    No active filter modules.
    ESM: 0 messages dropped
        Trap logging: level informational, 1785 message lines logged
    Log Buffer (4096 bytes):
    001779: *Feb 15 11:00:55.979: %FW-6-DROP_UDP_PKT: Dropping Other pkt 172.16.15.6:61806 => 168.94.0.1:53 with ip ident 511 due to  policy match failure
    001780: *Feb 15 11:00:59.739: %FW-6-DROP_TCP_PKT: Dropping Other pkt 172.16.15.6:4399 => 168.94.69.30:443 due to  policy match failure -- ip ident 515 tcpflags 0x7002 seq.no 974122240 ack 0
    001781: *Feb 15 11:01:26.507: %FW-6-DROP_UDP_PKT: Dropping Other pkt 172.16.15.6:51991 => 168.94.0.1:53 with ip ident 625 due to  policy match failure
    001783: *Feb 15 11:01:57.891: %FW-6-DROP_UDP_PKT: Dropping Other pkt 172.16.15.6:64470 => 168.94.0.1:53 with ip ident 677 due to  policy match failure

    Hello Charlie,
    I would recomend you to investigate a little bit more about how the ZBFW features works
    Now I am going to help you on this one at least, then I will give you a few links you could use to study
    We are going to study traffic from MyNetNet-zone to the MyNetWan-zone
    First the zone-pair
    zone-pair security MyNetNet->MyNetWAN source MyNetNet-zone destination MyNetWAN-zone
    service-policy type inspect MyNetNet-zone_to_MyNetWAN-zone_policy
    so lets go policy-map
    policy-map type inspect MyNetNet-zone_to_MyNetWAN-zone_policy
    class type inspect MyNetNet-Class
      inspect
    class class-default
    Finally to the class map
    class-map type inspect match-all MyNetNet-Class
    match class-map MyNetNet-access-list
    match class-map Voice-protocols
    match class-map Extended-protocols
    match class-map Base-protocols
    That keyword MATCH-ALL is the one causing the issues!!
    Why?
    Because you are telling the ZBFW to inspect traffic only if matches all of those class-maps so a packet will need to math the base protocols and the extended protocol and as you know that is not possible ( Just one protocol )
    So here are the links
    http://blogg.kvistofta.nu/cisco-ios-zone-based-policy-firewall/
    https://supportforums.cisco.com/thread/2138873
    http://pktmaniac.info/2011/08/zone-based-firewalls-something-to-keep-in-mind/
    http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00808bc994.shtml
    You have some work to do
    Please remember to rate all the helpful posts
    Julio
    CCSP

  • The class-default class map

    According to Cisco dumentation (http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/mpc.html)
    , the ASA is equipped with two default class-maps
    class-map inspection_default
    match default-inspection-traffic
    and
    class-map class-default
    match any
    The first makes perfect sense, but what is the class-default used for? Cisco says
    "This class map appears at the end of all Layer 3/4 policy maps and essentially tells the adaptive security appliance to not perform any actions on all other traffic. You can use the class-default class map if desired, rather than making your own
    match any class map. In fact, some features are only available for class-default."
    But I see stuff like this:
    policy-map MyPolicy
    class class-default
      inspect tfp MyFTPpolicy
    Obviously it is being used here to act on traffic! So I am confused.
    I also noticed that when you upgrade from 8.2 to 8.4, all default class-maps are removed from the configuration: you have to re-create everything (strange)

    Hello Collin,
    This is Mike. I dont think it is well documented. Basically it is just a class map (that does not appear on the configuration unless an action is specified) that will match all traffic passing through the ASA firewall. Some features like NSEL (Netflow) and Traffic shaping are only allowed to use this kind of class maps because they dont support any other match command.
    The one that you currently have (and God I hope its not applied)  will look for tftp traffic on every IP packet passing across the ASA.
    This specific type of policy you have there can only be applied on the interface (as it is not a layer 7 inspection policy) you can check if it is applied or not by running the show "run service-policy command"
    Mike

  • N7000 : details of packets dropped by COPP policy (class-default) ?

    Hi,
    On one of our N7K, we have some packets dropped by the COPP policy in the class-default class-map. :
    Partial results of "show policy-map interface control-plane" not so long after clearing the counters :
    class-map class-default (match-any)
          set cos 0
          police cir 100 kbps , bc 250 ms
          module 1 :
            conformed 12210790 bytes; action: transmit
            violated 201870 bytes; action: drop
          module 2 :
            conformed 8399646 bytes; action: transmit
            violated 0 bytes; action: drop
          module 3 :
            conformed 34518233 bytes; action: transmit
            violated 6186895 bytes; action: drop
    What would be the best way to figure out what traffic is dropped by the policy ? Is there any logging possible ?
    Thanks,
    Laurent

    There is still no logging possible.
    What can be done is piping the class-default-traffic to some port and then analyze it with wireshark or some similar tool. But as far as I know, this still cannot be done by default - at least with NX-OS 4.2(4) we had to reprogram the module with assistance from TAC. I suggest you contact your support partner in this matter.

  • IPv6 class-map or IOS problem

    Hello, sorry because of my bad English at first,
    I have a problem with my IPv6 ACL, IPv6 Class-map or IOS I'm not sure so I'm asking you.
    I have one 1721 router with one Ethernet and one FastEthernet interface, on Fa interface is 3 subinterfaces, and Eth interface is connected to 10 Mbps link to another 1721 router. I'm working on QoS for VoIPv6. My softphone emulator address is FEC2::1/64.
    This is my configuration:
    class-map match-any v6
       match access-group name v6
      policy-map v6
       class v6
        set ip dscp ef
    ipv6 access-list v6 permit FEC2::/64 any
    Question is, why is output of command show policy-map interface Fa0/0 showing that not a single one packet of IPv6 is not beeing marked:
    R1#sho policy-map interface fa0
      FastEthernet0
       Service-policy input: v6
         Class-map: v6 (match-any)
           0 packets, 0 bytes
           5 minute offered rate 0 bps, drop rate 0 bps
           Match: access-group name v6
             0 packets, 0 bytes
             5 minute rate 0 bps
           QoS Set
            ip dscp ef
               Packets marked 0
         Class-map: class-default (match-any)
           92 packets, 9134 bytes
           5 minute offered rate 0 bps, drop rate 0 bps
           Match: any
    This exact configuration, with IPv4 is working fine. My IOS version is c1700-y-mz.122-11.T11.bin
    If IOS version is too old, can you tell my what version will work so I can purchase it?
    Thanks

    If you are thinking of IPv6 prefix I tried everything. From /128 for single host to /64, nothing works.

  • QoS Class-maps

    Trying to understand the class-default for marking
    I have the concept of Identify traffic with ACLs
    Classify traffic for marking with class-maps
    Mark traffic with policy-maps
    the policy-map will always have a default-class for unaccounted traffic in the policy-maps
    what I don't quite understand is that the there is not a class-map class-default
    when servicing the "policy" the class-maps are referenced with "class A" "class B" "class class-default"
    when looking for the matches on class class-default there is no reference class-map to go to....
    I figured I have to accept this logic means if  traffic was not specifically matched by the collection of class-maps in the config the IOS can assume the traffic would have been/is class-default.
    i had put a config together to classify certain traffic as CS0, like SNMP... i wanted to force traffic there as well as having all unaccounted traffic being classified CS0.
    but from what i read if i don't have snmp matched in any class-map in the config then this traffic would find itself in
    policy-map XXX
         class class-default
         set ip precedence 0
    even though class-default does not exist as class-map class-default

    Hi,
    You want to mark some traffic as CS0? and then count that traffic? but you won't know which traffic had CS0 imposed or was natively IPP 0 like all data traffic not specifically marked.
    the class class-default exists just do a show class-map and you'll see it, it is the IOS which creates it.
    Doing a show policy-map interface will show you which class-map was matched.

  • Class-map with ACL rule

    In the following class-map:
    "class-map match-any voice
    match access-group 190"
    If the ACL 190 has more than one line with "permit" statements.
    In order for the policy-map using the above class-map to find a match and use the rules applied for the above class-map, does the traffic need to meet all the criteria in the ACL or does it work like a regular ACL, where it "walks" down and it stops execution at the first permit/deny "hit"?
    Regards,
    Christos

    the explicit " match-any" will do just that.So, a nested ACL can be configured for multiple criteria.
    The alternate is a "match-all" where all nested options in your acl MUST be met. Hope this helps.
    T

  • Need the default configuration of map-class and policies for WAAS version 5.3.1.20

    Do someone have the default configuraion cli of class-maps and policies for the WAAS version 5.3.1.20. I need this to compare with the configuration that I have in the network, I need the verify what have been changed.

    I'm sure you figured this out already since it's been 9 months.  But just in case someone needs this - you can restore the default policies if they don't show up.  Device Groups -> AllWAASGroup and edit.  There you will see a "Restore default Optimization Policies"

  • ACE SSL Sticky class-map generic vs class default differences.

    There was a thread recently titled "ACE 3.0(0) SW / LB with SSL Session-ID" where Giles Dufour outlined a configuration for an ACE performing sticky based on SSL Session ID.
    Can anyone explain the benefits and differences of using a specific class-map generic such as this:
    class-map type generic match-any SSL-v3-32
      2 match layer4-payload regex "\x16\x03\x00..\x01.*"
      3 match layer4-payload regex "\x16\x03\x01..\x01.*"
    Versus just matching class default?
    So if I have a configuration such as this:
    policy-map type loadbalance generic first-match SSL-v3-Sticky
    class SSL-v3-32
       sticky-serverfarm ssl-v3
    vs
    policy-map type loadbalance generic first-match SSL-v3-Sticky
    class class-default
       sticky-serverfarm ssl-v3
    What's the benefit or drawback?

    The SSL session id is only available in version 3.0.1 and 3.1.1
    So you can match this particular version and then attempt to do stickyness.
    You are guaranteed to find what you're looking for.
    If you match a class-default it means you apply stickyness to any version of ssl packet.
    So there is a risk to misinterpret the content of the packet and stick on something else than the session id.
    Gilles.

  • Policy map/ class map/ service policy for IOS xr

    Hi,
    I need to create a policy map and class map/service policy to limit the amount of bandwidth that can be used on one interface both in and out.
    I need the cap for the bandwidth to traverse this circuit to ne 10 Meg.
    the IOS xr version we are using is 4.3.4
    I was hoping someone could help me out by giving me a configuration example I could follow.
    Thank you.

    for instance like this:
    policy-map police-in
    class class-default
    police rate 10 mpbs <optionally set burst>
    policy-map shape-out-parent
    class class-default
    shape 10 mpbs <optional burst config>
    service-policy shape-out-child
    policy-map shape-out-child
    class class-default
    queue-limit 10 packets
    int g 0/0/0/0
    service-policy police-in in
    service-policy shape-out-parent out
    also have a look at CL 2013/2014 (orlando/sanfran) ID 2904 for more QOS details
    and the support forum article of "asr9000 quality of service architecture"
    xander

  • Class-maps used for load balancing on ACE

    I am from CCS background and am trying to understand how the VIPs could be configured on an ACE module (using class maps).
    I am looking for specific information for the following :
    1. Will each VIP have a corresponding Service-policy on the VLAN Interface or can we club many VIPs (through policy-maps) onto a single service-policy entry on teh interface?
    2. I could not find any cisco doco with the configuration examples for more than one VIP address and would please like to know some examples, if possible or could some one direct me to a doco with many VIP entries ?
    - Should each VIP have a seperate class-map or can list them together?

    You will have to configure L3/L4 class-maps for corresponding VIPs. You just need a single policy with n class-maps for n VIPS.
    I am writing a sample that will hopefully help you on this
    class-map match-all app1-vip
    match virtual-address 10.1.1.1 tcp eq 80
    class-map match-any app2-vip
    match virtual-address 10.1.1.2 tcp eq 443
    policy-map type loadbalance first-match L7app1
    class class-default
    server-farm App1-farm
    policy-map type loadbalance first-match L7app2
    class class-default
    server-farm App2-farm
    policy-map multi-match All-vips
    class app1-vip
    loadbalance vip inservice
    loadbalance policy L7app1
    loadbalance vip icmp-reply active
    class app2-vip
    loadbalance vip inservice
    loadbalance policy L7app2
    loadbalance vip icmp-reply active
    int vlan 100
    ip address 10.10.10.101 255.255.255.0
    service-policy input All-vips
    Syed Iftekhar Ahmed

  • How to get OIDs of indexes for class-map ?

    I have policy-map configured on cisco router with some class-maps inside. I need to draw a graph traffic passing through these classes. To make a graphs I use Cacti  which use SNMP query to draw the graphs (object name cbQosObjectsIndex).
    How to get OIDs of class-map indexes ?
    I tried to do this by following query:
    #snmpwalk -c community_string -v 2c 192.168.0.252 1.3.6.1.4.1.9.9.166.1.5.1.1.1
    but the answer was:
    iso.3.6.1.4.1.9.9.166.1.5.1.1.1 = No Such Object available on this agent at this OID
    The information i need is contained at the OID 1.3.6.1.4.1.9.9.166.1.15.1.1.7:
    # snmpwalk -c community_string -v 2c 192.168.0.252 1.3.6.1.4.1.9.9.166.1.15.1.1.7
    iso.3.6.1.4.1.9.9.166.1.15.1.1.7.1251.1277 = Gauge32: 0
    iso.3.6.1.4.1.9.9.166.1.15.1.1.7.1251.13363 = Gauge32: 0
    iso.3.6.1.4.1.9.9.166.1.15.1.1.7.1251.13383 = Gauge32: 0
    iso.3.6.1.4.1.9.9.166.1.15.1.1.7.1251.13435 = Gauge32: 734000
    iso.3.6.1.4.1.9.9.166.1.15.1.1.7.1251.13481 = Gauge32: 233000

    Because 192.168.0.252 1.3.6.1.4.1.9.9.166.1.5.1.1.1 is marked "non-accessible" according to http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=cbQosObjectsIndex
    You'll need to obtain the indices as explained in this blog post:
    http://pierky.wordpress.com/2009/04/09/cisco-class-based-qos-snmp-mib-and-statistics-monitor-for-nms/
    Joe wrote a very illustrative post on the subject of snmptables: https://supportforums.cisco.com/message/3051004#3051004
    And if your IOS supports it, you would want to configure the following to keep the indices from changing after every reboot or OIR:
    "snmp mib persist cbqos"

  • Detailed example for ABAP mapping in XI7.0 with code in  class builder

    hi experts,
                  will any one one send me the detailed example(including navigation steps) for ABAP mapping in XI7.0 with code in class builder.
                                                         Thankin u,

    Hi,
    Just go through the below link.It will guide you how to do abap mapping:
    The guide is on XI 3.0 but the same can be used in 7.0 also.
    The How-to-guide
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/5c46ab90-0201-0010-42bd-9d0302591383
    This link will provide more information regarding program point of view.
    http://help.sap.com/saphelp_nw04/helpdata/en/86/8280ba12d511d5991b00508b6b8b11/content.htm
    Thanks,
    Kishore.
    Edited by: Kishore on Mar 14, 2008 4:35 AM

  • Creating ABAP class in XI for ABAP mapping

    Hi All,
    While creating ABAP class in SE80 XI I am getting following message.
    “You are not registered as a
    developer.
    Please register in the Online
    Service System (OSS).
    In the OSS you will receive
    an access key.”
    Plz guide which role I required to do ABAP mapping/class creation.
    Regards

    Hi Rohan,
    for developing abap you need a developer key. You can get it with the corresponding authorisation at <a href="https://websmp209.sap-ag.de/~form/sapnet?_SHORTKEY=01100035870000103676&_SCENARIO=01100035870000000202&">SAP OSS</a>.
    Regards,
    Udo

Maybe you are looking for

  • How can I get rid of old books that I have deleted from my device? It still shows up as purchased books on "Icloud".

    How can I get rid of old books that I have deleted from my device but still shows up as "purchased books" on "Icloud". I don't want to see some of these books at all. I can sort by one that are PDFs and ones currently on device, but it still gives op

  • AD Reconciliation in oim 9.1

    Hi, We need your help to achieve the following requirement Existing Env: We already have two AD domains as integrated resources for Provisioning/DeProvisioning(no approval process) and reconciliation with two diff resources(ABC ADDomain,XYZ ADDomain)

  • External Hard Drive with Time Machine, Will it Delete Files that aren't Backups?

    Hello reader,           My concern right now that I need help with is backing up with Time Machine. I went down to an Apple Store and they formated my External Drive 1TB to work with Time Machine then I backed up my MacBook Pro and all is well. Howev

  • VIVO on graphics card how do i use it?

    Hey I have an MSI 6600GT graphics card and it has VIVO which i know stands for video in video out , what can i use this for ? can i use it to capture video from a VCR? if so how would i connect it all up thanks

  • Canada - Bank transit number - routing code

    hello! I am working in a Belgian company using ECC 6.0 and I have to pay a vendor which is in Canada. My bank told me i have to add the Canadian routing number (in French : code de transit) before the bank account. But in SAP, i dont know where shoul