Switch port Speed Limit summary

Speed-limiting switches are typically on three or more switches, and the new switch model two-tier device since 2008 can achieve the QoS speed limit of 1Mbps, such as the Cisco 2960 series switches. After this, most of the domestic standard two-layer switches can be long speed limit, the accuracy of the basic can reach 1Mbps, such as  standard two layer, H3C standard two layer can do. Older Cisco standard two-layer switches such as 2950-class switching can also be speed-limiting, but with only 10Mbps accuracy. Switching between 2950G and 2950 for EI type does not have much speed limit differences, because the speed limit and iOS are related, the 2950 series of the Exchange iOS version is generally around 9.0, the latest 2960 series switch iOS version around 12.2, the higher version of iOS provides stronger system features.

The following is a summary of some of the speed limit methods:

The PC1 is connected to the Cisco3550 F0/1, and the rate is 1M;

The PC1 is connected to the Cisco3550 F0/2, and the rate is 2M;

CISCO3550 's G0/1 for export.

PC is directly connected to the three-layer switch port, meaning that the limit is three layer switch port uplink and downlink traffic control, similarly, if the three-layer switch port is not connected to the PC, but a two-layer switch, then the lower-level devices can be on the upper bound speed limit.

Note: Each interface supports only one policy per direction, and one policy can be used for multiple interfaces. Therefore, the download rate limit for all PCs should be defined. In the same strategy (in this case, Policy-map User-down), the difference between PC rates is defined in Class-map.

1. Start QoS on the switch

Switch (config) #mls QoS//Start QoS on the switch

2. Define PC1 (10.10.1.1) and PC2 (10.10.2.1) access control lists respectively

Switch (config) #access-list permit 10.10.1.0 0.0.0.255//control PC1 upstream traffic

Switch (config) #access-list permit any 10.10.1.0 0.0.0.255//control PC1 downstream traffic

Switch (config) #access-list permit 10.10.2.0 0.0.0.255//control PC2 upstream traffic

Switch (config) #access-list 111 permit any 10.10.2.0 0.0.0.255/control PC2 downstream traffic

3. Define the class and bind to the Access control list defined above

Switch (config) # Class-map user1-up//define PC1 upstream class and bind access list 10

Switch (config-cmap) # match Access-group 10

Switch (Config-cmap) # exit

Switch (config) # Class-map user2-up

Switch (config-cmap) # match Access-group 11//define PC2 upstream class and bind access list 10

Switch (Config-cmap) # exit

Switch (config) # Class-map User1-down

Switch (config-cmap) # match Access-group 100//define PC1 downstream class and bind access list 100

Switch (Config-cmap) # exit

Switch (config) # Class-map User2-down

Switch (config-cmap) # match Access-group 111//define PC2 downstream class and bind access list 111

Switch (Config-cmap) # exit

4, define the policy, bind the class defined above to the policy

Switch (config) # Policy-map user1-up//define PC1 upstream at a rate of 1M

Switch (CONFIG-PMAP) # class user1-up

Switch (config-pmap-c) # Trust DSCP

Switch (config-pmap-c) # police 1024000 1024000 exceed-action drop

Switch (config) # Policy-map user2-up//define PC2 upstream at a rate of 2M

Switch (CONFIG-PMAP) # class user2-up

Switch (config-pmap-c) # Trust DSCP

Switch (config-pmap-c) # police 2048000 1024000 exceed-action drop

Switch (config) # Policy-map User-down//define PC1 downlink at a rate of 1M

Switch (CONFIG-PMAP) # class User1-down

Switch (config-pmap-c) # Trust DSCP

Switch (config-pmap-c) # police 1024000 1024000 exceed-action drop

Switch (config-pmap-c) # exit

Switch (CONFIG-PMAP) # class User2-down//define PC2 downlink at a rate of 2M

Switch (config-pmap-c) # Trust DSCP

Switch (config-pmap-c) # police 2048000 1024000 exceed-action drop

Switch (config-pmap-c) # exit

5. Apply the strategy on the interface

Switch (config) # interface F0/1//Enter PC1 port uplink switch port configuration mode

Switch (config-if) # Service-policy input user1-up//bind PC1 upstream policy to user1-up

Switch (config) # interface F0/2//Enter PC2 port uplink switch port configuration mode

Switch (config-if) # Service-policy input user2-up//bind PC2 upstream policy to user2-up

Switch (config) # interface G0/1//Enter switch uplink Gigabit port configuration mode

Switch (config-if) # Service-policy input user-down//bind switch uplink port policy to User-down

Using the Strom-control (Storm Control) feature in three-layer switching, this feature is based on port-controlled unicast \ Multicast \ Multicast, which can be accurate to 0.01%, but an approximate value. This method is a threshold way, limit the monitoring time per second, more than the set threshold to discard the package, and the user is not aware of the network terminal, or remote unresponsive, obviously this way can not ensure that the end user every moment of the network unimpeded, so I think this method is only applicable to certain occasions, Or in conjunction with other policies.

Specific configuration method:

Switch (config) # interface F0/1//Enter switch port configuration mode

Switch (config-if) # Strom-control Unicast/broadcast/multi level 10//10% of the port bandwidth

Understanding Storm Control

Storm control prevents the port of the switch from being destroyed by a broadcast, multicast, or unicast storm on a physical port in the LAN. LAN storm occurs in the packet flooding in the local area network, the establishment of excessive traffic and loss of network performance. Errors in the protocol stack or errors on the network configuration can cause storms.

Storm control (or flow suppression) manages the flow state of the stack, and is managed through a time and contrast measurement with pre-set threshold values for the suppression level. The threshold value is expressed as a percentage of the total available bandwidth for that port. The switch supports individual storm control thresholds for broadcast, multicast, and unicast. If the traffic type threshold is reached, more of this type of traffic will be suppressed until the incoming stack flow drops below the threshold level.

Note: When multicast is faster than a set of thresholds, all inbound traffic (broadcast multicast unicast) is discarded until the level drops below the threshold level. Only the STP package is forwarded. When the broadcast and unicast thresholds are exceeded, only traffic exceeding the threshold is closed.

When the storm control is turned on, the switch monitors the packets over the interface to exchange the bus and determines whether the packet is unicast, multicast, or broadcast. The switch monitors the number of broadcast multicast and unicast, once every 1 seconds, and when a threshold for a type of traffic arrives, the traffic is discarded. This threshold is specified as a percentage of the total available bandwidth that can be used by the broadcast.

The following is a model graph of the broadcast traffic over a period of time on an interface.

This example can also be applied to multicast and unicast traffic. In this example, the broadcast traffic is forwarded between T1-T2 and T4-T5 time over the configured threshold and all of that traffic is discarded at the next time. Therefore, the broadcast traffic is closed within T2 and T5 time. At the next break, T3, if the broadcast traffic does not exceed the limit, then it is forwarded again.

The work of storm control algorithm is the combination of storm control suppression level and interval control per second. A higher threshold allows more packets to pass. Setting the door limit to 100% means that all traffic will not be throttled. 0% means that all broadcast multicast and unicast traffic will be closed.

Note: Because the package does not arrive within the unified time interval, there is no traffic between intervals that can affect storm control.

The switch continuously monitors the port traffic, and when the utilization level drops below the threshold, the dropped type of traffic is forwarded again.

You can use the Storm-control interface command to set a threshold value for each type of traffic.

Default Storm control configuration: By default, the storm control for unicast multicast broadcasts is turned off on the switch, which means: the suppression level is 100%.

Turn on Storm control: You turn on Storm control on the interface and enter a percentage of the total available bandwidth to determine what you want to use for that type of traffic, and enter 100% to allow all traffic. However, because of the limitations of the hardware and the difference in the size of the package, the threshold percentage is an approximate value.

Note: Storm control is only supported under the physical port, and it does not support the use of the Ethernet channel, although it can be knocked in.

The following example restricts the multicast storm level to 70.5% under F0/17

switch# Configure terminal

Switch (config) # interface FASTETHERNET0/17

Switch (config-if) # Storm-control Multicast level 70.5//Limit multicast type of package

Switch (config-if) # End

switch# Show Storm-control FASTETHERNET0/17 multicast

Interface Filter State level current

--------- ------------- ------- -------

FA0/17 Forwarding 70.5% 0%

This is a closed storm control.

switch# Configure terminal

Switch (config) # interface FASTETHERNET0/17

Switch (config-if) # no Storm-control multicast level

Switch (config-if) # End

switch# Show Storm-control FASTETHERNET0/17 multicast

Interface Filter State level current

--------- ------------- ------- -------

-Interface speed limit for CISCO 3550-qos

Building configuration ...

Current configuration:3123 bytes

Version 12.1

No service pad

Service Timestamps Debug Uptime

Service Timestamps log datetime localtime

No service password-encryption

Hostname Shangwu

Enable Secret 5 $1$pmhu$dlsphrguma1simueia87j0

Enable password

IP Subnet-zero

MLS QoS

Class-map Match-all user1-up

Match Access-group 10

Class-map Match-all User1-down

Match Access-group 100

Policy-map user1-up

Class user1-up

Police 800000 800000 exceed-action drop

Trust DSCP

Spanning-tree Extend System-id

Interface FASTETHERNET0/1

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/2

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/3

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/4

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/5

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/6

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/7

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/8

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/9

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/10

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/11

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/12

No IP address

Duplex full

Speed 100

Interface FASTETHERNET0/13

No IP address

Service-policy input user1-up

Interface FASTETHERNET0/14

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/15

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/16

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/17

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/18

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface Fastethernet0/19

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/20

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/21

No IP address

Duplex full

Service-policy input user1-up

Interface FASTETHERNET0/22

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/23

No IP address

Duplex full

Speed 100

Service-policy input user1-up

Interface FASTETHERNET0/24

Description WAN Interface

Switchport mode access

No IP address

Duplex full

Speed 100

Interface GIGABITETHERNET0/1

No IP address

Interface GIGABITETHERNET0/2

No IP address

Interface Vlan1

IP address ********255.255.255.0

IP Default-gateway ********

IP classless

IP HTTP Server

Logging Trap Debugging

Logging Source-interface fastethernet0/24

Logging ***********

Access-list Permit *********.0 0.0.0.255

Access-list permit IP any ********.0 0.0.0.255

Line con 0

Exec-timeout 0 0

Line vty 0 4

Password

Login

Line Vty 5 15

Password

Login

End

The hostname of the switch, the password to enter enable mode, the user name and password for remote login and settings, the IP address of the Management VLAN, the default gateway for the switch, the port of the switch, the SNMP service, the switch time setting, and so on. These are the same as the previous 2950 switches, 2960 switches and 2950 increase the speed limit and other functions, because in the future customers new shelves in addition to the signing of the traffic contract of the other to do on the switch port speed limit.

The first and most important point is that before the configuration of the switch is complete, especially the configuration of the VTP mode (in general, the initial mode of the VTP is configured as transparent mode), it is forbidden to connect the switch to the network until the VLAN information in the network changes, so Because it is configured with the console line.

At the beginning of the configuration 2950 because the password has not been set, security considerations do not connect it to the network, because it is configured with the console port. All ports are self-tested when the switch is power on, and the indicator light on each port starts to turn off after a period of time. The system's instructions are illuminated by default on the Syst and stat two lights.

After the switch is started, it is set up using the console line. The console line uses a serial interface, and the serial port is connected to the computer's serial port (e.g. the computer does not have a serial port to connect with the adapter), and the RJ-45 connector is connected to the console port of the switch. After the line is connected on Windows click start → programs → accessories → communication → HyperTerminal, after jumping out of the New Connection dialog box, fill in the Name column with the name of the connection you want to create, and then OK. Then connected to the COM port, in the COM1 attribute Portland rate Select "9600", Data bit Select "8", parity check Select "None", Stop bit Select "1", Flow control Select "None", or click "Restore Default" to determine the access to the 2950 configuration interface.

2950 If the dialog configuration mode option appears for the first boot, select Yes to enter the dialog configuration mode and select No to enter the CLI command line interface. The following configurations are performed in CLI mode.

Switch display:switch> in CLI mode

Enter command here switch> user mode

Switch>enable Entering privileged mode

switch# Configure terminal Enter configuration mode

Switch (config) # configuration mode

Set host name switch (config) #hostname hostname in general, the rules for setting the host name are switches followed by switch numbers, such as SWITCH20, SWITCH21, etc.

Set the Enable password switch (config) #enable secret password with the secret command, because it has better security than the password command, and the password is password The agent software randomly generates 12-bit passwords with numbers and uppercase and lowercase letters

Set the remote login switch (config) # username user name privilege permissions secret password

User name, permissions and password when setting the permissions parameters generally fill 0 (minimum permissions), the user name is unified netmaster, password with password agent software randomly generated 12 digits and uppercase and lowercase letters of the password

Encrypt the password switch (config) # service password-encryption that is set

Set the Management VLAN and switch (config) # interface vlan1 into the configuration of the management VLAN

Default gateway switch (CONFIG-IF) # IP Address IP addresses subnet mask settings management VLAN IP, remote login using this IP

Switch (CONFIG-IF) #no shutdown enable the management VLAN

Switch (config-if) #exit exit the configuration of the management VLAN

Switch (config) # IP default-gateway IP Address set default gateway

Set switch port switch (config) # interface fastethernet 0/1 Enter the switch port number 1th

Switch (config-if) # Description Uplink port is described, by default switch 1th port is upper connected port

Switch (config-if) # switchport mode trunk sets the upper connection to trunk

Switch (config-if) # Speed 100 Set the port rate

Switch (config-if) # Duplex full port set to fully duplex mode

Switch (config-if) interface range FastEthernet 0/2-24

Enter Port 2 to port 24 configuration

Switch (config-if-range) #shutdown close these ports and turn them on when you use them

Set the SNMP service switch (config) #snmp-server community string lgb96g0o RO

The command allows read access to any software that commits community string to a string set to conform to a length of more than 8 digits, to contain uppercase and lowercase letters and numbers

Turn off the HTTP service switch (config) #no IP http Server has a hidden risk due to the full-open HTTP service

Set vty switch (config) #line vty 0 4 set telnet to 0 to 4 total 5 lines

Switch24 (config-line) # Login Local enables the system to authenticate with a locally set user name and password when Telnet

Set timestamps switch (config) # service timestamps Debug datetime

Switch (config) # service timestamps log datetime default Debug/log to Uptime, datetime

Setting the VTP mode Switch#vlan database into VTP settings

Switch (VLAN) #vtp transparent to set the VTP mode to transparent mode

Set switch time Switch#clock set HH:MM:SS

Save settings for the switch switch#copy running-config startup-config

View switch Settings switch#show running-config View the configuration of the switch

Limit of port traffic

The limit of switch port traffic is implemented by Policy-map.

Switch (config) #ip access-list standard name//establish a standardized named access control list, name of the ACL

Switch (CONFIG-STD-NACL) # permit any//matches any IP

Switch (config) #class-map name//Set QoS class map

Switch (config-cmap) #match access-group name name//bind ACL list

Switch (config) #policy-map name//Set policy name

Switch (config-pmap) #class name//bind Class-map

Switch (config-pmap-c) #police 3000000 100000 exceed-action drop defines a policy with a normal rate of 3Mbit per second, the allowable range is 100KByte, and the out-of-range packet is drop

Switch (config) #interface range fastethernet 0/1–24//Enter Port 1-24, and the default switch must do speed limit in addition to the uplink

Switch (config-if) #service-policy input name//bound policy in the direction of the port upward

Switch (config) #mls QoS//Enable MLS QoS to make policy effective

Port-bound MAC address

After entering configuration mode, the following command bindings are used:

Switch (config-if) switchport port-security mac-address mac (host MAC address)

Unbind

Switch (config-if) no switchport port-security Mac-address mac (host MAC address)

How the two-layer switch is speed-limiting.

With the Cisco 2950 switch, each port is a two-tier access and how to speed limit.

The port speed limit can be used with Service-policy:

You can define class first, and then

Switch (config) # Policy-map Policy1

Switch (CONFIG-PMAP) # class Class1

Switch (config-pmap-c) # police 1000000 65536 exceed-action drop

Then configure under the interface:

Switch (config) # interface GIGABITETHERNET0/17

Switch (config-if) # Service-policy input Plcmap1

Can speed limit, but not accurate ...

Give an example of a speed limit of 6500:

Mls QoS aggregate-policer Test 50000000 100000 conform-action transmit exceed-action drop

Mls QoS

Class-map Match-any Test_limite

Match Access-group name Test_addr

Policy-map Rate-limit-uplink

Class Test_limite

Police aggregate test

IP Access-list Extended test_addr

Permit IP any x.x.x.x 0.0.0.255

Inter G0/1

Service-policy input Rate-limit-uplink

Summary: Cisco switch port speed limit commonly used configuration, the front-end speed limit work is done by the superior department, recently due to the branch's own internal customer needs, we want to provide it with 50M bandwidth. For this reason, we took a painstaking two-day test, first of all, we tested the device connection situation:

Cisco 3560 Port 0/47 (analog user) —————— Cisco 6509 ports 0/1, 0/2 (analog station, two routes on the line, hot standby).

Test method on 3560 and 6509 respectively from the FTP for Speed measurement

The point is to say the 6509 command:

MLS QoS Aggregate-policer Test 50000000 100000 conform-action transmit exceed-action drop

MLS QoS

Class-map Match-any Test_limite

Match Access-group name Test_addr

Policy-map Rate-limit-uplink

Class Test_limite

Police aggregate test

IP access-list Extended test_addr (because the upper and lower lines refer to the same policy so do not separate ACLs)

Permit IP any x.x.x.x 0.0.0.3 (Internet address segment a assigned to the user)

Permit IP x.x.x.x 0.0.0.3 any

Permit IP any x.x.x.x 0.0.0.3 (assigned to the user's Internet address segment B)

Permit IP x.x.x.x 0.0.0.3 any

Inter F0/1

IP addre x.x.x.x 255.255.255.252

Service-policy input Test_uplink limit upload

Inter F0/2

IP addre x.x.x.x 255.255.255.252

Service-policy input Test_uplink limit upload

Inter G0/47

Service-policy input rate-limit-uplink restricted download

After testing, the scheme was successful. There are a few points to explain, because 35 and 65 only in the input direction to refer to the policy, so at the same time the uplink and download as the speed limit need to be on the top and download two-way port to do, and secondly, we have a lot of detours, say to everyone to wake up, start our test equipment performance is very low, So always test not the ideal result, very frustrated, accidentally took the best of a computer to test, unexpectedly, and later found a high-performance equipment to test, the results are very ideal, here to remind you, low-performance equipment in the test of high bandwidth should pay special attention.

2-layer switch, which is directly into the port, uses line-rate to speed up the upper and lower lines, but it seems to be done in both directions

Here's what I saw you try.

Access-list 2 Permit any

MLS QoS

Class-map Match-all Input-class

Match Access-group 2

Class-map Match-all Output-class

Match IP DSCP 0

Policy-map output-policy-2m

Class Output-class

Police 2000000 200000 exceed-action drop

Policy-map input-policy-2m

Class Input-class

Police 2000000 200000 exceed-action drop

Policy-map output-policy-5m

Class Output-class

Police 5000000 500000 exceed-action drop

Policy-map input-policy-5m

Class Input-class

Police 5000000 500000 exceed-action drop

Policy-map output-policy-10m

Class Output-class

Police 10000000 1000000 exceed-action drop

Policy-map input-policy-10m

Class Input-class

Police 10000000 1000000 exceed-action drop

Policy-map output-policy-20m

Class Output-class

Police 20000000 1000000 exceed-action drop

Policy-map input-policy-20m

Class Input-class

Police 20000000 1000000 exceed-action drop

Interface fastethernet?/?

Service-policy input input-policy-5m

Service-policy Output output-policy-5m

Smart Ethernet Switch Series

The Cisco Catalyst 2960 Series Smart Ethernet switch is a new, fixed-configuration standalone device family that provides desktop Fast Ethernet and Gigabit Ethernet connectivity to provide enhanced LAN services for entry-level enterprise, midsize market, and branch office networks. The Catalyst2960 family has integrated security features, including network Admission Control (NAC), Advanced quality of Service (QoS), and resiliency to provide intelligent service to the edge of the network.

Cisco Catalyst 2960 Series offers: Provides intelligent features for network edge, such as advanced access Control lists (ACLs) and enhanced security features dual media uplink ports provide Gigabit Ethernet uplink flexibility and can use copper or fibre uplink ports- Each media uplink Port has a two-port Ethernet port and a small pluggable (SFP) Gigabit Ethernet port, one of which is activated when used, but cannot be used at the same time. Network control and bandwidth optimization are achieved through advanced QoS, precise rate limiting, ACL, and multicast services. Network security through multiple authentication methods, data encryption technology, and network access control based on user, port and MAC address simplifies network configuration, upgrades, and troubleshooting with smartports and automatically configures specific applications using the Cisco Network Assistant

Cisco Catalyst 2960-24tt:24 10/100 Ethernet port and 2 A/a fixed Ethernet uplink port; 1 rack Unit (RU)

Cisco Catalyst 2960-48tt:48 10/100 Ethernet port and 2 A/a fixed Ethernet uplink port; 1 RU

Cisco Catalyst 2960-24tc:24 10/100 Ethernet ports and 2 dual media uplink ports; 1 RU

Cisco Catalyst 2960-48tc:48 10/100 Ethernet ports and 2 dual media uplink ports; 1 RU

Cisco Catalyst 2960g-24tc:20 x/N Ethernet ports, 4 of which are dual media ports; 1 RU

The CiscoCatalyst2960 series of software images provides a rich array of intelligent services, including advanced QoS, rate limiting, and ACLs. SFP Gigabit Ethernet ports can be installed with a wide range of SFP transceivers including CISCO1000BASE-SX, 1000BASE-LX, 1000BASE-BX, 1000base-zx, 100base-fx, 100base-lx10, 100BASE-BX and coarse-wavelength division multiplexing (CWDM) SFP transceivers.

Advanced QoS:

802.1p Cos and DSCP field classifications are available with source and destination IP addresses, source and destination MAC addresses, or layer fourth TCP/UDP port numbers

Make tags and reclassify based on a single grouping.

The Cisco control plane and data plane QoS ACLs on all ports ensure proper tagging on a single grouping basis. 4 output queues per port allow users to manage up to four types of traffic in the stack.

The SRR Scheduler ensures that users can provide different priorities for data traffic by intelligently serving input and output queues. Weighted Fleet tail Drop (WTD) provides congestion avoidance for input and output queues before an outage occurs.

Strict prioritization ensures that the highest-priority groupings are serviced before all other traffic.

High-precision QoS features do not have any impact on performance.

Precise rate Limiting:

The Cisco CIR feature ensures bandwidth with accuracy of up to 1Mbps.

Rate limits are based on source and destination IP addresses, source and destination MAC addresses, layer fourth TCP/UDP information, or any combination of these fields, and are provided using QoS, ACLs (IP ACLs or Mac ACLs), level diagrams, and policy diagrams.

The input policy control and output shaping makes it easy to manage asynchronous upstream and downstream traffic from base stations or uplinks. Each Fast Ethernet or Gigabit Ethernet port can support up to 64 totals or a separate policy controller.