Configure traffic
storm control levels according to the following guidelines and limitations:
-
Typically, a
fabric administrator configures storm control in fabric access policies on the
following interfaces:
-
A regular
trunk interface.
-
A direct port
channel on a single leaf switch.
-
A virtual port
channel (a port channel on two leaf switches).
-
Beginning with release 4.2(1), support is now available for triggering SNMP traps from Cisco Application Centric
Infrastructure (ACI) when storm control thresholds are met, with the following restrictions:
-
There are two actions associated with storm control: drop and shutdown. With the shutdown action, interface traps will be
raised, but the storm control traps to indicate that the storm is active or clear is not determined by the shutdown action.
Storm control traps with the shutdown action on the policy should therefore be ignored.
-
If the ports flap with the storm control policy on, clear and active traps are seen together when the stats are collected.
Clear and active traps are typically not seen together, but this is expected behavior in this case.
-
For port channels and virtual port channels, the storm control values (packets per second or percentage) apply to all individual
members of the port channel.
Note
|
For switch hardware, beginning with Cisco Application Policy Infrastructure
Controller (APIC) release 1.3(1) and switch release 11.3(1), for port channel configurations, the traffic suppression on the aggregated port
may be up to two times the configured value. The new hardware ports are internally subdivided into these two groups: slice-0
and slice-1. To check the slicing map, use the vsh_lc command show platform internal hal l2 port gpd and look for slice 0 or slice 1 under the Sl column. If port channel members fall on both slice-0 and slice-1, allowed storm control traffic may become twice the configured
value because the formula is calculated based on each slice.
|
-
When configuring
by percentage of available bandwidth, a value of 100 means no traffic storm
control and a value of 0.01 suppresses all traffic.
-
Due to hardware
limitations and the method by which packets of different sizes are counted, the
level percentage is an approximation. Depending on the sizes of the frames that
make up the incoming traffic, the actual enforced level might differ from the
configured level by several percentage points. Packets-per-second (PPS) values
are converted to percentage based on 256 bytes.
-
Maximum burst is
the maximum accumulation of rate that is allowed when no traffic passes. When
traffic starts, all the traffic up to the accumulated rate is allowed in the
first interval. In subsequent intervals, traffic is allowed only up to the
configured rate. The maximum supported is 65535 KB. If the configured rate
exceeds this value, it is capped at this value for both PPS and percentage.
-
The maximum burst
that can be accumulated is 512 MB.
-
On an egress leaf
switch in optimized multicast flooding (OMF) mode, traffic storm control will
not be applied.
-
On an egress leaf
switch in non-OMF mode, traffic storm control will be applied.
-
On a leaf switch
for FEX, traffic storm control is not available on host-facing interfaces.
-
Traffic storm control unicast/multicast differentiation is not supported on Cisco Nexus C93128TX, C9396PX, C9396TX, C93120TX,
C9332PQ, C9372PX, C9372TX, C9372PX-E, or C9372TX-E switches.
-
SNMP traps for traffic storm control are not supported on Cisco Nexus C93128TX, C9396PX, C9396TX, C93120TX, C9332PQ, C9372PX,
C9372TX, C9372PX-E, C9372TX-E switches.
-
Traffic storm control traps is not supported on Cisco Nexus C93128TX, C9396PX, C9396TX, C93120TX, C9332PQ, C9372PX, C9372TX,
C9372PX-E, or C9372TX-E switches.
-
Storm Control Action is supported only on physical Ethernet interfaces and port channel interfaces.
Beginning with release 4.1(1), Storm Control Shutdown option is supported. When the shutdown action is selected for an interface with the default Soak Instance Count, the packets exceeding the threshold are dropped
for 3 seconds and the port is shutdown on the 3rd second. The default action is Drop. When Shutdown action is selected, the user has the option to specify the soaking interval. The default soaking interval is 3 seconds. The
configurable range is from 3 to 10 seconds.
-
If the data plane policing (DPP) policer that is configured for the interface has a value that is lower than storm policer's
value, the DPP policer will take the precedence. The lower value that is configured between the DPP policer and storm policer
is honored on the configured interface.
-
Beginning with release 4.2(6), the storm policer is enforced for all forwarded control traffic in the leaf switch for the
DHCP, ARP, ND, HSRP, PIM, IGMP, and EIGRP protocols regardless of whether the bridge domain is configured for Flood in BD or Flood in Encapsulation. This behavior change applies only to EX and later leaf switches.
-
With EX switches, you can configure both the supervisor policer and storm policer for one of the protocols. In this case,
if a server sends traffic at a rate higher than the configured supervisor policer rate (Control Plane Policing, CoPP), then
the storm policer will allow more traffic than what is configured as the storm policer rate. If the incoming traffic rate
is equal to or less than supervisor policer rate, then the storm policer will correctly allow the configured storm traffic
rate. This behavior is applicable irrespective of the configured supervisor policer and storm policer rates.
-
One side effect of the storm policer now being enforced for all forwarded control traffic in the leaf switch for the specified
protocols is that control traffic that gets forwarded in the leaf switch will now get subjected to storm policer drops. In
previous releases, no such storm policer drops occur for the protocols that are affected by this behavior change.
-
Traffic storm control cannot police multicast traffic in a bridge domain or VRF instance that has PIM enabled.
-
When the storm control policer is applied on a port channel interface, the allowed rate may be more than the configured rate.
If the member links of the port channel span across multiple slices, then the allowed traffic rate will be equal to the configured
rate multiplied by the number of slices across which the member links span.
The port-to-slice mapping depends on the switch model.
As an example, assume that there is a port channel that has member links port1, port2, and port3 with a storm policer rate
of 10Mbps.
-
If port1, port2, and port3 belong to slice1, then traffic is policed to 10Mbps.
-
If port1 and port2 belong to slice1 and port3 belongs to slice2, then traffic is policed to 20Mbps.
-
If port1 belongs to slice1, port2 belongs to slice2, and port3 belongs to slice3, then traffic is policed to 30Mbps.
Feedback