Downloads |
Table Of Contents
Input and Output Rate-Limiting on an Interface Example
Rate-Limiting and Precedence-Setting Example
Internet Exchange Point Example
Committed Access Rate
Feature Summary
The Committed Access Rate (CAR) feature performs the following functions:
•
Limits the input or output transmission rate on an interface or subinterface based on a flexible set of criteria.
•
Note
CAR can be used to rate-limit traffic based on certain matching criteria, such as incoming interface, IP precedence, QoS group, or IP access list criteria. CAR provides configurable actions, such as transmit, drop, set precedence, or set QoS group, when traffic conforms to or exceeds the rate limit.
Benefits
CAR performs two quality of service (QoS) functions:
•
•
•
•
List of Terms
average rate—Maximum long-term average rate of conforming traffic.
Committed Access Rate (CAR)—QoS feature that performs rate limiting and packet classification.
conform action—Action to take on packets below the rate allowed by the rate limit.
Distributed CAR (DCAR)—An implementation of CAR. DCAR performs all of the functions of CAR, but all of the processing takes place on the VIP.
exceed action—Action to take on packets above the rate allowed by the rate limit.
excess burst size—Bytes allowed in a burst before all packets will exceed the rate limit.
normal burst size—Bytes allowed in a burst before some packets will exceed the rate limit. Larger bursts are more likely to exceed the rate limit.
QoS group—Internal QoS group ID for a packet used to determine rate-limiting or weighted fair queuing characteristics for that packet.
rate limit—Traffic descriptor defined by the average rate, normal burst size, and excess burst size.
rate policy—The rate limit, conform actions, and exceed actions that apply to traffic matching a certain criteria.
Versatile Interface Processor (VIP)—Interface card used by Cisco 7500 series and Cisco 7000 series with RSP7000 routers.
Restrictions
CAR and DCAR can only be used with IP traffic. Non-IP traffic is not rate-limited.
CAR or DCAR can be configured on an interface or subinterface. However, CAR and DCAR are not supported on the following:
•
•
•
•
DCAR is not supported on ATM subinterfaces.
DCAR is not supported with the ATM encapsulations AAL5-MUX and AAL5-NLPID.
Platforms
CAR is supported on these platforms:
•
•
•
DCAR is only supported on Cisco 7000 series with RSP7000 or Cisco 7500 series routers with a VIP2-40 or better. A VIP2-50 card is strongly recommended when the aggregate line rate of the port adapters on the VIP is greater than DS-3. A VIP2-50 card is required for OC-3 rates.
Prerequisites
Distributed CEF switching must be enabled on any interface that uses DCAR, even when only output CAR is configured. In order to use CAR, CEF must be enabled on the interface.
Refer to the Cisco Express Forwarding feature documentation for configuration information.
Supported MIBs and RFCs
This feature supports the CISCO-CAR-MIB.
For descriptions of supported MIBs and how to use MIBs, see Cisco's MIB website on CCO at http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml.
No RFCs are supported by this feature.
Functional Description
This section describes the following aspects of the Committed Access Rate (CAR) feature:
Matching Criteria
Rate policies can be associated with one of the following:
•
•
•
•
•
Matching to IP access lists is more processor-intensive than matching based on other criteria.
Rate Limits
Rate limits define which packets conform or exceed based on the three parameters: average rate, normal burst size, and excess burst size:
•
•
•
•
CAR propagates bursts. It does no smoothing or shaping of traffic.
Conform and Exceed Actions
Once the packet has been classified as conforming or exceeding a particular rate limit, the router performs one of the following actions on the packet:
•
•
•
•
•
•
•
Multiple Rate Policies
One rate policy includes information about the rate limit, conform actions, and exceed actions.
Each interface can have multiple CAR policies, corresponding to different types of traffic. For example, low priority traffic may be limited to a lower rate than high priority traffic. Additionally, you can classify and set IP precedences or QoS groups based on different criteria for use by other QoS features (such as WRED or WFQ).
With multiple rate policies, the router examines each policy in the order entered until the packet matches. If a match is not found, the default action is to transmit.
The rate policies can be independent; each rate policy deals with a different type of traffic. Alternatively, rate policies can be cascading; a packet may be compared to multiple different rate policies in succession.
You can configure up to 20 rate policies on a subinterface.
Configuration Tasks
To configure CAR or DCAR, perform the following tasks beginning in global configuration mode:
Refer to the "Configuration Examples" section for example configurations.
Configuration Examples
The following sections provide examples of ways you might use CAR to control traffic into and out of your network:
•
•
•
Input and Output Rate-Limiting on an Interface Example
In this example, a customer is connected to an ISP by a T3 link. The ISP wants to rate-limit the customer's transmissions to 20 Mbps of the 45 Mbps. In addition, the customer is allowed to transmit bursts of 24000 bytes. All exceeding packets dropped. The following commands are configured on the ISP's HSSI interface connected to the customer:
interface Hssi0/0/0description 45Mbps to R1rate-limit input 20000000 24000 24000 conform-action transmit exceed-action dropip address 200.200.14.250 255.255.255.252rate-limit output 20000000 24000 24000 conform-action transmit exceed-action dropTo verify the configuration and monitor CAR statistics, use the show interfaces rate-limit command:
Router# show interfaces hssi 0/0/0 rate-limitHssi0/0/0 45Mbps to R1Inputmatches: all trafficparams: 20000000 bps, 24000 limit, 24000 extended limitconformed 8 packets, 428 bytes; action: transmitexceeded 0 packets, 0 bytes; action: droplast packet: 8680ms ago, current burst: 0 byteslast cleared 00:03:59 ago, conformed 0 bps, exceeded 0 bpsOutputmatches: all trafficparams: 20000000 bps, 24000 limit, 24000 extended limitconformed 0 packets, 0 bytes; action: transmitexceeded 0 packets, 0 bytes; action: droplast packet: 8680ms ago, current burst: 0 byteslast cleared 00:03:59 ago, conformed 0 bps, exceeded 0 bpsRate-Limiting and Precedence-Setting Example
The following example limits the rate by application.
•
•
•
Notice that two access lists are created to classify the Web and FTP traffic so that they can be handled separately by the CAR feature.
interface Hssi0/0/0description 45Mbps to R2rate-limit input access-group 101 20000000 24000 32000 conform-action set-prec-transmit 5 exceed-action set-prec-transmit 0rate-limit input access-group 102 10000000 24000 32000 conform-action set-prec-transmit 5 exceed-action droprate-limit input 8000000 16000 24000 conform-action set-prec-transmit 5 exceed-action dropip address 200.200.14.250 255.255.255.252!access-list 101 permit tcp any any eq wwwaccess-list 102 permit tcp any any eq ftpTo verify the configuration and monitor CAR statistics, use the show interfaces rate-limit command:
Router# show interfaces hssi 0/0/0 rate-limitHssi0/0/0 45Mbps to R2Inputmatches: access-group 101params: 20000000 bps, 24000 limit, 32000 extended limitconformed 3 packets, 189 bytes; action: set-prec-transmit 5exceeded 0 packets, 0 bytes; action: set-prec-transmit 0last packet: 309100ms ago, current burst: 0 byteslast cleared 00:08:00 ago, conformed 0 bps, exceeded 0 bpsmatches: access-group 102params: 10000000 bps, 24000 limit, 32000 extended limitconformed 0 packets, 0 bytes; action: set-prec-transmit 5exceeded 0 packets, 0 bytes; action: droplast packet: 19522612ms ago, current burst: 0 byteslast cleared 00:07:18 ago, conformed 0 bps, exceeded 0 bpsmatches: all trafficparams: 8000000 bps, 16000 limit, 24000 extended limitconformed 5 packets, 315 bytes; action: set-prec-transmit 5exceeded 0 packets, 0 bytes; action: droplast packet: 9632ms ago, current burst: 0 byteslast cleared 00:05:43 ago, conformed 0 bps, exceeded 0 bpsInternet Exchange Point Example
This example uses rate-limiting to control traffic in an Internet Exchange Point (IXP). Since the IXP is comprised of many neighbors around a FDDI ring, MAC address rate-limit access lists are used to control traffic from a particular ISP. Traffic from one ISP (at 00e0.34b0.7777) is compared to a rate-limit of 80 Mbps of the 100 Mbps available on the FDDI connection. Traffic that conforms to this rate is transmitted. Non-conforming traffic is dropped.
interface Fddi2/1/0rate-limit input access-group rate-limit 100 800000000 64000 80000 conform-action transmit exceed-action dropip address 200.200.6.1 255.255.255.0!access-list rate-limit 100 00e0.34b0.7777To verify the configuration and monitor the CAR statistics, use the show interfaces rate-limit:
Router# show interfaces fddi2/1/0 rate-limitFddi2/1/0Inputmatches: access-group rate-limit 100params: 800000000 bps, 64000 limit, 80000 extended limitconformed 0 packets, 0 bytes; action: transmitexceeded 0 packets, 0 bytes; action: droplast packet: 4737508ms ago, current burst: 0 byteslast cleared 01:05:47 ago, conformed 0 bps, exceeded 0 bpsCommand Reference
This section documents new or modified commands. All other commands used with this feature are documented in the Cisco IOS Release 11.1 command references or the Cisco Express Forwarding feature documentation.
access-list rate-limit
To configure an access list for use with Committed Access Rate (CAR) policies, use the access-list rate-limit global configuration command. The no form of this command removes the access list from the configuration.
access-list rate-limit acl-index {precedence | mac-address | mask prec-mask}
no access-list rate-limit acl-index {precedence | mac-address | mask prec-mask}Syntax Description
Default
No CAR access lists are configured.
Command Mode
Global configuration
Usage Guidelines
This command first appeared in Cisco IOS Release 11.1 CC.
This command classifies packets with the specified IP precedence or MAC address into a particular CAR access list. You can then apply CAR policies, using the rate-limit command, to individual rate-limit access lists. Thus, packets with different IP precedences or MAC addresses are treated differently by the CAR process.
You can only specify one command for each rate-limit access list. If you enter this command multiple times with the same access list number, the new command will overwrite the previous command.
Use the mask keyword to assign multiple IP precedences to the same rate-limit list. To determine the mask value, perform the following steps:
Step 1
Step 2
Step 3
Step 4
A mask of FF matches any precedence, and 00 does not match any precedence.
Example
The following example assigns any packets with a MAC address of 00e0.34b0.7777 to rate-limit access list 100:
access-list rate-limit 100 00e0.34b0.7777The following example assigns packets with an IP precedence of 0, 1, or 2 to the rate-limit access list 25:
access-list rate-limit 25 mask 07Related Commands
rate-limit
show access-lists rate-limit
show interfaces rate-limitrate-limit
To configure Committed Access Rate (CAR) policies, use the rate-limit interface configuration command. The no form of this command removes the rate limit from the configuration.
rate-limit {input | output} [access-group [rate-limit] acl-index | qos-group qos-number] bps
burst-normal burst-max conform-action action exceed-action action
no rate-limit {input | output} [access-group [rate-limit] acl-index | qos-group qos-number]
bps burst-normal burst-max conform-action action exceed-action actionSyntax Description
Default
CAR is disabled.
Command Mode
Interface configuration
Usage Guidelines
This command first appeared in Cisco IOS Release 11.1 CC.
Use this command to configure your CAR policy on an interface. To specify multiple policies, enter this command once for each policy. For each policy, provide the following information:
•
•
•
•
•
•
•
Example
The following example limits the rate by application.
•
•
•
Notice that two access lists are created to classify the Web and FTP traffic so that they can be handled separately by the CAR feature.
interface Hssi0/0/0description 45Mbps to R2rate-limit input access-group 101 20000000 24000 32000 conform-action set-prec-transmit 5 exceed-action set-prec-transmit 0rate-limit input access-group 102 10000000 24000 32000 conform-action set-prec-transmit 5 exceed-action droprate-limit input 8000000 16000 24000 conform-action set-prec-transmit 5 exceed-action dropip address 200.200.14.250 255.255.255.252!access-list 101 permit tcp any any eq wwwaccess-list 102 permit tcp any any eq ftpRelated Commands
access-list rate-limit
show interfaces rate-limitshow access-lists
To display the contents of current IP and rate-limit access lists, use the show access-lists privileged EXEC command.
show access-lists [access-list-number]
Syntax Description
access-list-number
(Optional) Access list number to display. The range is 1 to 1199. The system displays all access lists by default.
Default
The system displays all access lists.
Command Mode
Privileged EXEC
Usage Guidelines
This command appeared before Cisco IOS Release 10.0.
Sample Display
The following is sample output from the show access-lists command when rate-limit access lists are configured:
Router# show access-listsStandard IP access list 1permit anyStandard IP access list 1300permit anyRate-limit access list 10Rate-limit access list 21Rate-limit access list 32Rate-limit access list 43Rate-limit access list 54Rate-limit access list 65Rate-limit access list 9mask FFRate-limit access list 10mask 0FRate-limit access list 11mask F0Rate-limit access list 1001001.0110.1111Rate-limit access list 10100E0.34B8.D840Rate-limit access list 1991111.1111.1111The following is sample output from the show access-lists command when access lists numbered 1 are displayed:
Router# show access-lists 1Standard IP access list 1permit anyRate-limit access list 10The following is sample output from the show access-lists command when an extended access list is configured:
Router# show access-lists 101Extended IP access list 101permit tcp host 198.92.32.130 any established (4304 matches)permit udp host 198.92.32.130 any eq domain (129 matches)permit icmp host 198.92.32.130 anypermit tcp host 198.92.32.130 host 171.69.2.141 gt 1023permit tcp host 198.92.32.130 host 171.69.2.135 eq smtp (2 matches)permit tcp host 198.92.32.130 host 198.92.30.32 eq smtppermit tcp host 198.92.32.130 host 171.69.108.33 eq smtppermit udp host 198.92.32.130 host 171.68.225.190 eq syslogpermit udp host 198.92.32.130 host 171.68.225.126 eq syslogdeny ip 150.136.0.0 0.0.255.255 224.0.0.0 15.255.255.255deny ip 171.68.0.0 0.1.255.255 224.0.0.0 15.255.255.255 (2 matches)deny ip 172.24.24.0 0.0.1.255 224.0.0.0 15.255.255.255deny ip 192.82.152.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.122.173.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.122.174.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.135.239.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.135.240.0 0.0.7.255 224.0.0.0 15.255.255.255deny ip 192.135.248.0 0.0.3.255 224.0.0.0 15.255.255.255deny ip 192.150.42.0 0.0.0.255 224.0.0.0 15.255.255.255An access list counter counts how many packets are allowed by each line of the access list. This number is displayed as the number of matches.
Related Commands
access-list (extended)
access-list (standard)
access-list rate-limit
clear access-list counters
clear access-temp
ip access-list
show access-lists rate-limit
show ip access-listshow access-lists rate-limit
To display information about rate-limit access lists, use the show access-lists rate-limit EXEC command.
show access-lists rate-limit [acl-index]
Syntax Description
Command Mode
EXEC
Usage Guidelines
This command first appeared in Cisco IOS Release 11.1 CC.
Sample Display
The following is sample output from the show access-lists rate-limit command:
Router# show access-lists rate-limitRate-limit access list 10Rate-limit access list 21Rate-limit access list 32Rate-limit access list 43Rate-limit access list 54Rate-limit access list 65Rate-limit access list 9mask FFRate-limit access list 10mask 0FRate-limit access list 11mask F0Rate-limit access list 1001001.0110.1111Rate-limit access list 10100E0.34B8.D840Rate-limit access list 1991111.1111.1111The following is sample output from the show access-lists rate-limit command when specific rate-limit access lists are specified:
Router# show access-lists rate-limit 1Rate-limit access list 10Router# show access-lists rate-limit 9Rate-limit access list 9mask FFRouter# show access-lists rate-limit 101Rate-limit access list 10100E0.34B8.D840describes the fields shown in these displays.
Related Commands
access-list rate-limit
rate-limitshow interfaces rate-limit
To display information about CAR for an interface, use the show interfaces rate-limit EXEC command.
show interfaces [interface] rate-limit
Syntax Description
Command Mode
EXEC
Usage Guidelines
This command first appeared in Cisco IOS Release 11.1 CC.
Sample Display
The following is sample output from the show interfaces rate-limit command:
Router# show interfaces fddi2/1/0 rate-limitFddi2/1/0Inputmatches: access-group rate-limit 100params: 800000000 bps, 64000 limit, 80000 extended limitconformed 0 packets, 0 bytes; action: set-prec-continue 1exceeded 0 packets, 0 bytes; action: set-prec-continue 0last packet: 4737508ms ago, current burst: 0 byteslast cleared 01:05:47 ago, conformed 0 bps, exceeded 0 bpsmatches: access-group 101params: 80000000 bps, 56000 limit, 72000 extended limitconformed 0 packets, 0 bytes; action: set-prec-transmit 5exceeded 0 packets, 0 bytes; action: set-prec-transmit 0last packet: 4738036ms ago, current burst: 0 byteslast cleared 01:02:05 ago, conformed 0 bps, exceeded 0 bpsmatches: all trafficparams: 50000000 bps, 48000 limit, 64000 extended limitconformed 0 packets, 0 bytes; action: set-prec-transmit 5exceeded 0 packets, 0 bytes; action: set-prec-transmit 0last packet: 4738036ms ago, current burst: 0 byteslast cleared 01:00:22 ago, conformed 0 bps, exceeded 0 bpsOutputmatches: all trafficparams: 80000000 bps, 64000 limit, 80000 extended limitconformed 0 packets, 0 bytes; action: transmitexceeded 0 packets, 0 bytes; action: droplast packet: 4809528ms ago, current burst: 0 byteslast cleared 00:59:42 ago, conformed 0 bps, exceeded 0 bpsdescribes the fields shown in this display.
Related Commands
access-list rate-limit
clear counters
rate-limit
