If you are playing around with CBWFQ you might have discovered that it’s impossible to attach a policy-map to a sub-interface directly. There is a good reason for this and I’d like to show you why this occurs and how to fix it. This is the topology I will use to demonstrate this:
Just two routers connected to teach other using frame-relay. We will try to configure CBWFQ on the Serial 0/0.1 sub-interface of R1.
Configuration
First i’ll create a simple CBWFQ configuration:
R1(config)#class-map TELNET
R1(config-cmap)#match protocol telnet
R1(config)#class-map HTTP
R1(config-cmap)#match protocol http
R1(config)#policy-map CBWFQ
R1(config-pmap)#class TELNET
R1(config-pmap-c)#bandwidth percent 10
R1(config-pmap-c)#exit
R1(config-pmap)#class HTTP
R1(config-pmap-c)#bandwidth percent 20
R1(config-pmap-c)#exitNothing special here…just a simple CBWFQ configuration that gives 10% of the bandwidth to telnet and 20% to HTTP traffic. Let’s try to apply it to the sub-interface:
R1(config)#interface serial 0/0.1
R1(config-subif)#service-policy output CBWFQ
CBWFQ : Not supported on subinterfacesToo bad, it’s not gonna happen…IOS has a day off. There is a workaround however…we can’t apply it directly, but if we use a hierarchical policy-map it will work. Let me show you what I mean:
R1(config)#policy-map PARENT
R1(config-pmap)#class class-default
R1(config-pmap-c)#service-policy CBWFQI’ll create a policy-map called PARENT that has our service-policy attached to the class-default class. Now let’s try to attach this to the sub-interface:
R1(config)#interface serial 0/0.1
R1(config-subif)#service-policy output PARENT
CBWFQ : Hierarchy supported only if shaping is configured in this classIOS is still complaining, it only allows a hierarchical policy-map when shaping is configured. Let’s give it what it wants:
Hi Rene,
I’ve been following your tutorials for quite a while now and they have helped my a lot. Thanks for them.
Two things I want to ask:
Using Class-map, is it possible to block something like Facebook. I am able to block http://www.facebook.com but https is a headache. Can’t seem to block only one https site. I don’t want to block all https category.
Do you have tutorials on different Switching stuffs like STP, RSTP, MST, VLAN etc?
Please share if ya have. Will be grateful.
rgds
BJ
Hi BJ,
You can use NBAR to block HTTP but not HTTPS, here’s why:
I have quite some switching tutorials but I’m going to add more, t
... Continue reading in our forumHi Olaniyi,
QoS on the switches works a bit different. The configuration is different. Here’s an example:
I think the 4900/4500 QoS is similar but I’d have to check.
Rene
Hi Filip,
That’s right and the same thing applies to the class-default class. The only difference is that the class-default class will have a much higher weight that any of the user defined classes so it will only get a small portion of the bandwidth, even if you don’t configure a bandwidth for it. I’d have to check how much exactly, on IOS 12.4 you could use the “show queueing” command to see the weights. Not sure you can still see them on IOS 15 since these commands have been deprecated but I could do a simple bandwidth test
Rene
Hi Rene,
I need you shed some light on ‘when congested’. Am I right in saying the QoS policies that we apply are insignificant during the period of non-congestion? can request you demo this.
Also I believe tx ring limit and hold-queue commands on an interface lets us play with the interface buffers and hence the congestion. Can you please shed some light on them too?
Thanks.
Ayyappan