1、Class-based PolicingObjectivesUpon completing this lesson, you will be able to: Describe class-based policingConfigure class-based policingMonitor and troubleshoot class-based policingClass-Based PolicingClass-based policing is used to limit a traffic class to a configured bit rate.It uses a token b

2、ucket model to measure the arrival rate of packets.Class-based policing is an improved version of the committed access rate (CAR) mechanism.Class-based policing is configured using the Modular QoS CLI.How Do Routers Measure Traffic Rate?Routers use the token bucket mathematical model to keep track o

3、f packet arrival rate.The Token Bucket model is used whenever a new packet is processed.The return value is conform or exceed.BandwidthTimeLink BandwidthRate LimitExceeding TrafficConforming Traffic700700Token Bucket500 bytes500 bytesConform Action200Token Bucket (cont.)300 bytesExceed Action300 byt

4、esToken BucketBc is normal burst size (specifies sustained rate).Be is excess burst size (specifies length of burst).BeBc of tokens is added every Tc msTc = Bc / CIRTimeLinkUseTc2*Tc3*Tc4*Tc5*TcBcBcBcBcBcBcLink BWAverage BW(CIR)BeClass-Based PolicingCAR uses one single token bucket to determine if a

5、 packet conforms to or exceeds the bit-rate policy.CAR用單桶來決定報文屬于conform或者exceed組Class-based policing uses one or two token buckets to determine if a packet ，CB policing用單桶或者雙桶來決定報文屬于:Conformsis within the average bit rate平均速率之內的Exceedsexceeds the average bit rate but is within the allowed excess bur

6、st 超出平均速率的但是在過量突發之內的報文Violatesexceeds both the average bit rate and the allowed excess burst (optional)超出conform和execeedClass-Based Policing ActionsA packet can conform, exceed, or violate the rate limit.一個報文可以屬于conform、exceed、violate組In response, the policer can take one of these actions流量監管可以有如下行為

7、：:TransmitDrop以下為標記Set IP Precedence and transmitSet IP DSCP and transmitSet QoS group and transmitSet MPLS experimental bits and transmitSet Frame Relay DE bit and transmitSet ATM CLP bit and transmitSingle Token Bucket with Class-Based PolicingThe packet conforms to the policy if the size of the p

8、acket is less than or equal to the number of tokens in the token bucket.數據包的字節數小于等于令牌桶中的令牌數，則數據包遵守契約，同時從令牌桶移除相應數目的令牌700Be500 bytesConform Action700Single Token Bucket with Class-Based Policing (cont.)The packet exceeds the policy if the size of the packet is more than the number of tokens in the tok

9、en bucket.數據包中的字節數大于令牌桶中的令牌，超出契約，不移除令牌200Be300 bytesExceed ActionDouble Token Bucket with Class-Based PolicingThe packet conforms to the policy if the size of the packet is less than or equal to the number of tokens in the first token bucket-如果小于等于第一個令牌桶的數量，那么遵循conform策略限速將移除與數據包相同的令牌700400BcBe500 b

10、ytesConform Action700Double Token Bucket with Class-Based Policing (cont.)The packet exceeds the policy if the size of the packet is more than the number of tokens in the first token bucket and less or equal to the number of tokens in the second token bucket-如果到達的報文大小大于第一個令牌桶同時小于等于第二個令牌桶則遵循exceedCB限

11、速將與數據包字節等量的字節移除令牌桶200400BcBe300 bytesExceed Action400Double Token Bucket with Class-Based Policing (cont.)The packet violates the policy if the size of the packet is more than the number of tokens in the first and the second token bucket-到達報文大于等于每個令牌桶的令牌數則為violate不會移除任何的令牌桶200100BcBe400 bytesViolate

12、 ActionRefilling the Token BucketsThe number of tokens that have to be added is actually calculated every time a new packet has to be processed:TB1 = min(BC, TB1 + (Tnow - TLastPacket) * BitRate / 8)TB1TB2Add tokens at the configured bit rateExcess spills over into the second token bucketBcBeTime of

13、 the last packet secondsTime now secondsNew size of the token bucketPrevious size of the token bucket令牌桶的填充和消耗：在數據包到達時填充BC桶填充溢出的令牌不浪費會放入BE通，如果BE桶也填滿則移除的令牌無法使用Configuring Class-Based Policingpolice avg-rate BC BE conform-action action exceed-action action violate-action actionRouter(config-pmap-c)#av

14、g-rate traffic rate in bps (8.000 to 200.000.000)BC normal burst sets the size of the first token bucket in bytes (default is 1500 or avg-rate/32, whatever is higher)BE excess burst sets the size of the second token bucket in bytes (equals BC if not configured)action can be:transmit (default conform

15、 action)drop (default exceed and violate action)set-prec-transmit ip-precedenceset-dscp-transmit dscpset-qos-transmit qos-groupset-mpls-exp-transmit mple-expset frde-transmit set-clp-transmitExample 1（單速率單桶） class-map match-all C1 match input-interface Serial1/0！policy-map P1 class C1 police cir 800

16、0 bc 1500 be 1000（可以只配置CIR自行計算Bc和Be） conform-action transmit exceed-action drop（沒有配置violate，所以加接口驗證時不會顯示BE）！sh policy-map Policy Map P1 Class C1 police cir 8000 bc 1500 conform-action transmit exceed-action dropExample 2（雙速率雙桶）class-map match-all C1 match any ！policy-map DualPIR class C1 police cir

17、8000 bc 1000 pir 9000 be 1000 conform-action transmit exceed-action transmit violate-action set-prec-transmit 3！sh policy-map Policy Map DualPIR Class C1 police cir 8000 bc 1000 pir 9000 be 1000 conform-action transmit exceed-action transmit violate-action set-prec-transmit 5驗證PIRR1#show policy-map

18、interface Serial1/0 Service-policy input: P1 Class-map: C1 (match-all) 10 packets, 10140 bytes 5 minute offered rate 2000 bps, drop rate 0 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes pir 9000 bps, be 1000 bytes conformed 2 packets, 1048 bytes; actions: transmit exceeded 0 packets

19、, 0 bytes; actions: transmit violated 8 packets, 9092 bytes; actions: set-prec-transmit 3 conformed 0 bps, exceed 0 bps, violate 2000 bps雙速三色(雙速雙桶)雙速三色(雙速雙桶)兩個加令牌的速率，兩個令牌桶，三種狀態conform 符合從第一個令牌桶和第二個令牌桶同時取到令牌的exceed 超出從第一個令牌桶取令牌的violate 違規取不到令牌的Two Rate Three Color (2 Bucket) 雙速率，三色（兩個令牌桶）RFC 26981100

20、700BeBcTB2TB1CIR，根據到達時間和BC按比例填充PIR，更準確說法為根據到達時間和BE按照比例填充溢出的令牌不在使用雙速率三色，兩個令牌桶。引入峰值速率（PIRCIR）第一個桶是黃色，第二個桶是綠色令牌填充的區別：在需要被限制的數據包到達時，填充兩個令牌桶。區別在于PIR是直接填充的無需等待CIR的溢出，無需非活躍期1100600Two Rate Three Color (2 Bucket) 雙速率，三色（兩個令牌桶）RFC 2698700BeBc500 bytesConform ActionTB1200TB2If the number of bytes in the packe

21、t is less than or equal to (=) the number of tokens in the CIR bucket, the packet conforms. CB Policing removes tokens from the CIR equal to the number of bytes in the packet, and performs the action for packets that conform to the contract. CB Policing also removes the same number of tokens from th

22、e PIR bucket-包的大小小于等于CIR桶中的令牌數稱之為conform；CB policing從BC桶移除相應數目的字節數，注意此時也從BE桶移除相應的字節600Two Rate Three Color (2 Bucket) 雙速率，三色（兩個令牌桶）RFC 2698200BeBc300 bytesExceed Action300TB2TB1If the packet does not conform, and the number of bytes in the packet is less than or equal to (=) the number of tokens in

23、the PIR bucket, the packet exceeds. CB Policing removes tokens from the PIR bucket equal to the number of bytes in the packet, and performs the action for packets that exceed the contract.第一個桶夠可以取，第二個桶不夠取成為黃色-Exceed（小于BE桶的令牌數），CB policing從PIR桶中移除相應字節的報文Two Rate Three Color (2 Bucket) 雙速率，三色（兩個令牌桶）RF

24、C 2698300200BeBc400 bytesViolate ActionTB2TB1If the packet neither conforms nor exceeds, it violates the traffic contract. CB Policing does not remove tokens from either bucket, and performs the action for packets that violate the contract.兩個桶都不夠取稱為紅色Violate，CB policing不會從任何桶中移除令牌Class-Based Policin

25、g ExampleThe customer can locate a server at service provider premises (switched LAN). Class-based policing is used to limit the amount of traffic that the web server can generate (more flexible per-bandwidth pricing).Unknown traffic is rate-limited to 64 kbps to allow remote configuration of new se

26、rvers.Class-Based Policing Exampleclass-map match source-address mac 000d.dddf.0480!class-map match source-address mac 000d.dddc.ad21!policy-map ServerFarm class police 128000 conform-action transmit exceed-action drop class police 256000 conform-action transmit exceed-action drop class class-defaul

27、t police 64000!interface FastEthernet 0/0 service-policy input ServerFarm!Monitoring and Troubleshooting Class-Based PolicingRouter#show policy interface fastethernet 0/0 FastEthernet0/0 Service-policy input: ServerFarm (1207) Class-map: (match-all) (1209/6) 0 packets, 0 bytes 5 minute offered rate

28、0 bps, drop rate 0 bps Match: ip precedence 4 (1213) Match: source-address mac 000D.DDDF.0480 (1217) police: 128000 bps, 4000 limit, 4000 extended limit conformed 0 packets, 0 bytes; action: transmit exceeded 0 packets, 0 bytes; action: drop conformed 0 bps, exceed 0 bps violate 0 bps . Class-map: c

29、lass-default (match-any) (1229/0) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any (1233) police: 64000 bps, 2000 limit, 2000 extended limit conformed 0 packets, 0 bytes; action: transmit exceeded 0 packets, 0 bytes; action: drop conformed 0 bps, exceed 0 bps violate 0 bps

30、.SummaryUpon completing this lesson, you should be able to:Describe class-based policingConfigure class-based policingMonitor and troubleshoot class-based policingLesson ReviewWhat do CAR and class-based policing do?What are the main differences between CAR and class-based policing?Which marking opt

31、ions does class-based policing support?Which actions does class-based policing support?Class-based ShapingObjectivesUpon completing this lesson, you will be able to: Describe class-based shapingConfigure class-based shapingMonitor and troubleshoot class-based shapingClass-Based ShapingUse of class-b

32、ased shaping is similar to that of class-based policingClass-Based Shaping is used to rate-limit packetsDelays exceeding packets rather than dropping themHas no marking capabilitiesClass-based shaping is a version of generic traffic shaping (GTS) using the Modular QoS CLIClass-Based ShapingClass-Bas

33、ed ShapingRouter periodically updates the token bucket (every TC) and checks if any packets can be forwarded to the main queue.TC = BC / BitRateShaping Queue N TokenBucketEnoughTokens?packetCheck Shaping Queue NForwardYesDo NothingNoPacket SizeTokensQueue NBC+BEAdd TokensRefilling the Token BucketCl

34、ass-based shaping has two shaping methods:Shaping to the configured average rate (adds BC tokens every TC)每Tc時間內放入Bc大小的令牌Shaping to the peak rate (adds BC+BE tokens every TC)Average rate is forwarding packets at the configured average rate with allowed bursting up to BE when there are extra tokens a

35、vailablePeak rate is forwarding packets at the peak rate, which is calculated using this formula，PIR需要計算:PeakRate = AvgRate * (1+BE/BC)Configuring Class-Based Shapingshape average | peak bit-rate BC BERouter(config-pmap-c)#BC and BE can be omitted to let the router select the optimal values.shape ma

36、x-buffers queue-limitRouter(config-pmap-c)#Set the maximum number of packets that can be stored in the shaping queue.shaping Q中最大的包的數量，默認1000Class-Based Shaping Frame Relay Adaptationshape adaptive min-rateRouter(config-pmap-c)#Adapts the shaping rate when BECN bits are receivedEach BECN bit causes the shaping rate to be reduced to three-quarters of the previous rate but not below the min-rateThis command has effect only if used on Frame Relay interfacesshape fecn-ad