Skip to main content

Traffic Policing and Shaping Configuration


Traffic Policing and Shaping Configuration

Both the Traffic policing and Class-based traffic shaping features are implemented using the MQC. The MQC is used to classify traffic by defining a traffic class, set traffic policy by defining a traffic policy (where policing and shaping is implemented) and is assigned to a specific interface.
Setting Up Traffic Classification

The first step involves traffic classification setup; traffic that is matched to a specific class can have a number of different actions taken against it. For the purposes of this article, the action to be taken will be to police or shape the matched traffic. 

Setting Up a Traffic Policy

The second step involves traffic policy setup; the traffic policy is where specific actions can be configured. As stated before, in the context of this article, this is where the traffic policing and shaping are configured.
Setting Up Assignment of the Configured Traffic Policy onto a Specific Interface

The third step involves assigning the configured traffic policy onto a specific interface. In the context of this article, the interface that is assigned will implement the traffic policing or shaping feature configuration.
Traffic Policing Configuration

The Traffic policing feature uses the police command to implement a specific policing policy. The command is used within the configuration of a traffic policy as stated earlier. The following commands are used to create a traffic policy and implement the Traffic policing feature:

router#configure terminal

router(config)#policy-map policy-map-name

router(config-pmap)#class {class-name | class-default}

router(config-pmap-c)#police bps [burst-normal] [burst-max] conform-action action exceed-action action [violate-action action]

The bps parameter configures the allowed traffic rate and is specified in bits per second; if the traffic is within this allowed traffic rate, then the conform action is taken, if not the exceed action is taken. The Traffic policing feature enables the use of a single or dual token bucket implementation. When implementing a dual token bucket implementation, the violate action is specified. The violate action is taken when traffic violates not only the traffic rate and the normal burst, but also violates the configured maximum burst. There are a number of different actions that can be configured, the most common ones include transmit and drop.
Traffic Shaping Configuration

The Class-based traffic shaping feature uses the shape command to implement a specific shaping policy. While it is possible to use other queuing mechanisms, by default the weighted fair queuing (WFQ) mechanism is used. As stated before, the main difference between traffic policing and shaping is that when shaping, non-conforming traffic is placed into a queue and is allowed to be transmitted based on the status of that queue.

As with traffic policing above, class-based traffic shaping is implemented using MQC and is implemented using a traffic policy in the same way. The following commands are used to create a traffic policy and implement class-based traffic shaping:

router#configure terminal

router(config)#policy-map policy-map-name

router(config-pmap)#class {class-name | class-default}

router(config-pmap-c)#shape {average | peak} mean-rate [burst-size] [excess-burst-size]

There are two different mechanisms that can be used by the class-based traffic feature that affect how traffic is transmitted: average rate shaping and peak rate shaping; these will be explained shortly. The mean-rate parameter configures the allowed traffic rate and is specified in bits per second. The burst-size parameter is used to configure the optional committed burst size and is specified in bits. The excess-burst-size parameter is used to configure the optional excess burst size and is specified in bits.

To explain the different shaping mechanisms, using average rate shaping, traffic is transmitted based on the configured mean-rate and is limited to this rate on average. Peak rate shaping allows traffic to be passed at a higher rate based on the following calculation:

peak rate = mean rate(1 + Be (excess-burst) / Bc (burst)

While peak rate allows higher burst and rate capability, it also has a higher likelihood of being dropped by other elements in the network which are not expecting this traffic rate.

Popular posts from this blog

Fixing Tanzu Kubernetes Pod to External Services Connectivity Issues with NSX-T

Fixing Tanzu Kubernetes Pod to External Services Connectivity Issues with NSX-T Last month I got a call from a customer who was pulling their hair out over a networking issue. They had just deployed VMware Tanzu Kubernetes Grid on their vSphere with Tanzu environment, everything looked good in the dashboards, all pods were running, but their applications inside the pods could not reach external databases running on traditional VMs in the same datacenter. The frustrating part was that some pods could reach external services perfectly fine, while others would just timeout. There was no clear pattern. Let me tell you how we figured this out and fixed it. The Initial Problem Here is what the customer setup looked like: vSphere 8.0 with Tanzu enabled NSX-T 4.1.2 for networking Three Tanzu Kubernetes clusters running different microservices applications External PostgreSQL database running on traditional VMs (non-Kubernetes) External API services running on another se...

Troubleshooting vSAN Storage Policy Migration Failures in VMware Cloud Foundation 9.0

Recently I had a customer who migrated their VMware infrastructure from vSphere 7.0 to VMware Cloud Foundation 9.0. After the migration, they wanted to update their vSAN storage policies to take advantage of the new vSAN ESA (Express Storage Architecture) features. However, when they tried to change the storage policy for their production VMs, the operation kept failing with a cryptic error message. The error they were getting was: "Cannot complete operation due to insufficient resources to satisfy current storage policy." This was strange because they had plenty of disk space available. The vSAN cluster was only at 45% capacity, and all the hosts were healthy. Let me walk through how we troubleshooted and fixed this issue. Understanding the Problem First, let's understand what was happening in their environment: They had a 6-node vSAN cluster running VCF 9.0 vSAN was configured with the new ESA architecture They were trying to migrate VMs fro...

Unlocking VMware Cloud Foundation 9.0: A Strategic Blueprint for Enterprise Transformation

The evolution of VMware under Broadcom represents not disruption, but clarification—a focused vision toward unified private cloud excellence. As organizations navigate this transformation, the opportunity has never been greater to build truly modern, efficient, and powerful infrastructure with VMware Cloud Foundation. After architecting VMware solutions across diverse enterprise environments, I've observed a pattern: organizations that embrace VMware Cloud Foundation (VCF) strategically—rather than viewing the transition as a burden—emerge with significantly more capable, cost-effective, and future-ready infrastructure. This post shares a practical framework for successfully modernizing your VMware environment, maximizing your investment, and positioning your organization for the AI-driven, cloud-native future. Understanding the VMware Cloud Foundation Vision Let's start with clarity about what Broadcom and VMware are building: VMware Cloud Foundati...