This lab lesson will examine another common use case for localized data policies: to create a traffic policer that controls the maximum rate of traffic sent or received on a specific vEdge interface.

Cisco SD-WAN Traffic Policer
Figure 1. Cisco SD-WAN Traffic Policer

The Initial State

First, let’s verify that our network can transfer 10 Mbps UDP traffic between vEdge-1 and vEdge-4 using the MPLS transport cloud. To do this, we will use the embedded iperf tool installed on every WAN edge router by default. 

Before using the iperf tool, we will need to allow all network services in the implicit ACL on the MPLS interfaces on both vEdge-1 and vEdge-4. Otherwise, the implicit ACL will drop the iperf generated traffic.

vEdge-1# conf t -->> we need to configure this on both vEdge-1 and vEdge-4
Entering configuration mode terminal
vEdge-1(config)# vpn 0 int ge0/1
vEdge-1(config-interface-ge0/1)# tunnel-interface 
vEdge-1(config-tunnel-interface)# allow-service all
vEdge-1(config-tunnel-interface)# commit and-quit

Once we have allowed all network services, we can start an iperf server on vEdge-1 using the tools iperf command as shown in the output below:

vEdge-1# tools iperf vpn 0 options "-s -u -i 1"
iperf -s -u -i 1 in VPN 0
------------------------------------------------------------
Server listening on UDP port 5001

Now we can send a 10Mbps UDP stream from vEdge-4 over the MPLS transport to vEdge-1’s ge0/1 interface.

vEdge-4# tools iperf vpn 0 options "-c 10.10.0.1 -u -b 10m -t 60"
iperf -c 10.10.0.1 -u -b 10m -t 60 in VPN 0
------------------------------------------------------------
Client connecting to 10.10.0.1, UDP port 5001
Sending 1470 byte datagrams, IPG target: 1176.00 us (kalman adjust)
UDP buffer size: 2.50 MByte (default)
------------------------------------------------------------
(  4) local 10.10.0.4 port 39353 connected with 10.10.0.1 port 5001
( ID) Interval       Transfer     Bandwidth
(  4)  0.0-60.0 sec  71.5 MBytes  10.0 Mbits/sec
(  4) Sent 51021 datagrams
(  4) Server Report:
(  4)  0.0-60.0 sec  71.3 MBytes  9.97 Mbits/sec   2.188 ms  178/51021 (0.35%)

We can see that we can successfully transfer 10Mbps UDP traffic from vEdge-4 to vEdge-1 over the MPLS cloud. Now let’s configure a local data policy that polices the traffic to 2Mbps in the direction from vEdge-4 to vEdge-1.

Configuring local traffic policer attached on an interface

In Cisco SD-WAN, we configure traffic policer using the policy policer command using the CLI directly on a vEdge or using a vManage device template. Under the policer, we specify the desired values for bandwidth, burst, and exceed action. 

vEdge(config)# policy 
vEdge(config-policy)# policer {policer-name}    
vEdge(config-policer)# rate {bandwidth}    
vEdge(config-policer)# burst {bytes}    
vEdge(config-policer)# exceed {action}

In our lab example, we will configure on vEdge-4 a policer named POLICER-2MBPS that specifies a maximum data rate of 2Mbps, a burst value of 40 kbytes, and exceed action drop.

policy
 policer POLICER-2MBPS
  rate   2000000
  burst  40000
  exceed drop
 !

We apply the policer directly on the mpls interface of vEdge-4 in outbound direction as shown below:

vEdge-4#  conf t
Entering configuration mode terminal
vEdge-4(config)# vpn 0 interface ge0/1
vEdge-4(config-interface-ge0/1)# policer POLICER-2MBPS out
vEdge-4(config-interface-ge0/1)# commit and-quit

If we rerun the iperf test, we can see that the available bandwidth between is 1.96Mbps.

vEdge-4# tools iperf vpn 0 options "-c 10.10.0.1 -u -b 10m -t 60"
iperf -c 10.10.0.1 -u -b 10m -t 60 in VPN 0
------------------------------------------------------------
Client connecting to 10.10.0.1, UDP port 5001
Sending 1470 byte datagrams, IPG target: 1176.00 us (kalman adjust)
UDP buffer size: 2.50 MByte (default)
------------------------------------------------------------
(  4) local 10.10.0.4 port 34345 connected with 10.10.0.1 port 5001
( ID) Interval       Transfer     Bandwidth
(  4)  0.0-60.0 sec  71.5 MBytes  10.0 Mbits/sec
(  4) Sent 51021 datagrams
(  4) Server Report:
(  4)  0.0-60.2 sec  14.1 MBytes  1.96 Mbits/sec  20.408 ms 40972/51022 (80%)

Configuring local traffic policer attached to specific traffic

In a real-world deployment, we are more likely to police specific data traffic than an entire interface. In such cases, we match the interesting traffic in an ACL sequence and then invoke the configured local traffic policer as shown in the output below:

Full Content Access is for Registered Users Only (it's FREE)...

  • Learn any CCNA, DevNet or Network Automation topic with animated explanation.
  • We focus on simplicity. Networking tutorials and examples written in simple, understandable language for beginners.
Sign up for free ►