Administrator Guide

Access Control Lists 741
Expedite DSCP(EF) Traffic/Limit Background Traffic
By default (with no CoS or DSCP configuration), packets are assigned to User
Priority 1/CoS queue 0 (see the output from show classofservice trust and
show classofservice dot1p-mapping). When incast occurs (multiple ports
sending to a single output port at a rate greater than can be accommodated),
the switch buffer capacity can be exhausted. When the buffer capacity is
exhausted, the switch is unable to perform QoS properly as the decision on
whether to expedite a packet is overridden by the availability of a buffer to
receive the packet. If no buffer is available, the packet is dropped on ingress.
The following configuration sets the switch to expedite DSCP EF traffic and
limits buffering of background traffic in CoS queue 0.
This configuration sets the switch to trust DSCP on ingress, maps DSCP EF
to CoS queue 3, and enables WRED on CoS queue 0. Then, green TCP
traffic is set to begin random discard at 75% port capacity with a 5% drop
probability. Non-TCP traffic is set to tail drop at 100% of port buffer capacity.
The other WRED queue parameters (yellow and red traffic) are kept at their
default values.
console#config
console(config)#classofservice trust ip-dscp
console(config)#classofservice ip-dscp-mapping 46 3
console(config)#cos-queue random-detect 0
console(config)#cos-queue strict 3
console(config)#random-detect queue-parms 0 min-thresh 75 30 20 100
max-thresh 100 90 80 100 drop-prob-scale 5 10 10 100
Configure a VLAN ACL
This example configures a MAC ACL to rate-limit matching traffic. The ACL
is configured on the VLAN interface, and multiple ports are made members
of the VLAN. As the ACL is the only ACL on the interfaces, a permit any any
clause is included to allow other traffic to be permitted. Subsequent ACL will
never be matched due to this clause.
1 Create VLAN 100:
console(config)#vlan 100
console(config-vlan100)#exit
2 Declare a MAC access list with the matching criteria:
console(config)#mac access-list extended vlan100