Cisco – Enabling MLS QoS on a production 7600

ciscocisco-7600policingqos

I am looking at a 7609-S with a RSP720-3CXL running 12.2(33)SRE3.

I have been asked to help with rate limiting some servers attached to a couple of ports running as L2 ports (switchport mode access), so this requires me to apply a policy-map to the L3 SVI that is the default gateway in this VLAN. When enabling the service policy under the SVI interface configuration I received the following error;

router(config-if)#service-policy input PM-LIMIT-100M
Warning (QoS): MLS QoS is disabled, marking/policing will be done after 
enabling MLS QoS globally

I have a looked through the config and sure enough, there is no "mls qos" in the global configuration. What potential issues can happen from enabling this global config command on this production device? I can obviously perform this during scheduled maintenance period for safety, but should it even be attempted at all?

If it makes any difference, there were no class maps or policy maps defined on this router until I logged in, to make one to rate limit the previously mentioned server ports (all ports are Gig, I have been tasked with limiting this SVI to 100Mps for a short period). I trying to use the following configuration;

class-map match-any CM-LIMIT-100M
  match access-group name ACL-SERVERS
!
policy-map PM-LIMIT-100M
  class CM-LIMIT-100M
    police 100000000 18750000 31250000 conform-action transmit exceed-action drop violate-action drop
!
int vlan 123
service-policy input PM-LIMIT-100M
service-policy output PM-LIMIT-100M

I would like to think there is no potential issues that will occur if I enable this, but you never know so I'm all ears!

Best Answer

You definitely should enable MLS QoS. It is also prerequisite for CoPP, which you should add in your TODO list to implement.

Enabling 'mls qos' without other config is extremely bad idea in low-end cats, like 3560/3750, due to unexpected default scheduling and due to heavily reduced buffers causing more microbursting.

On 7600/6500 it's comparatively safe to enable, but of course you can crash your router with 'show run'. I would feel comfortable enough to enable it during production hours.

You should monitor 'show queueing interface X' after enabling to see that you're not dropping anything. Long term, you should design QoS policy and implement it, I recommend using as few queues as possible (and assign 100% of buffer to those few queues). Example of possible QoS policy in WS-X6704-10GE:

interface TenGigabitEthernet4/1
 wrr-queue bandwidth percent 30 40 30 0 0 0 0  ## allocate 3 queues (+implied strictpriority) share buffer 30% 40% 30% on thos three queues
 wrr-queue cos-map 1 1 0 7 # map cos values to queues
 wrr-queue cos-map 2 2 3 
 wrr-queue cos-map 3 1 4 
 wrr-queue cos-map 3 2 6

For advanced config, you may want to supplement that with 'wrr-queue random-detect' with RED curve per queue+threshold. Be sure to mark your traffic correctly when it enters your network.

Related Topic