Hi,
We have the following policy-map setup on 2960's and 3750's for
customer facing ports:
class-map match-any LAN_MANAGEMENT
match access-group name LAN_MANAGEMENT
class-map match-any SERVER_MANAGEMENT
match access-group name SERVER_MANAGEMENT
policy-map ACCESS_PORT
class LAN_MANAGEMENT
set ip dscp af31
class SERVER_MANAGEMENT
set ip dscp af31
class class-default
set ip dscp default
police 10000000 16000 exceed-action policed-dscp-transmit
ip access-list extended LAN_MANAGEMENT
remark telnet traffic
permit tcp any any eq telnet
permit tcp any eq telnet any
remark ssh traffic
permit tcp any any eq 22
permit tcp any eq 22 any
remark snmp traffic
permit udp any any eq snmp
permit udp any eq snmp any
permit udp any any eq snmptrap
permit udp any eq snmptrap any
ip access-list extended SERVER_MANAGEMENT
remark RDP traffic
permit tcp any any eq 3389
permit tcp any eq 3389 any
interface FastEthernet0/1
switchport access vlan 191
switchport mode access
switchport port-security maximum 10
switchport port-security
switchport port-security aging time 10
storm-control broadcast level 20.00
storm-control action trap
spanning-tree portfast
spanning-tree guard root
service-policy input ACCESS_PORT
We see the policer is working(Formatting will prob. be terrible - Apologies!):
#show mls qos interface fastEthernet 0/1 statistics FastEthernet0/1
(All statistics are in packets)
dscp: incoming -------------------------------
0 - 4 : 477175 0 0 0
0 5 - 9 : 0 0 0 0
0 10 - 14 : 0 0 0 0
0 15 - 19 : 0 0 0
0 0 20 - 24 : 0 0 0
0 0 25 - 29 : 0 0 0
0 0 30 - 34 : 0 0 0
0 0 35 - 39 : 0 0
0 0 0 40 - 44 : 0 0
0 0 0 45 - 49 : 0 0
0 0 0 50 - 54 : 0
0 0 0 0 55 - 59 : 0
0 0 0 0 60 - 64 : 0
0 0 0 dscp: outgoing
-------------------------------
0 - 4 : 932319 0 0 0
0 5 - 9 : 0 0 0 0
0 10 - 14 : 0 0 0 0
0 15 - 19 : 0 0 0
0 0 20 - 24 : 0 0 0
0 0 25 - 29 : 0 0 0
0 0 30 - 34 : 0 0 0
0 0 35 - 39 : 0 0
0 0 0 40 - 44 : 0 0
0 0 0 45 - 49 : 0 0
0 0 0 50 - 54 : 0
0 0 0 0 55 - 59 : 0
0 0 0 0 60 - 64 : 0
0 0 0 cos: incoming
-------------------------------
0 - 4 : 477191 0 0 0
0 5 - 7 : 0 0 0 cos: outgoing
-------------------------------
0 - 4 : 932333 0 0 0
0 5 - 7 : 0 0 0 Policer:
Inprofile: 29413 OutofProfile: 19101
But, when performing RDP/SSH etc to/from server connected to port,
ACL's show no hits?
#sh access-lists Extended IP access list LAN_MANAGEMENT
10 permit tcp any any eq telnet
20 permit tcp any eq telnet any
30 permit tcp any any eq 22
40 permit tcp any eq 22 any
50 permit udp any any eq snmp
60 permit udp any eq snmp any
70 permit udp any any eq snmptrap
80 permit udp any eq snmptrap any
Extended IP access list SERVER_MANAGEMENT
10 permit tcp any any eq 3389
20 permit tcp any eq 3389 any
Is this to be expected?
-------------------------------------------------------------------------
This e-mail was sent via Data FX Online WebMail http://www.datafx.com.au/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
