I used John's exact setup.
I added policer to loop5 and lan0
configure policer name policy2 type 1r2c cir 500 cb 5000 rate kbps
conform-action transmit exceed-action drop
classify table mask l3 ip4 src
classify session policer-hit-next policy2 table-index 0 match l3 ip4
src 10.8.200.2
set policer classify interface loop5 ip4-table 0
set policer classify interface lan0 ip4-table 20
sh int loop5 features
loop5
ip4-unicast:
nat44-in2out
ip4-policer-classify
sh int lan0 features
lan0
ip4-unicast:
ip4-not-enabled
ip4-policer-classify
"sh classify tables verbose" shows table has been added.
"show classify policer type ip4" shows table has been added to loop5 and lan0.
As you can see below it's
ethernet-input
l2-input
l2-learn
l2-fwd
ip4-input
nat44-in2out
ip4-lookup
ip4-policer-classify is not present after nat44-in2out.
Packet 1
1:23:06:454709: dpdk-input
lan0 rx queue 0
buffer 0xb3cf: current data 0, length 60, free-list 0, clone-count
0, totlen-nifb 0, trace 0x2
ext-hdr-valid
l4-cksum-computed l4-cksum-correct
PKT MBUF: port 3, nb_segs 1, pkt_len 60
buf_len 2176, data_len 60, ol_flags 0x180, data_off 128, phys_addr
0xe96cf440
packet_type 0x111 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0
rss 0x0 fdir.hi 0x0 fdir.lo 0x0
Packet Offload Flags
PKT_RX_IP_CKSUM_GOOD (0x0080) IP cksum of RX pkt. is valid
PKT_RX_L4_CKSUM_GOOD (0x0100) L4 cksum of RX pkt. is valid
Packet Types
RTE_PTYPE_L2_ETHER (0x0001) Ethernet packet
RTE_PTYPE_L3_IPV4 (0x0010) IPv4 packet without extension headers
RTE_PTYPE_L4_TCP (0x0100) TCP packet
IP4: ac:2e:33:1f:cc:3e -> ee:af:33:00:00:11
TCP: 10.155.6.109 -> 10.8.200.1
tos 0x00, ttl 128, length 40, checksum 0x3811
fragment id 0xdfad, flags DONT_FRAGMENT
TCP: 49727 -> 5201
seq. 0x34aa7da4 ack 0x4578b6ae
flags 0x10 ACK, tcp header: 20 bytes
window 53248, checksum 0x77bc
01:23:06:454710: ethernet-input
frame: flags 0x3, hw-if-index 4, sw-if-index 4
IP4: ac:2e:33:1f:cc:3e -> ee:af:33:00:00:11
01:23:06:454711: l2-input
l2-input: sw_if_index 4 dst ee:af:33:00:00:11 src ac:2e:33:1f:cc:3e
01:23:06:454712: l2-learn
l2-learn: sw_if_index 4 dst ee:af:33:00:00:11 src ac:2e:33:1f:cc:3e bd_index 1
01:23:06:454712: l2-fwd
l2-fwd: sw_if_index 4 dst ee:af:33:00:00:11 src ac:2e:33:1f:cc:3e
bd_index 1 result [0x700000007, 7] static age-not bvi
01:23:06:454713: ip4-input
TCP: 10.155.6.109 -> 10.8.200.1
tos 0x00, ttl 128, length 40, checksum 0x3811
fragment id 0xdfad, flags DONT_FRAGMENT
TCP: 49727 -> 5201
seq. 0x34aa7da4 ack 0x4578b6ae
flags 0x10 ACK, tcp header: 20 bytes
window 53248, checksum 0x77bc
01:23:06:454713: nat44-in2out
NAT44_IN2OUT_FAST_PATH: sw_if_index 7, next index 0, session 22
01:23:06:454714: ip4-lookup
fib 0 dpo-idx 1 flow hash: 0x00000000
TCP: 10.8.200.2 -> 10.8.200.1
tos 0x00, ttl 128, length 40, checksum 0x770e
fragment id 0xdfad, flags DONT_FRAGMENT
TCP: 26849 -> 5201
seq. 0x34aa7da4 ack 0x4578b6ae
flags 0x10 ACK, tcp header: 20 bytes
window 53248, checksum 0x1018
01:23:06:454715: ip4-rewrite
tx_sw_if_index 6 dpo-idx 1 : ipv4 via 10.8.200.1 wan0: mtu:9000
a0369f9be2e2083571eb70550800 flow hash: 0x00000000
00000000: a0369f9be2e2083571eb7055080045000028dfad40007f06780e0a08c8020a08
00000020: c80168e1145134aa7da44578b6ae5010d00010180000000000000000
01:23:06:454716: wan0-output
wan0
IP4: a2:12:53:ac:bf:3b -> 2b:dd:3e:22:ae:2e
TCP: 10.8.200.2 -> 10.8.200.1
tos 0x00, ttl 127, length 40, checksum 0x780e
fragment id 0xdfad, flags DONT_FRAGMENT
TCP: 26849 -> 5201
seq. 0x34aa7da4 ack 0x4578b6ae
flags 0x10 ACK, tcp header: 20 bytes
window 53248, checksum 0x1018
01:23:06:454716: wan0-tx
wan0 tx queue 1
buffer 0xb3cf: current data 0, length 60, free-list 0, clone-count
0, totlen-nifb 0, trace 0x2
ext-hdr-valid
l4-cksum-computed l4-cksum-correct natted
l2-hdr-offset 0 l3-hdr-offset 14
PKT MBUF: port 3, nb_segs 1, pkt_len 60
buf_len 2176, data_len 60, ol_flags 0x180, data_off 128, phys_addr
0xe96cf440
packet_type 0x111 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0
rss 0x0 fdir.hi 0x0 fdir.lo 0x0
Packet Offload Flags
PKT_RX_IP_CKSUM_GOOD (0x0080) IP cksum of RX pkt. is valid
PKT_RX_L4_CKSUM_GOOD (0x0100) L4 cksum of RX pkt. is valid
Packet Types
RTE_PTYPE_L2_ETHER (0x0001) Ethernet packet
RTE_PTYPE_L3_IPV4 (0x0010) IPv4 packet without extension headers
RTE_PTYPE_L4_TCP (0x0100) TCP packet
IP4: a2:12:53:ac:bf:3b -> 2b:dd:3e:22:ae:2e
TCP: 10.8.200.2 -> 10.8.200.1
tos 0x00, ttl 127, length 40, checksum 0x780e
fragment id 0xdfad, flags DONT_FRAGMENT
TCP: 26849 -> 5201
seq. 0x34aa7da4 ack 0x4578b6ae
flags 0x10 ACK, tcp header: 20 bytes
window 53248, checksum 0x1018
Cheers
On Thu, Apr 18, 2019 at 9:12 PM carlito nueno via Lists.Fd.Io
<[email protected]> wrote:
>
> John,
>
> from your packet trace:
>
> 00:01:47:426336: ip4-input-no-checksum
> TCP: 10.8.200.1 -> 10.8.200.2
> tos 0x00, ttl 64, length 52, checksum 0x96b0
> fragment id 0x0000, flags DONT_FRAGMENT
> TCP: 80 -> 18995
> seq. 0x732f1a24 ack 0x702b5a27
> flags 0x12 SYN ACK, tcp header: 32 bytes
> window 29200, checksum 0xb6b3
> 00:01:47:426337: nat44-out2in
> NAT44_OUT2IN: sw_if_index 6, next index 1, session index 1
>
> You can't use src 10.8.200.2 because packets entering wan0 are out to
> in, hence nat44_out2in, will have src of 10.8.200.1.
> Packets before nat44_out2in will have dst of 10.8.200.2.
> Hence your policer session will not work.
>
> from your packet trace:
>
> 00:01:47:426338: loop5-output
> loop5
> IP4: de:ad:00:00:00:05 -> c0:56:27:90:3f:fc
> TCP: 10.8.200.1 -> 10.155.6.109
> tos 0x00, ttl 63, length 52, checksum 0x58b3
> fragment id 0x0000, flags DONT_FRAGMENT
> TCP: 80 -> 50051
>
> Again, l2 src 08:25:a1:cb:40:55 won't work because packets after NAT
> are leaving out of loop5 with src de:ad:00:00:00:05.
>
> My hunch is this might work:
> classify session policer-hit-next policy1 table-index 1 match l2 src
> de:ad:00:00:00:05
> set policer classify interface loop5 l2-table 1
>
> Hope this helps.
>
> On Tue, Apr 16, 2019 at 8:28 PM John Pearson <[email protected]> wrote:
> >
> > Hi all,
> >
> > I am using NAT44 and am trying to limit upload and download bandwidth
> > separately on wan0.
> >
> > setup:
> > file server <--> [wan0] VPP [loop5] <--> client
> >
> > Info:
> > file server
> > ip address: 10.8.200.1
> > mac: a0:36:9f:9b:e2:e2
> >
> > wan0
> > ip addr: 10.8.200.2
> > gateway: 10.8.200.1
> > mac: 08:25:a1:cb:40:55
> >
> > loop5
> > ip addr: 10.155.6.1
> > mac: de:ad:00:00:00:05
> >
> > client
> > ip addr: 10.155.6.109
> > mac: c0:56:27:90:3f:fc
> >
> > vpp.conf
> >
> > set int state wan0 up
> > set int ip address wan0 10.8.200.2/24
> > ip route add 0.0.0.0/0 via 10.8.200.1
> >
> > set int state lan0 up
> >
> > create loopback interface instance 5
> > set int l2 bridge loop5 5 bvi
> > set int ip address loop5 10.155.6.1/24
> > set int state loop5 up
> > set int l2 bridge lan0 5
> >
> > nat44 add interface address wan0
> > set interface nat44 in loop5 out wan0
> >
> > Packet trace of 2 packets: https://pastebin.com/PZLMpG1i
> >
> > What I tried:
> >
> > configure policer name policy1 type 1r2c cir 500 cb 5000 rate kbps
> > conform-action transmit exceed-action drop
> > classify table mask l3 ip4 src
> > classify session policer-hit-next policy1 table-index 0 match l3 ip4 src
> > 10.8.200.2
> > set policer classify interface wan0 ip4-table 0
> >
> > -------------
> >
> > configure policer name policy1 type 1r2c cir 500 cb 5000 rate kbps
> > conform-action transmit exceed-action drop
> > classify table mask l2 src
> > classify session policer-hit-next policy1 table-index 1 match l2 src
> > 08:25:a1:cb:40:55
> > set policer classify interface wan0 l2-table 0
> >
> > Please let me know where I am making a mistake.
> >
> > Thanks!
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> >
> > View/Reply Online (#12802): https://lists.fd.io/g/vpp-dev/message/12802
> > Mute This Topic: https://lists.fd.io/mt/31208381/675621
> > Group Owner: [email protected]
> > Unsubscribe: https://lists.fd.io/g/vpp-dev/unsub [[email protected]]
> > -=-=-=-=-=-=-=-=-=-=-=-
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
>
> View/Reply Online (#12820): https://lists.fd.io/g/vpp-dev/message/12820
> Mute This Topic: https://lists.fd.io/mt/31208381/675621
> Group Owner: [email protected]
> Unsubscribe: https://lists.fd.io/g/vpp-dev/unsub [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#12821): https://lists.fd.io/g/vpp-dev/message/12821
Mute This Topic: https://lists.fd.io/mt/31208381/21656
Group Owner: [email protected]
Unsubscribe: https://lists.fd.io/g/vpp-dev/unsub [[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
