3550 switch + rate-limiting. Help!

Ok, I have a 3550. Its running EMI code: c3550-i5q3l2-mz.121-8.EA1c.bin

I'm trying to apply some kind of rate-limit for one of my customers to stop
them killing our bandwidth. The switch is operating purely as a Layer 2
device, so no routing or anything clever.

So far, from poking around in various places, I have come up with the
following:

!
mls qos
!
class-map match-any any
match any
!
!
policy-map 64kbps
class any
police 64000 64000 exceed-action drop
!
........
interface FastEthernet0/24
switchport access vlan 5
switchport mode access
no ip address
duplex full
speed 100
service-policy input 64kbps
service-policy output 64kbps
no cdp enable
....

But...it doesn't do anything!

'show mls qos int fa0/24 stat' gives the following:
FastEthernet0/24
Ingress
dscp: incoming no_change classified policed dropped (in bytes)
Others: 900750579 841373 899909206 0 0
Egress
dscp: incoming no_change classified policed dropped (in bytes)
Others: 1110768778 n/a n/a 0 0

Which is nice, except 'dropped' shouldn't be zero, I would have thought!

I can still transfer data at full speed in both directions.

Any assistance gratefully recieved!

Cheers,
Mat

 

["Mat Sharpe"]

| I'm trying to apply some kind of rate-limit for one of my customers to stop
| them killing our bandwidth. The switch is operating purely as a Layer 2
| device, so no routing or anything clever.
|
| So far, from poking around in various places, I have come up with the
| following:
|
| !
| mls qos
| !
| class-map match-any any
| match any

I've never gotten "match any" to work properly here. Try

access-list 100 permit ip any any
class-map match-any any
match access-group 100

In most cases you can also get the same effect with

class-map match-any any
match ip dscp 0

Steinar Haug, Nethelp consulting,