Community discussions

MUM Europe 2020
 
tprice42
just joined
Topic Author
Posts: 11
Joined: Thu Nov 22, 2007 4:25 am

MPLS/VPLS and rate limiting

Tue Jul 08, 2008 2:02 am

I have a problem which i hope someone can help me with.

My Scenario is very simple, One VPLS circuit setup from point A to B using RB133 and x86 PC both running V3.10.
The circuit is working fine with customer traffic but i am unable to rate limit the circuit.

I have tried setting up connection / packet marking on the interfaces in the bridge but the firewall rules see no traffic.

I have tried turning on the 'Use IP Firewall' setting in the bridge settings and then the firewall sees some traffic but not all because the customer is using vlans. So i turned on 'Use IP Firewall for VLAN' in the bridge settings which causes the customers traffic to stop completely.

I have tried setting up packet marking in the bridge filter and i see the bytes and packets counter increment, i even set the action to 'log' and verified that the correct packets were being marked, but then the queue doesn't see the packet marks for some reason.

Can anyone shed any light on this problem for me? It is important to note that the circuit needs to be completely transparent to the customer, as-in they should be able to put whatever protocols they like through the circuit and the queue / firewall should rate limit it without knowing what it is.

I'm assuming that it can be done as MPLS/VPLS are carrier grade technologies by definition and carriers don't often know or care what their circuits are being used for.
 
Mplsguy
MikroTik Support
MikroTik Support
Posts: 226
Joined: Fri Jun 06, 2008 5:06 pm

Re: MPLS/VPLS and rate limiting

Tue Jul 08, 2008 12:20 pm

How do you configure limiting queue? You have to use 'queue tree' if you want to limit traffic that does not pass IP firewall.
 
tprice42
just joined
Topic Author
Posts: 11
Joined: Thu Nov 22, 2007 4:25 am

Re: MPLS/VPLS and rate limiting

Tue Jul 08, 2008 4:30 pm

Can you explain more? I have tried simple queue's and queue tree and had no luck with either.
 
Mplsguy
MikroTik Support
MikroTik Support
Posts: 226
Joined: Fri Jun 06, 2008 5:06 pm

Re: MPLS/VPLS and rate limiting

Tue Jul 08, 2008 5:22 pm

Here is working example:
[admin@R1] > /interface vpls print
Flags: X - disabled, D - dynamic, R - running, B - bgp-signaled
 0  R  name="vpls1" mtu=1500 mac-address=02:35:99:D7:83:C4 arp=enabled disable-running-check=no remote-peer=9.9.9.5 vpls-id=1:1

[admin@R1] > /interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic
 #    INTERFACE                                                                                     BRIDGE                                                                                    PRIORITY PATH-COST  HORIZON
 0    ether2                                                                                        vpls-bridge                                                                               0x80     10         none
 1    vpls1                                                                                         vpls-bridge                                                                               0x80     10         none

[admin@R1] > /interface bridge filter print
Flags: X - disabled, I - invalid, D - dynamic
 0   chain=forward action=mark-packet new-packet-mark=lala in-interface=ether2

[admin@R1] > /interface bridge filter print
Flags: X - disabled, I - invalid, D - dynamic
 0   chain=forward action=mark-packet new-packet-mark=lala in-interface=ether2

[admin@R1] > /queue tree print
Flags: X - disabled, I - invalid
 0   name="queue1" parent=vpls1 packet-mark=lala limit-at=10000 queue=default priority=8 max-limit=10000 burst-limit=0 burst-threshold=0 burst-time=0s
Packets that do not pass IP firewall do not pass through 'queue simple'. Taking into account that you want to provide completely transparent circuit, you can not assume that your customer is passing only IP. Therefore you have to use 'queue tree' like in the above example.
 
tprice42
just joined
Topic Author
Posts: 11
Joined: Thu Nov 22, 2007 4:25 am

Re: MPLS/VPLS and rate limiting

Wed Jul 09, 2008 2:01 am

I have the following implemented as per your instructions and can see the packet and byte counters incrementing in the bridge filters but the queue statistics show no traffic, is this likely to be a bug do you think?
[admin@MikroTik] > /interface vpls print 
Flags: X - disabled, D - dynamic, R - running, B - bgp-signaled 
 0  R  name="COLLINGWOOD_AREA" mtu=1500 mac-address=02:3E:0E:F5:0B:75 arp=enabled disable-running-check=no remote-peer=172.16.30.6 vpls-id=400:0 

[admin@MikroTik] > /interface bridge port print 
Flags: X - disabled, I - inactive, D - dynamic 
 #    INTERFACE                                                      BRIDGE                                                     PRIORITY PATH-COST  HORIZON   
 0    COLLINGWOOD_AREA                                               THELOOP_BRIDGE                                             0x80     10         none      
 1    The_Loop_Interface                                             THELOOP_BRIDGE                                             0x80     10         none      

[admin@MikroTik] > /interface bridge filter print 
Flags: X - disabled, I - invalid, D - dynamic 
 0   chain=forward action=mark-packet new-packet-mark=mark_in in-interface=COLLINGWOOD_AREA 

 1   chain=forward action=mark-packet new-packet-mark=mark_out in-interface=The_Loop_Interface 

[admin@MikroTik] > /interface bridge filter print 
Flags: X - disabled, I - invalid, D - dynamic 
 0   chain=forward action=mark-packet new-packet-mark=mark_in in-interface=COLLINGWOOD_AREA 

 1   chain=forward action=mark-packet new-packet-mark=mark_out in-interface=The_Loop_Interface 
 
Mplsguy
MikroTik Support
MikroTik Support
Posts: 226
Joined: Fri Jun 06, 2008 5:06 pm

Re: MPLS/VPLS and rate limiting

Wed Jul 09, 2008 10:34 am

The most important is how your queue config looks (post '/queue tree print').
 
tprice42
just joined
Topic Author
Posts: 11
Joined: Thu Nov 22, 2007 4:25 am

Re: MPLS/VPLS and rate limiting

Wed Jul 09, 2008 10:48 am

Oops sorry
[admin@MikroTik] > /queue tree print
Flags: X - disabled, I - invalid 
 0   name="queue1" parent=The_Loop_Interface packet-mark=mark_in limit-at=2000000 queue=default priority=8 max-limit=2000000 burst-limit=0 burst-threshold=0 
     burst-time=0s 

 1   name="queue2" parent=COLLINGWOOD_AREA packet-mark=mark_out limit-at=2000000 queue=default priority=8 max-limit=2000000 burst-limit=0 burst-threshold=0 
     burst-time=0s 
 
Mplsguy
MikroTik Support
MikroTik Support
Posts: 226
Joined: Fri Jun 06, 2008 5:06 pm

Re: MPLS/VPLS and rate limiting

Wed Jul 09, 2008 11:26 am

Config looks correct, I suppose you should confirm that you still have this problem with latest version and then cotact support with supout file.
 
User avatar
richinuk
Member Candidate
Member Candidate
Posts: 142
Joined: Tue Jan 22, 2008 9:30 pm

Re: MPLS/VPLS and rate limiting

Wed Jul 09, 2008 8:35 pm

Hi Mplsguy,

I'm also interested in this exact setup, so thanks for posting the config.

Tprice, I just tried this out on a network of 5 vmware based MT 3.10 machines and worked straight up. Maybe you have something missing in your config?

Rich

Who is online

Users browsing this forum: No registered users and 71 guests