Alert : SE_LICENSED_BANDWIDTH_EXCEEDED for SE with BANDWIDTH based license (Avi Load Balancer)

Products

• VMware Avi Load Balancer

Issue/Introduction

• SE_LICENSED_BANDWIDTH_EXCEEDED
• A "licensed bandwidth exceeded" error means that you have exceeded the bandwidth limit for your service engine

Environment

Avi Load Balancer with Service Engine Bandwidth Based License
https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-installation-guide/installing-nsx-alb-in-microsoft-azure/deployment-considerations/licensing-options.html

Bandwidth-limited Service Engine

• Available in 25-Mbps, 200-Mbps and 1-Gbps options
• 25-Mbps and 200-Mbps options are applicable in any environment
• 1-Gbps option applicable for public cloud only

 

Cause

1. First check the SE Analytics - Navigate to Infrastructure >> Service Engine >>Search for the SE in question and click on Analytics >> You can filter for Bandwidth_exceeded messages
2. Next check the BW Exceeded messages under Avi Operations tab  - Navigate to Operations >>  All events and filter for "SE_Licensed_Bandwidth_exceeded"
   
   
   
3. Check the Licensing tab - Go to Infrastructure >> Service Engine Group >> Advanced tab and here check the license part. 
4. See whats the SE Bandwidth Type and License Type mentioned
   
   
   
   Bandwidth Based License available with 25 Mbps and 200 Mbps
   
   

 

Resolution

Below is the explanation as too why the Event is triggered;

SE_LICENSED_BANDWIDTH_EXCEEDED event is generated at most once an hour.

The way the Bandwidth limit works is as follows:

• We divide one sec into 50ms intervals

• We convert the configured BW limit into bytes per 50ms. So in the 200Mbps case, this will be:
  Bytes per sec = (200*1024*1024) / 8 = 26214400
  Bytes per 50ms period (In 1 sec(1000 ms), there are 20 50ms periods)= 26214400 / 20 = 1310720

• Every packet received is summed up. If this exceeds the max per 50ms interval, that packet is dropped.
• Every 50ms, the total bytes received on the SE is cleared. So we get a fresh 50ms interval to allow 1310720 bytes

So in any 50ms interval more than 1310720 bytes are received, that is considered BW_EXCEEDED event. If no event has been sent in the past one hour, an event is generated.

Also the graphs that we see under SE Analytics would show hourly average data. So if traffic has bursts then it would trigger events but may look normal in the charts.