Rate Limiting the Segment Traffic Using NSX QoS Profiles

Products

• VMware NSX

Issue/Introduction

This article describes expected behavior when validating VMware NSX QoS Segment Profiles using iPerf traffic testing and explains how burst size configuration may impact TCP congestion window behavior.
NSX QoS Segment Profiles also enforce traffic shaping policies using configured bandwidth and burst parameters. When testing throughput with iPerf, very small burst values may impact TCP flow efficiency and congestion window behavior while still correctly enforcing the configured rate limit. This behavior is expected and aligns with standard traffic shaping principles.

Environment

VMware NSX
VMware NSX-T

Cause

NSX QoS Segment Profiles enforce traffic shaping policies using configured bandwidth and burst parameters.
Burst size configuration affects how traffic is buffered and transmitted. Very small burst values may impact TCP flow efficiency and congestion window behavior while still correctly enforcing the configured rate limit.
This behavior is expected and aligns with standard traffic shaping principles.

Resolution

• Calculate Traffic Shaping Parameters

1. Formula:
   
   
   
   
2. Create the QoS Segment Profile
   • Log in to the NSX Manager UI.
   • Navigate to Networking > Segments > Profiles.
   • Select the Segment Profiles tab, click  Add Segment Profile, and choose QoS.
   • Define the profile parameters:
   • Name: Segment-QoS-Traffic-Shaping
   • Direction: Select Ingress, Egress, or Both depending on your traffic flow requirements.
   • Average Bandwidth: Enter the calculated value in Mbps (e.g., 500).
   • Peak Bandwidth: Enter the calculated value in Mbps (e.g., 1000).
   • Burst Size: Enter the calculated value in Bytes (e.g., 2500000).
   • Click Save.
     
     
3. Apply the Profile to an NSX Segment
   • Navigate to Networking > Segments.
   • Locate the target segment, click the three vertical dots icon next to it, and select Edit.
   • Expand the Segment Profiles drop-down section.
   • Under QoS Profile, select the newly created Segment-QoS-Traffic-Shaping profile.
   • Click Save and then select Close Editing.
     
     
4. Execute Throughput Validation via iPerf3
   
   • Run performance tests directly between two virtual machines residing on the modified segment.
   • Receiver Side (Server VM): Initialize iPerf3 in listener mode:
   • Bash
   • iperf3 -s
   • Transmitter Side (Client VM): Initialize the parallel traffic generator stream:
   • Bash
   • iperf3 -c <Iperf-server IP> -t 30 -P 4
   • (The -P 4 flag establishes 4 concurrent TCP streams to fill the token bucket efficiently and validate structural enforcement)
     
     
     
     
     

Additional Information

VMware NSX supports QoS traffic shaping using Segment Profiles and Gateway QoS policies to control bandwidth utilization and enforce traffic limits.

For configuration guidance, refer to the VMware documentation:
https://techdocs.broadcom.com/us/en/vmware-cis/nsx/nsxt-dc/3-1/administration-guide/segments/segment-profiles/understanding-qos-segment-profile/create-an-nsx-qos-segment-profile.html