Table Of Contents
First Published: October 15, 2001Last Updated: July 13, 2007
This document describes the Two-Rate Policer feature and explains how to configure the feature.
History for the Two-Rate Policer Feature
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Networks police traffic by limiting the input or output transmission rate of a class of traffic based on user-defined criteria. Policing traffic allows you to control the maximum rate of traffic sent or received on an interface and to partition a network into multiple priority levels or class of service (CoS).
The Two-Rate Policer performs the following functions:
•Limits the input or output transmission rate of a class of traffic based on user-defined criteria.
•Marks packets by setting the IP precedence value, IP differentiated services code point (DSCP) value, Multiprotocol Label Switching (MPLS) experimental value, Quality of Service (QoS) group, ATM Cell Loss Priority (CLP) bit, and the Frame Relay Discard Eligibility (DE) bit.
With the Two-Rate Policer, you can enforce traffic policing according to two separate rates—committed information rate (CIR) and peak information rate (PIR). You can specify the use of these two rates, along with their corresponding values, by using two keywords, cir and pir, of the police command.
The Two-Rate Policer manages the maximum rate of traffic through a token bucket algorithm. The token bucket algorithm can use the user-configured values to determine the maximum rate of traffic allowed on an interface at a given moment in time. The token bucket algorithm is affected by all traffic entering or leaving the interface (depending on the location of the interface on which the Two-Rate Policer is configured) and is useful in managing network bandwidth in cases where several large packets are sent in the same traffic stream.
The token bucket algorithm provides users with three actions for each packet: a conform action, an exceed action, and an optional violate action. Traffic entering the interface with Two-Rate Policer configured is placed in to one of these categories. Within these three categories, users can decide packet treatments. For instance, packets that conform can be configured to be sent, packets that exceed can be configured to be sent with a decreased priority, and packets that violate can be configured to be dropped.
The Two-Rate Policer is often configured on interfaces at the edge of a network to limit the rate of traffic entering or leaving the network. In the most common configurations, traffic that conforms is sent and traffic that exceeds is sent with a decreased priority or is dropped. Users can change these configuration options to suit their network needs.
Note Additionally, the Two-Rate Policer enables you to implement Differentiated Services (DiffServ) Assured Forwarding (AF) Per-Hop Behavior (PHB) traffic conditioning. For more information about DiffServ, refer to the "Implementing DiffServ for End-to-End Quality of Service Overview" chapter of the Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.4.
Note Starting with Cisco IOS Release 12.1(5)T, you can police traffic by using the Traffic Policing feature (sometimes referred to as the single-rate policer). The Two-Rate Policer (available with Cisco IOS Release 12.2(4)T) is in addition to the Traffic Policing feature, and it provides additional functionality. For more information about the Traffic Policing feature, refer to the "Policing and Shaping Overview" chapter of the Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.4.
Bandwidth Management Through Rate Limiting
This feature provides improved bandwidth management through rate limiting. Before this feature was available, you could police traffic with the single-rate Traffic Policing feature. The Traffic Policing feature provided a certain amount of bandwidth management by allowing you to set the peak burst size (be). The Two-Rate Policer supports a higher level of bandwidth management and supports a sustained excess rate. With the Two-Rate Policer, you can enforce traffic policing according to two separate rates—CIR and PIR—specified in bits per second (bps).
Packet Marking Through IP Precedence, DSCP Value, MPLS Experimental Value, and the QoS Group Setting
In addition to rate-limiting, the Two-Rate Policer allows you to independently mark the packet according to whether the packet conforms, exceeds, or violates a specified rate. Packet marking also allows you to partition your network into multiple priority levels or classes of service (CoS).
•Use the Two-Rate Policer to set the IP precedence value, the IP DSCP value, or the MPLS experimental value for packets that enter the network. Then networking devices within your network can use the this setting to determine how the traffic should be treated. For example, the Weighted Random Early Detection (WRED) feature uses the IP precedence value to determine the probability that a packet will be dropped.
•Use the Two-Rate Policer to assign packets to a QoS group. The router uses the QoS group to determine how to prioritize packets within the router.
If you want to mark traffic but do not want to use the Two-Rate Policer, see the Class-Based Marking feature module available with Cisco IOS Release 12.2(2)T. More information about the Class-Based Marking feature is available from the Cisco documentation website (Cisco.com) or the Cisco documentation CD.
Packet Marking for Frame Relay Frames
The Two-Rate Policer allows users to mark the Frame Relay DE bit of the Frame Relay frame. The Frame Relay DE bit is one bit and, therefore, can be set to either 0 or 1. In congested environments, frames that have the DE bit set to 1 are discarded before frames that have the DE bit set to 0.
Packet Marking for ATM Cells
The Two-Rate Policer allows users to mark the ATM CLP bit in ATM cells. The ATM CLP bit is used to prioritize packets in ATM networks. The ATM CLP bit is one bit and, therefore, can be set to either 0 or 1. In congested environments, cells that have the ATM CLP bit set to 1 are discarded before cells that have the ATM CLP bit set to 0.
The following restrictions apply to the Two-Rate Policer:
•On a Cisco 7500 series router, traffic policing can monitor Cisco Express Forwarding (CEF) or Distributed CEF (dCEF) switching paths only. To use the Two-Rate Policer, CEF or dCEF must be configured on both the interface receiving the packet and the interface sending the packet.
•On a Cisco 7500 series router, traffic policing cannot be applied to packets that originated from or are destined to a router.
•Two-rate policing can be configured on an interface, a subinterface, a Frame Relay data-link connection identifier (DLCI), and an ATM permanent virtual circuit (PVC).
•Two-rate policing is not supported on the following interfaces:
–Any interface on a Cisco 7500 series router that does not support CEF or dCEF
•Cisco 2600 series
•Cisco 7100 series
•Cisco 7200 series
•Cisco 7500 series (VIP-based platform only)
Note To use the set-clp-transmit action available with this feature, the Enhanced ATM Port Adapter (PA-A3) is required. Therefore, the set-clp-transmit action is not supported on any platform that does not support the PA-A3 adapter (such as the Cisco 2600 series router, the Cisco 3620 router, and the 3640 router). For more information, refer to the documentation for your specific router.
•On a Cisco 7500 series router, CEF or dCEF must be configured on the interface before you can use the Two-Rate Policer. For additional information on CEF or dCEF, refer to the Cisco IOS IP Switching Configuration Guide, Release 12.4.
•To configure the Two-Rate Policer, a traffic class and a service policy must be created, and the service policy must be attached to a specified interface. These tasks are performed using the Modular QoS CLI. For information on the Modular QoS CLI, see the "Modular Quality of Service Command-Line Interface Overview" chapter of the Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.4.
See the following sections for configuration tasks for the Two-Rate Policer feature. Each task in the list is identified as either required or optional.
•Configuring the Two-Rate Policer (required)
•Verifying the Two-Rate Policer Configuration (optional)
Configuring the Two-Rate Policer
The Two-Rate Policer is configured in the service policy. To configure the Two-Rate Policer, use the following command in policy-map class configuration mode.
Although not required for configuring the Two-Rate Policer, the command syntax of the police command also allows you to specify the action to be taken on a packet when you enable an optional action argument. The resulting action corresponding to the keyword choices are listed in Table 1.
The Two-Rate Policer works by using a token bucket mechanism. There are currently two types of token bucket algorithms: a single token bucket algorithm (available through the Traffic Policing feature) and a two token bucket algorithm (available through the Two-Rate Policer).
For more information about the single-rate Traffic Policing feature, refer to the "Policing and Shaping Overview" chapter in the Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.4.
Verifying the Two-Rate Policer Configuration
To verify that the Two-Rate Policer is configured on your interface, use the following command in user EXEC or privileged EXEC mode:
show policy-map interface
Displays statistics and configurations of all input and output policies attached to an interface.
•Check the interface type. Verify that your interface is not listed as a nonsupported interface in the Restrictions section of this document.
•For input traffic policing on a Cisco 7500 series router, verify that CEF or dCEF is configured on the interface on which traffic policing is configured.
•For output traffic policing on a Cisco 7500 series router, ensure that the incoming traffic is CEF-switched or dCEF-switched. Traffic policing cannot be used on the switching path unless CEF or dCEF switching is enabled.
Monitoring and Maintaining the Two-Rate Policer
To monitor and maintain the Two-Rate Policer, use the following user EXEC or privileged EXEC mode commands.
This section provides the following configuration example:
Limiting the Traffic Using a Policer Class: Example
In this example, the Two-Rate Policer is configured on a class to limit traffic to an average committed rate of 500 kbps and a peak rate of 1 Mbps.Router(config)# class-map policeRouter(config-cmap)# match access-group 101Router(config-cmap)# policy-map policy1Router(config-pmap)# class policeRouter(config-pmap-c)# police cir 500000 bc 10000 pir 1000000 be 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action dropRouter(config)# interface serial3/0Router(config-if)# service-policy output policy1Router(config-if)# endRouter# show policy-map policy1Policy Map policy1Class policepolice cir 500000 conform-burst 10000 pir 1000000 peak-burst 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action drop
Traffic marked as conforming to the average committed rate (500 kbps) will be sent as is. Traffic marked as exceeding 500 kbps, but not exceeding 1 Mbps, will be marked with IP Precedence 2 and then sent. All traffic exceeding 1 Mbps will be dropped. The burst parameters are set to 10000 bytes.
In the following example, 1.25 Mbps of traffic is sent ("offered") to a policer class.Router# show policy-map interface serial3/0Serial3/0Service-policy output: policy1Class-map: police (match all)148803 packets, 36605538 bytes30 second offered rate 1249000 bps, drop rate 249000 bpsMatch: access-group 101police:cir 500000 bps, conform-burst 10000, pir 1000000, peak-burst 100000conformed 59538 packets, 14646348 bytes; action: transmitexceeded 59538 packets, 14646348 bytes; action: set-prec-transmit 2violated 29731 packets, 7313826 bytes; action: dropconformed 499000 bps, exceed 500000 bps violate 249000 bpsClass-map: class-default (match-any)19 packets, 1990 bytes30 seconds offered rate 0 bps, drop rate 0 bpsMatch: any
The Two-Rate Policer marks 500 kbps of traffic as conforming, 500 kbps of traffic as exceeding, and 250 kbps of traffic as violating the specified rate. Packets marked as conforming will be sent as is, and packets marked as exceeding will be marked with IP Precedence 2 and then sent. Packets marked as violating the specified rate are dropped.
The following sections provide references related to the Two Rate Policer feature.
Related Topic Document Title
Modular Quality of Service Command-Line Interface
•Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.4
•Cisco IOS Quality of Service Solutions Command Reference, Release 12.2SB
•Cisco IOS Quality of Service Solutions Command Reference, Release 12.2SR
•Cisco IOS Quality of Service Solutions Command Reference, Release 12.4T
MIB MIBs Link
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
This feature uses no new or modified commands.
CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2001-2007 Cisco Systems, Inc. All rights reserved.