Downloads |
Table Of Contents
Related Features and Technologies
Supported Standards, MIBs, and RFCs
Monitoring and Maintaining Traffic Policing
Configuring a Service Policy that Includes Traffic Policing
Traffic Policing
This feature module describes the Traffic Policing feature. It includes information on the benefits of the feature, supported platforms, related documents, and so forth.
This document includes the following sections:
•
Supported Standards, MIBs, and RFCs
•
Feature Overview
The Traffic Policing feature performs the following functions:
•
•
Traffic policing allows you to control the maximum rate of traffic transmitted or received on an interface. The Traffic Policing feature is applied when you attach a traffic policy contain the Traffic Policing configuration to an interface. A traffic policy is configured using the Modular Quality of Service Command-Line Interface (Modular QoS CLI). For information on configuring the Modular QoS CLI, see the Modular Quality of Service Command-Line Interface Overview on Cisco Connection Online (CCO) and the Documentation CD-ROM.
Benefits
Bandwidth Management Through Rate Limiting
Traffic policing allows you to control the maximum rate of traffic transmitted or received on an interface. Traffic policing is often configured on interfaces at the edge of a network to limit traffic into or out of the network. In most Traffic Policing configurations, traffic that falls within the rate parameters is transmitted, whereas traffic that exceeds the parameters is dropped or transmitted with a different priority.
Packet Marking
Packet marking allows you to partition your network into multiple priority levels or classes of service (CoS). A packet is marked and these markings can be used to identify and classify traffic for downstream devices. In some cases, such as ATM Cell Loss Priority (CLP) marking or Frame Relay Discard Eligibility (DE) marking, the marking is used to classify traffic.
•
•
Traffic can be marked without using the Traffic Policing feature. If you want to mark traffic but do not want to use Traffic Policing, see the Class-Based Marking feature module.
Packet Prioritization for Frame Relay Frames
The Traffic Policing feature allows users to mark the Frame Relay DE bit of the Frame Relay frame. The Frame Relay DE bit is one bit and, therefore, can be set to either 0 or 1. In congested environments, frames with the DE bit set to 1 are discarded before frames with the DE bit set to 0.
Packet Prioritization for ATM Cells
The Traffic Policing feature allows users to mark the ATM CLP bit in ATM cells. The ATM CLP bit is used to prioritize packets in ATM networks. The ATM CLP bit is one bit and, therefore, can be set to either 0 or 1. In congested environments, cells with the ATM CLP bit set to 1 are discarded before cells with the ATM CLP bit set to 0.
Restrictions
•
•
•
•
–
–
Note
–
–
Related Features and Technologies
•
•
•
Related Documents
•
•
•
•
Supported Platforms
•
Note
•
•
•
•
•
•
•
Note
Supported Standards, MIBs, and RFCs
Standards
No new or modified standards are supported by this feature.
MIBs
Class-Based Quality of Service MIB
•
•
For descriptions of supported MIBs and how to use MIBs, see the Cisco MIB web site on CCO at http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml.
RFCs
•
Prerequisites
On a Cisco 7500 series router, Cisco Express Forwarding (CEF) must be configured on the interface before traffic policing can be used.
For additional information on Cisco Express Forwarding, see the Cisco Express Forwarding and Distributed Cisco Express Forwarding feature modules.
Configuration Tasks
See the following sections for configuration tasks for the Traffic Policing feature. Each task in the list indicates if the task is optional or required.
•
Configuring Traffic Policing
To successfully configure the Traffic Policing feature, a traffic class and a traffic policy must be created, and the traffic policy must be attached to a specified interface. These tasks are performed using the Modular QoS CLI. For information on the Modular QoS CLI, see the Modular Quality of Service Command-Line Interface document on CCO or the Documentation CD-ROM.
The Traffic Policing feature is configured in the traffic policy. To configure the Traffic Policing feature, use the following command in policy map configuration mode:
Router(config-pmap-c)# police bps burst-normal burst-max conform-action action exceed-action action violate-action action
Specifies a maximum bandwidth usage by a traffic class.
The Traffic Policing feature works with a token bucket mechanism. There are currently two types of token bucket algorithms: a single token bucket algorithm and a two token bucket algorithm. A single token bucket system is used when the violate-action option is not specified, and a two token bucket system is used when the violate-action option is specified.
For a description of a single token bucket algorithm and an explanation of how it works, see the "What is a Token Bucket?" section of the Policing and Shaping Overview document. An example of how the single token bucket algorithm works is also given in the "Command Reference" section of this document.
For a description of the two token bucket algorithm and an explanation of how it works, see the "Command Reference" section of this document.
Verifying Traffic Policing
Use the show policy-map interface EXEC command to verify that the Traffic Policing feature is configured on your interface. If the feature is configured on your interface, the show policy-map interface command output displays policing statistics:
Router# show policy-map interfaceEthernet1/7service-policy output: xclass-map: a (match-all)0 packets, 0 bytes5 minute rate 0 bpsmatch: ip precedence 0police:1000000 bps, 10000 limit, 10000 extended limitconformed 0 packets, 0 bytes; action: transmitexceeded 0 packets, 0 bytes; action: dropconformed 0 bps, exceed 0 bps, violate 0 bpsTroubleshooting Tips
•
•
•
Monitoring and Maintaining Traffic Policing
To monitor and maintain the Traffic Policing feature, use the following commands in EXEC mode, as needed:
Configuration Examples
This section provides the following configuration example:
•
Configuring a Service Policy that Includes Traffic Policing
The following configuration shows how to define a traffic class (with the class-map command) and associate that traffic class with a traffic policy (with the policy-map command). Traffic policing is applied in the traffic policy. The service-policy command is then used to attach the traffic policy to the interface.
For additional information on configuring traffic classes and traffic policies, see the Modular Quality of Service Command-Line Interface document on CCO and the Documentation CD-ROM.
In this particular example, traffic policing is configured with the average rate at 8000 bits per second, the normal burst size at 2000 bytes, and the excess burst size at 4000 bytes. Packets coming into Fast Ethernet interface 0/0 are evaluated by the token bucket algorithm to analyze whether packets conform exceed, or violate the specified parameters. Packets that conform are transmitted, packets that exceed are assigned a QoS group value of 4 and are transmitted, and packets that violate are dropped.
For a description of a token bucket and an explanation of how a token bucket works, see the "What is a Token Bucket?" section of the Policing and Shaping Overview document. An example of how the token bucket works is also given in the "Command Reference" section of this document.
Router(config)# class-map acgroup2Router(config-cmap)# match access-group 2Router(config-cmap)# exitRouter(config)# policy-map policeRouter(config-pmap)# class acgroup2Router(config-pmap-c)# police 8000 2000 4000 conform-action transmit exceed-action set-qos-transmit 4 violate-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy input policeCommand Reference
This section documents new or modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.1 command reference publications.
police
To configure the Traffic Policing feature, use the police policy map configuration command. The no form of this command removes the Traffic Policing feature from the configuration.
police bps burst-normal burst-max conform-action action exceed-action action [violate-action action]
no police bps burst-normal burst-max conform-action action exceed-action action[violate-action action]
Syntax DescriptionDescription
Usage
Defaults
Disabled
Command Modes
Policy-map configuration mode
Command History
Usage Guidelines
The violate-action option is not available in Cisco IOS Release 12.0 XE or Release 12.1 E. The violate-action option is not available with the rate-limit command.
The Traffic Policing feature works with a token bucket algorithm. There are currently two types of token bucket algorithms in Cisco IOS Release 12.1(5)T: a single token bucket algorithm and a two token bucket algorithm. A single token bucket system is used when the violate-action option is not specified, and a two token bucket system is used when the violate-action option is specified.
The token bucket algorithm for the police command that was introduced in Cisco IOS Release 12.0(5)XE is different from the token bucket algorithm for the police command introduced in Cisco IOS Release 12.1(5)T. For information on the token bucket algorithm introduced in Release 12.0(5)XE, see the Traffic Policing document for Release 12.0(5)XE. This document is available on the New Features for 12.0(5)XE feature documentation index (under Modular QoS CLI-related feature modules) at cisco.com.
Many of the action options are also Class-Based Marking features. For additional information on these actions, see the Class-Based Marking feature module.
The following are explanations of how the token bucket algorithms introduced in Cisco IOS Release 12.1(5)T work:
Token Bucket Algorithm with One Token Bucket
The one token bucket algorithm is used when the violate-action option is not specified in the police command CLI.
The conform bucket is initially set to the full size (the full size is the number of bytes specified as the normal burst size).
When a packet of size B bytes arrives at time t the following actions occur:
a. Tokens are updated in the conform bucket. If the previous arrival of the packet was at t1 and the current time is t, the bucket is updated with (t-t1) worth of bits based on the token arrival rate. The token arrival rate is calculated as follows:
(time between packets<which is equal to t-t1> * policer rate)/8 bytes
b. If the number of bytes in the conform bucket - B is greater than or equal to 0, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is completed for the packet.
c. If the number of bytes in the conform bucket - B is less than 0, the exceed action is taken.
Token Bucket Algorithm with Two Token Buckets
The two token bucket algorithm is used when the violate-action is specified in the police command CLI.
The conform bucket is initially full (the full size is the number of bytes specified as the normal burst size).
The exceed bucket is initially full (the full exceed bucket size is the number of bytes specified in the maximum burst size).
The tokens for both the conform and exceed token buckets are updated based on the token arrival rate (or CIR).
When a packet of size B bytes arrives at time t the following actions occur:
a. Tokens are updated in the conform bucket. If the previous arrival of the packet was at t1 and the current arrival of the packet is at t, the bucket is updated with t-t1 worth of bits based on the token arrival rate. The refill tokens are placed in the conform bucket. If the tokens overflow the conform bucket, the overflow tokens are placed in the exceed bucket.
The token arrival rate is calculated as follows:
(time between packets<which is equal to t-t1> * policer rate)/8 bytes
b. If the number of bytes in the conform bucket - B is greater than or equal to 0, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is taken. The exceed bucket is unaffected in this scenario.
c. If the number of bytes in the conform bucket - B is less than 0, the excess token bucket is checked for bytes by the packet. If the number of bytes in the exceed bucket - B is greater than or equal to 0, the exceed action is taken and B bytes are removed from the exceed token bucket. No bytes are removed from the conform bucket.
d. If the number of bytes in the exceed bucket - B is less than 0, the packet violates and the violate action is taken. The action is complete for the packet.
Examples
Token Bucket Algorithm with One Token Bucket Example
The token bucket algorithm for the police command that was introduced in Cisco IOS Release 12.0(5)XE is different from the token bucket algorithms introduced in Cisco IOS Release 12.1(5)T. The following example is for the token bucket algorithm with one token bucket introduced in Cisco IOS Release 12.1(5)T.
When the violate-action option is not specified while configuring a policy with the police command in Cisco IOS Release 12.1(5)T onward, the token bucket algorithm uses one token bucket. If the violate-action option is specified, the token bucket algorithm uses two token buckets. In the following example, the violate-action option is not specified, so the token bucket algorithm only uses one token bucket.
The following configuration shows users how to define a traffic class (using the class-map command) and associate the match criteria from the traffic class with the Traffic Policing configuration, which is configured in the service policy (using the policy-map command). The service-policy command is then used to attach this service policy to the interface.
In this particular example, traffic policing is configured with the average rate at 8000 bits per second and the normal burst size at 1000 bytes for all packets leaving Fast Ethernet interface 0/0.
Router(config)# class-map access-matchRouter(config-cmap)# match access-group 1Router(config-cmap)# exitRouter(config)# policy-map police-settingRouter(config-pmap)# class access-matchRouter(config-pmap-c)# police 8000 1000 conform-action transmit exceed-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy output police-settingThe treatment of a series of packets leaving Fast Ethernet interface 0/0 is dependant on the size of the packet and the number of bytes remaining in the conform bucket. These packets are policed based on the following rules:
a. Tokens are updated in the conform bucket. If the previous arrival of the packet was at t1 and the current time is t, the bucket is updated with t-t1 worth of bits based on the token arrival rate. The token arrival rate is calculated as follows:
(time between packets<which is equal to t-t1> * policer rate)/8 bytes
b. If the number of bytes in the conform bucket - B is greater than or equal to 0, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is completed for the packet.
c. If the number of bytes in the conform bucket - B is less than 0, the exceed action is taken.
In this example, the initial token buckets starts full at 1000 bytes. If a 450 byte packet arrives, the packet conforms because enough bytes are available in the token bucket. The conform action (transmit) is taken by the packet and 450 bytes are removed from the token bucket (leaving 550 bytes).
If the next packet arrives .25 seconds later, 250 bytes are added to the token bucket (0.25 * 8000)/8), leaving 800 bytes in the token bucket. If the next packet is 900 bytes, the packet exceeds and the exceed action (drop) is taken. No bytes are taken from the token bucket.
Token Bucket Algorithm with Two Token Buckets Example
When the violate-action option is specified while configuring a policy with the police command in Cisco IOS Release 12.1(5)T onward, the token bucket algorithm uses two token buckets. The following example uses the token bucket algorithm with two token buckets.
The following configuration shows users how to define a traffic class (using the class-map command) and associate the match criteria from the traffic class with the Traffic Policing configuration, which is configured in the service policy (using the policy-map command). The service-policy command is then used to attach this service policy to the interface.
In this particular example, traffic policing is configured with the average rate at 8000 bits per second, the normal burst size at 1000 bytes, and the excess burst size at 1000 bytes for all packets leaving Fast Ethernet interface 0/0.
Router(config)# class-map access-matchRouter(config-cmap)# match access-group 1Router(config-cmap)# exitRouter(config)# policy-map police-settingRouter(config-pmap)# class access-matchRouter(config-pmap-c)# police 8000 1000 1000 conform-action transmit exceed-action set-qos-transmit 1 violate-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy output police-settingThe treatment of a series of packets leaving Fast Ethernet interface 0/0 is dependant on the size of the packet and the number of bytes remaining in the conform and exceed token buckets. The series of packets are policed based on the following rules:
a. If the previous arrival of the packet was at t1 and the current arrival of the packet is at t, the bucket is updated with t-t1 worth of bits based on the token arrival rate. The refill tokens are placed in the conform bucket. If the tokens overflow the conform bucket, the overflow tokens are placed in the exceed bucket.
The token arrival rate is calculated as follows:
(time between packets<which is equal to t-t1> * policer rate)/8 bytes
b. If the number of bytes in the conform bucket - B is greater than or equal to 0, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is taken. The exceed bucket is unaffected in this scenario.
c. If the number of bytes in the conform bucket - B is less than 0, the excess token bucket is checked for bytes by the packet. If the number of bytes in the exceed bucket - B is greater than or equal to 0, the exceed action is taken and B bytes are removed from the exceed token bucket. No bytes are removed from the conform bucket in this scenario.
d. If the number bytes in the exceed bucket - B is less than 0, the packet violates and the violate action is taken. The action is complete for the packet.
In this example, the initial token buckets starts full at 1000 bytes. If a 450 byte packet arrives, the packet conforms because enough bytes are available in the conform token bucket. The conform action (transmit) is taken by the packet and 450 bytes are removed from the conform token bucket (leaving 550 bytes).
If the next packet arrives .25 seconds later, 250 bytes are added to the conform token bucket (0.25 * 8000)/8), leaving 800 bytes in the conform token bucket. If the next packet is 900 bytes, the packet does not conform because only 800 bytes are available in the conform token bucket.
The exceed token bucket, which starts full at 1000 bytes (as specified by the excess burst size) is then checked for available bytes. Because enough bytes are available in the exceed token bucket, the exceed action (set the QoS transmit value of 1) is taken and 900 bytes are taken from the exceed bucket (leaving 100 bytes in the exceed token bucket.
If the next packet arrives 0.40 seconds later, 400 bytes are added to the token buckets ((.40 * 8000)/8). Therefore, the conform token bucket now has 1000 bytes (the maximum number of tokens available in the conform bucket) and 200 bytes overflow the conform token bucket (because it only 200 bytes were needed to fill the conform token bucket to capacity). These overflow bytes are placed in the exceed token bucket, giving the exceed token bucket 300 bytes.
If the arriving packet is 1000 bytes, the packet conforms because enough bytes are available in the conform token bucket. The conform action (transmit) is taken by the packet and 1000 bytes are removed from the conform token bucket (leaving 0 bytes).
If the next packet arrives 0.20 seconds later, 200 bytes are added to the token bucket ((.20 * 8000)/8). Therefore, the conform bucket now has 200 bytes. If the arriving packet is 400 bytes, the packet does not conform because only 200 bytes are available in the conform bucket. Similarly, the packet does not exceed because only 300 bytes are available in the exceed bucket. Therefore, the packet violates and the violate action (drop) is taken.
Related Commands
Glossary
average rate—Maximum long-term average rate of conforming traffic.
conform action—Action to take on packets with a burst size below the rate allowed by the rate limit.
DSCP—differentiated services code point
exceed action—Action to take on packets that exceed the rate limit.
excess burst size—Bytes allowed in a burst before all packets will exceed the rate limit.
normal burst size—Bytes allowed in a burst before some packets will exceed the rate limit. Larger bursts are more likely to exceed the rate limit.
QoS group—Internal QoS group ID for a packet used to determine weighted fair queuing characteristics for that packet.
policing policy—Rate limit, conform actions, and exceed actions that apply to traffic matching a certain criteria.
Versatile Interface Processor (VIP)—Interface card used by Cisco 7500 series and Cisco 7000 series with RSP7000 routers.
