Downloads |
Table Of Contents
Related Features and Technologies
Supported Standards, MIBs, and RFCs
Configuring the Two-Rate Policer
Verifying the Two-Rate Policer Configuration
Monitoring and Maintaining the Two-Rate Policer
Limiting the Traffic Using a Policer Class Example
Two-Rate Policer
12.2(4)T
This feature was introduced.
12.2(4)T3
Support for the Cisco 7500 series routers was added.
Feature History
This document describes the Two-Rate Policer feature in Cisco IOS Release 12.2(4)T. It includes the following sections:
•
Feature Overview, page 1
•
•
•
•
•
•
Feature Overview
Networks police traffic by limiting the input or output transmission rate of a class of traffic based on user-defined criteria. Policing traffic allows you to control the maximum rate of traffic sent or received on an interface and to partition a network into multiple priority levels or class of service (CoS).
The Two-Rate Policer performs the following functions:
•
•
With the Two-Rate Policer, you can enforce traffic policing according to two separate rates—committed information rate (CIR) and peak information rate (PIR). You can specify the use of these two rates, along with their corresponding values, by using two keywords, cir and pir, of the police command. For more information about the police command, see the "Command Reference" section of this document.
The Two-Rate Policer manages the maximum rate of traffic through a token bucket algorithm. The token bucket algorithm can use the user-configured values to determine the maximum rate of traffic allowed on an interface at a given moment in time. The token bucket algorithm is affected by all traffic entering or leaving the interface (depending on the location of the interface on which the Two-Rate Policer is configured) and is useful in managing network bandwidth in cases where several large packets are sent in the same traffic stream.
The token bucket algorithm provides users with three actions for each packet: a conform action, an exceed action, and an optional violate action. Traffic entering the interface with Two-Rate Policer configured is placed in to one of these categories. Within these three categories, users can decide packet treatments. For instance, packets that conform can be configured to be sent, packets that exceed can be configured to be sent with a decreased priority, and packets that violate can be configured to be dropped.
The Two-Rate Policer is often configured on interfaces at the edge of a network to limit the rate of traffic entering or leaving the network. In the most common configurations, traffic that conforms is sent and traffic that exceeds is sent with a decreased priority or is dropped. Users can change these configuration options to suit their network needs.
Note
Note
Benefits
Bandwidth Management Through Rate Limiting
This feature provides improved bandwidth management through rate limiting. Before this feature was available, you could police traffic with the single-rate Traffic Policing feature. The Traffic Policing feature provided a certain amount of bandwidth management by allowing you to set the peak burst size (be). The Two-Rate Policer supports a higher level of bandwidth management and supports a sustained excess rate. With the Two-Rate Policer, you can enforce traffic policing according to two separate rates—CIR and PIR—specified in bits per second (bps).
Packet Marking Through IP Precedence, DSCP Value, MPLS Experimental Value, and the QoS Group Setting
In addition to rate-limiting, the Two-Rate Policer allows you to independently mark the packet according to whether the packet conforms, exceeds, or violates a specified rate. Packet marking also allows you to partition your network into multiple priority levels or classes of service (CoS).
•
•
If you want to mark traffic but do not want to use the Two-Rate Policer, see the Class-Based Marking feature module available with Cisco IOS Release 12.2(2)T. More information about the Class-Based Marking feature is available from the Cisco documentation website (Cisco.com) or the Cisco documentation CD.
Packet Marking for Frame Relay Frames
The Two-Rate Policer allows users to mark the Frame Relay DE bit of the Frame Relay frame. The Frame Relay DE bit is one bit and, therefore, can be set to either 0 or 1. In congested environments, frames that have the DE bit set to 1 are discarded before frames that have the DE bit set to 0.
Packet Marking for ATM Cells
The Two-Rate Policer allows users to mark the ATM CLP bit in ATM cells. The ATM CLP bit is used to prioritize packets in ATM networks. The ATM CLP bit is one bit and, therefore, can be set to either 0 or 1. In congested environments, cells that have the ATM CLP bit set to 1 are discarded before cells that have the ATM CLP bit set to 0.
Restrictions
The following restrictions apply to the Two-Rate Policer:
•
•
•
•
–
–
–
Related Features and Technologies
•
•
•
•
Related Documents
•
•
•
Supported Platforms
•
•
•
•
•
•
Note
Platform Support Through Feature Navigator
Cisco IOS software is packaged in feature sets that support specific platforms. To get updated information regarding platform support for this feature, access Feature Navigator. Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.
Feature Navigator is a web-based tool that enables you to quickly determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image.
To access Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions at http://www.cisco.com/register.
Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Feature Navigator home page at the following URL:
http://www.cisco.com/go/fn
Supported Standards, MIBs, and RFCs
Standards
No new or modified standards are supported by this feature.
MIBs
The Two-Rate Policer feature supports the following MIBs:
•
•
To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
RFCs
This feature supports RFC 2698, A Two Rate Three Color Marker.
Prerequisites
•
•
Configuration Tasks
See the following sections for configuration tasks for the Two-Rate Policer feature. Each task in the list is identified as either required or optional.
•
•
Configuring the Two-Rate Policer
The Two-Rate Policer is configured in the service policy. To configure the Two-Rate Policer, use the following command in policy-map class configuration mode:
Although not required for configuring the Two-Rate Policer, the command syntax of the police command also allows you to specify the action to be taken on a packet when you enable an optional action argument. The resulting action corresponding to the keyword choices are listed in Table 1.
For more information about the police command, see the "Command Reference" section of this document.
The Two-Rate Policer works by using a token bucket mechanism. There are currently two types of token bucket algorithms: a single token bucket algorithm (available through the Traffic Policing feature) and a two token bucket algorithm (available through the Two-Rate Policer).
For more information about the single-rate Traffic Policing feature, refer to the "Policing and Shaping Overview" chapter in the Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.2.
For more information about the two token bucket algorithm, see the "Command Reference" section of this document.
Verifying the Two-Rate Policer Configuration
To verify that the Two-Rate Policer is configured on your interface, use the following command in EXEC or privileged EXEC mode:
Router# show policy-map interface
Displays statistics and configurations of all input and output policies attached to an interface.
Troubleshooting Tips
•
•
•
Monitoring and Maintaining the Two-Rate Policer
To monitor and maintain the Two-Rate Policer, use the following EXEC or privileged EXEC mode commands:
Configuration Examples
This section provides the following configuration example:
•
Limiting the Traffic Using a Policer Class Example
In this example, the Two-Rate Policer is configured on a class to limit traffic to an average committed rate of 500 kbps and a peak rate of 1 Mbps.
Router(config)# class-map policeRouter(config-cmap)# match access-group 101Router(config-cmap)# policy-map policy1Router(config-pmap)# class policeRouter(config-pmap-c)# police cir 500000 bc 10000 pir 1000000 be 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action dropRouter(config-pmap-c)# interface s3/0Router(config-if)# service-policy output policy1Router(config-if)# endRouter# show policy-map policy1Policy Map policy1Class policepolice cir 500000 conform-burst 10000 pir 1000000 peak-burst 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action dropTraffic marked as conforming to the average committed rate (500 kbps) will be sent as is. Traffic marked as exceeding 500 kbps, but not exceeding 1 Mbps, will be marked with IP Precedence 2 and then sent. All traffic exceeding 1 Mbps will be dropped. The burst parameters are set to 10000 bytes.
In the following example, 1.25 Mbps of traffic is sent ("offered") to a policer class.
Router# show policy-map interface s3/0Serial3/0Service-policy output: policy1Class-map: police (match all)148803 packets, 36605538 bytes30 second offered rate 1249000 bps, drop rate 249000 bpsMatch: access-group 101police:cir 500000 bps, conform-burst 10000, pir 1000000, peak-burst 100000conformed 59538 packets, 14646348 bytes; action: transmitexceeded 59538 packets, 14646348 bytes; action: set-prec-transmit 2violated 29731 packets, 7313826 bytes; action: dropconformed 499000 bps, exceed 500000 bps violate 249000 bpsClass-map: class-default (match-any)19 packets, 1990 bytes30 seconds offered rate 0 bps, drop rate 0 bpsMatch: anyThe Two-Rate Policer marks 500 kbps of traffic as conforming, 500 kbps of traffic as exceeding, and 250 kbps of traffic as violating the specified rate. Packets marked as conforming will be sent as is, and packets marked as exceeding will be marked with IP Precedence 2 and then sent. Packets marked as violating the specified rate are dropped.
Command Reference
This section documents modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.2 command reference publications.
•
•
•
police
To configure traffic policing, use the police command in policy-map class configuration mode. To remove traffic policing from the configuration, use the no form of this command.
police {cir cir} [bc conform-burst] {pir pir} [be peak-burst] [conform-action action [exceed-action action [violate-action action]]]
no police {cir cir} [bc conform-burst] {pir pir} [be peak-burst] [conform-action action [exceed-action action [violate-action action]]]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
Policy-map class configuration
Command History
Usage Guidelines
The Two-Rate Policer uses two token buckets—Tc and Tp—for policing traffic at two independent rates. Note the following points about the two token buckets:
•
•
Updating Token Buckets
The following scenario illustrates how the token buckets are updated:
A packet of B bytes arrives at time t. The last packet arrived at time t1. The CIR and the PIR token buckets at time t are represented by Tc(t) and Tp(t), respectively. Using these values and in this scenario, the token buckets are updated as follows:
Tc(t) = min(CIR * (t-t1) + Tc(t1), Bc)
Tp(t) = min(PIR * (t-t1) + Tp(t1), Be)
Marking Traffic
The Two-Rate Policer marks packets as either conforming, exceeding, or violating a specified rate. The following points (using a packet of B bytes) illustrate how a packet is marked:
•
•
Otherwise, the packet is marked as conforming to the specified rate, and both token buckets—Tc(t) and Tp(t)—are updated as follows:
Tp(t) = Tp(t) - B
Tc(t) = Tc(t) - B
For example, if the CIR is 100 kbps, and the PIR is 200 kbps, and a data stream with a rate of 250 kbps arrives at the Two-Rate Policer, the packet would be marked as follows:
•
•
•
Marking Packets and Assigning Actions Flowchart
The flowchart in Figure 1 illustrates how the Two-Rate Policer marks packets and assigns a corresponding action (that is, violate, exceed, or conform) to the packet.
Figure 1 Marking Packets and Assigning Actions with the Two-Rate Policer
Examples
In this example, the Two-Rate Policer is configured on a class to limit traffic to an average committed rate of 500 kbps and a peak rate of 1 Mbps.
Router(config)# class-map policeRouter(config-cmap)# match access-group 101Router(config-cmap)# policy-map policy1Router(config-pmap)# class policeRouter(config-pmap-c)# police cir 500000 bc 10000 pir 1000000 be 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action dropRouter(config-pmap-c)# interface s3/0Router(config-if)# service-policy output policy1Router(config-if)# endRouter# show policy-map policy1Policy Map policy1Class policepolice cir 500000 conform-burst 10000 pir 1000000 peak-burst 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action dropTraffic marked as conforming to the average committed rate (500 kbps) will be sent as is. Traffic marked as exceeding 500 kbps, but not exceeding 1 Mbps, will be marked with IP Precedence 2 and then sent. All traffic marked as exceeding 1 Mbps will be dropped. The burst parameters are set to 10000 bytes.
In the following example, 1.25 Mbps of traffic is sent ("offered") to a policer class.
Router# show policy-map interface s3/0Serial3/0Service-policy output: policy1Class-map: police (match all)148803 packets, 36605538 bytes30 second offered rate 1249000 bps, drop rate 249000 bpsMatch: access-group 101police:cir 500000 bps, conform-burst 10000, pir 1000000, peak-burst 100000conformed 59538 packets, 14646348 bytes; action: transmitexceeded 59538 packets, 14646348 bytes; action: set-prec-transmit 2violated 29731 packets, 7313826 bytes; action: dropconformed 499000 bps, exceed 500000 bps violate 249000 bpsClass-map: class-default (match-any)19 packets, 1990 bytes30 seconds offered rate 0 bps, drop rate 0 bpsMatch: anyThe Two-Rate Policer marks 500 kbps of traffic as conforming, 500 kbps of traffic as exceeding, and 250 kbps of traffic as violating the specified rate. Packets marked as conforming to the rate will be sent as is, and packets marked as exceeding the rate will be marked with IP Precedence 2 and then sent. Packets marked as violating the rate are dropped.
Related Commands
show policy-map
To display the configuration of all classes for a specified service policy map or all classes for all existing policy maps, use the show policy-map command in EXEC or privileged EXEC mode.
show policy-map [policy-map]
Syntax Description
policy-map
(Optional) Name of the service policy map whose complete configuration is to be displayed.
Defaults
All existing policy map configurations are displayed.
Command Modes
EXEC or privileged EXEC
Command History
Usage Guidelines
The show policy-map command displays the configuration of a service policy map created using the policy-map command. You can use the show policy-map command to display all class configurations comprising any existing service policy map, whether or not that service policy map has been attached to an interface.
Examples
In this example, the Two-Rate Policer is configured on a class to limit traffic to an average committed rate of 500 kbps and a peak rate of 1 Mbps.
Router(config)# class-map policeRouter(config-cmap)# match access-group 101Router(config-cmap)# policy-map policy1Router(config-pmap)# class policeRouter(config-pmap-c)# police cir 500000 bc 10000 pir 1000000 be 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action dropRouter(config-pmap-c)# interface s3/0Router(config-if)# service-policy output policy1Router(config-if)# endRouter# show policy-map policy1Policy Map policy1Class policepolice cir 500000 conform-burst 10000 pir 1000000 peak-burst 10000 conform-action transmit exceed-action set-prec-transmit 2 violate-action dropTraffic marked as conforming to the average committed rate (500 kbps) will be sent as is. Traffic marked as exceeding 500 kbps, but not exceeding 1 Mbps, will be marked with IP Precedence 2 and then sent. All traffic exceeding 1 Mbps will be dropped. The burst parameters are set to 10000 bytes.
Table 2 describes the significant fields shown in this display.
Related Commands
show policy-map interface
To display the configuration of all classes configured for all service policies on the specified interface or to display the classes for the service policy for a specific permanent virtual circuit (PVC) on the interface, use the show policy-map interface command in EXEC or privileged EXEC mode.
show policy-map interface-name [vc [vpi/] vci][dlci dlci]
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
EXEC or privileged EXEC
Command History
Usage Guidelines
The show policy-map interface command displays the configuration for classes on the specified interface or the specified PVC only if a service policy has been attached to the interface or the PVC.
You can use the interface-name argument to display output for a PVC only for Enhanced ATM port adapters (PA-A3) that support per-VC queueing.
The counters displayed after the show policy-map interface command is entered are updated only if congestion is present on the interface.
The show policy-map interface command will display policy information about Frame Relay PVCs only if Frame Relay Traffic Shaping (FRTS) is enabled on the interface.
Examples
In the following example, 1.25 Mbps of traffic is sent ("offered") to a policer class:
Router# show policy-map interface s3/0Serial3/0Service-policy output: policy1Class-map: police (match all)148803 packets, 36605538 bytes30 second offered rate 1249000 bps, drop rate 249000 bpsMatch: access-group 101police:cir 500000 bps, conform-burst 10000, pir 1000000, peak-burst 100000conformed 59538 packets, 14646348 bytes; action: transmitexceeded 59538 packets, 14646348 bytes; action: set-prec-transmit 2violated 29731 packets, 7313826 bytes; action: dropconformed 499000 bps, exceed 500000 bps violate 249000 bpsClass-map: class-default (match-any)19 packets, 1990 bytes30 seconds offered rate 0 bps, drop rate 0 bpsMatch: anyThe Two-Rate Policer marks 500 kbps of traffic as conforming, 500 kbps of traffic as exceeding, and 250 kbps of traffic as violating the specified rate. Packets marked as conforming will be sent as is, and packets marked as exceeding will be marked with IP Precedence 2 and then sent. Packets marked as violating the specified rate are dropped.
Table 3 describes the fields associated with the Two-Rate Policer shown in this display. For more information about the other fields shown in this display, refer to the documentation for the show policy-map interface command in the Cisco IOS Quality of Service Solutions Command Reference, Release 12.2.
Related Commands
