Feedback
Table Of Contents
Licensing Requirements for Policing
Configuring 1-Rate and 2-Rate, 2-Color and 3-Color Policing
Configuring Color-Aware Policing
Configuring Ingress and Egress Policing
Verifying the Policing Configuration
Configuring Policing
This chapter describes how to configure policing of traffic classes.
This chapter includes the following sections:
•
Licensing Requirements for Policing
•
Information About Policing
Policing is the monitoring of the data rates for a particular class of traffic. When the data rate exceeds user-configured values, marking or dropping of packets occurs immediately. Policing does not buffer the traffic, so transmission delay is not affected. When traffic exceeds the data rate, you instruct the system to either drop the packets or mark QoS fields in them.
You can define single-rate, dual-rate, and color-aware policers.
Single-rate policers monitor the committed information rate (CIR) of traffic. Dual-rate policers monitor both CIR and peak information rate (PIR) of traffic. In addition, the system monitors associated burst sizes. Three "colors," or conditions, are determined by the policer for each packet depending on the data rate parameters supplied: conform (green), exceed (yellow), or violate (red).
You can configure only one action for each condition. For example, you might police for traffic in a class to conform to the data rate of 256000 bits per second, with up to 200 millisecond bursts. The system would apply the conform action to traffic that falls within this rate, and it would apply the violate action to traffic that exceeds this rate.
Color-aware policers assume that traffic has been previously marked with a color. This information is then used in the actions taken by this type of policer.
For more information about policers, see RFC 2697 and RFC 2698.
Shared Policers
QoS applies the bandwidth limits specified in a shared policer cumulatively to all flows in the matched traffic. A shared policer applies the same policer to more than one interface simultaneously.
For example, if you configure a shared policer to allow 1 Mbps for all TFTP traffic flows on VLAN 1 and VLAN 3, the device limits the TFTP traffic for all flows combined on VLAN 1 and VLAN 3 to 1 Mbps.
The following are guidelines for configuring shared policers:
•
•
•
Licensing Requirements for Policing
The following table shows the licensing requirements for this feature:
However, using VDCs requires an Advanced Services license.
Prerequisites for Policing
Policing has the following prerequisites:
•
•
•
Guidelines and Limitations
Use the following guidelines to configure policing:
•
–
–
–
•
Configuring Policing
You can configure a single- or dual-rate policer.
This section includes the following topics:
•
•
•
•
Configuring 1-Rate and 2-Rate, 2-Color and 3-Color Policing
The type of policer created by the device is based on a combination of the police command arguments described in Table 6-1.
Note
Table 6-1 Arguments to the police Command
cir
Committed information rate, or desired bandwidth, specified as a bit rate or a percentage of the link rate. Although a value for cir is required, the argument itself is optional. The range of values is 1 to 80000000000; the range of policing values that are mathematically significant is 8000 to 80 Gbps.
percent
Specifies the rate as a percentage of the interface rate. The range of values is 1 to 100%.
bc
Indication of how much the cir can be exceeded, either as a bit rate or an amount of time at cir. The default is 200 milliseconds of traffic at the configured rate. The default data rate units are bytes, and the Gigabit per second (gbps) rate is not supported for this parameter.
pir
Peak information rate, specified as a PIR bit rate or a percentage of the link rate. There is no default. The range of values is 1 to 80000000000; the range of policing values that are mathematically significant is 8000 to 80 Gbps. The range of percentage values is 1 to 100%.
be
Indication of how much the pir can be exceeded, either as a bit rate or an amount of time at pir. When the bc value is not specified, the default is 200 milliseconds of traffic at the configured rate. The default data rate units are bytes, and the Gigabit per second (gbps) rate is not supported for this parameter.
Note
conform
Single action to take if the traffic data rate is within bounds. The basic actions are transmit or one of the set commands listed in Table 6-4. The default is transmit.
exceed
Single action to take if the traffic data rate is exceeded. The basic actions are drop or markdown. The default is drop.
violate
Single action to take if the traffic data rate violates the configured rate values. The basic actions are drop or markdown. The default is drop.
Note
Although all the arguments in Table 6-1 are optional, you must specify a value for cir. In this section, cir indicates what is its value but not necessarily the keyword itself. The combination of these arguments and the resulting policer types and actions are shown in Table 6-2.
The policer actions that you can specify are described in Table 6-3 and Table 6-4.
Table 6-3 Policer Actions for Exceed or Violate
drop
Drops the packet. This is only available when the packet exceeds or violates the parameters.
set dscp dscp table {cir-markdown-map | pir-markdown-map}
Sets the specified fields from a table map and transmits the packet. For more information on the system-defined, or default table maps, see Chapter 4, "Configuring Marking." This is available only when the packet exceeds the parameters (use the cir-markdown-map) or violates the parameters (use the pir-markdown-map).
Note
The data rates used in the police command are described in Table 6-5.
Table 6-5 The Data Rates for the police Command
bps
Bits per second (default)
kbps
1,000 bits per seconds
mbps
1,000,000 bits per second
gbps
1,000,000,000 bits per second
Burst sizes used in the police command are described in Table 6-6.
Table 6-6 Burst Sizes for the police Command
bytes
bytes
kbytes
1,000 bytes
mbytes
1,000,000 bytes
ms
milliseconds
us
microseconds
SUMMARY STEPS
Note
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Step 1
config t
Example:
switch# config t
switch(config)#
Enters configuration mode.
Step 2
policy-map [type qos] [match-first] policy-map-name
Example:
switch(config)# policy-map policy1
switch(config-pmap-qos)#
Creates or accesses the policy map named policy-map-name, and then enters policy-map mode. The policy-map name can contain alphabetic, hyphen, or underscore characters, is case sensitive, and can be up to 40 characters.
Step 3
class [type qos] {class-map-name | class-default} [insert-before before-class-map-name]
Example:
switch(config-pmap-qos)# class class-default
switch(config-pmap-c-qos)#
Creates a reference to class-map-name, and enters policy-map class configuration mode. The class is added to the end of the policy map unless insert-before is used to specify the class to insert before. Specify class-default to select all traffic that is not matched by classes in the policy map so far.
Step 4
police [cir] {committed-rate [data-rate] | percent cir-link-percent} [[bc committed-burst-rate [link-speed]][pir] {peak-rate [data-rate] | percent cir-link-percent} [[be peak-burst-rate [link-speed]] [conform {transmit | set-prec-transmit | set-dscp-transmit | set-cos-transmit | set-qos-transmit | set-discard-class-transmit} [exceed {drop | set dscp dscp table {cir-markdown-map}} [violate {drop | set dscp dscp table {pir-markdown-map}}]]]
Example #1:
switch(config-pmap-c-qos)# police cir 256000 conform transmit violate set dscp dscp table pir-markdown-map
switch(config-pmap-c-qos)#
Example #2:
switch(config-pmap-c-qos)# police cir 256000 pir 256000 conform transmit exceed set dscp dscp table cir-markdown-map violate drop
switch(config-pmap-c-qos)#
Polices cir in bits or as a percentage of the link rate. The conform action is taken if the data rate is <= cir. If be and pir are not specified, all other traffic takes the violate action. If be or violate are specified, then the exceed action is taken if the data rate <= pir, and the violate action is taken otherwise. The actions are described in Table 6-3 and Table 6-4. The data rates and link speeds are described in Table 6-5 and Table 6-6.
This first example shows a 1-rate, 2-color policer that transmits if the data rate is within 200 milliseconds of traffic at 256000 bps and marks IP precedence to 6 if the data rate is exceeded.
This second example shows a 1-rate, 3-color policer that transmits if the data rate is within 200 milliseconds of traffic at 256000 bps, marks DSCP to 6 if the data rate is within 300 milliseconds of traffic at 256000 bps, and drops packets otherwise.
Note
Step 5
exit
Example:
switch(config-pmap-c-qos)# exit
switch(config-pmap-qos)#
Exits policy-map class configuration mode and enters policy-map mode.
Step 6
exit
Example:
switch(config-pmap-qos)# exit
switch(config)#
Exits policy-map mode and enters configuration mode.
Step 7
show policy-map [type qos] [policy-map-name]
Example:
switch(config)# show policy-map
(Optional) Displays information about all configured policy maps or a selected policy map of type qos.
Step 8
copy running-config startup-config
Example:
switch(config)# copy running-config startup-config
(Optional) Saves the running configuration to the startup configuration.
Use the show policy-map command to display the policy1 policy-map configuration:
switch# show policy-map policy1Configuring Color-Aware Policing
Color-aware policing implies that the QoS DSCP field in a class of traffic has been previously marked with values that you can use in a policer. This feature allows you to mark traffic at one node in a network and then take action based on this marking at a subsequent node.
Note
You can use one or more of the four police command class maps conform-color or exceed-color to perform color-aware policing. These keywords require a class-map name that is used to classify packets. Based on the match criteria that you specify in the class maps, the traffic is classified into one of these two classes or class-default if there is no match. The policer then takes the following action:
•
•
•
Note
You can set the DSCP value for color-aware policing to a specified value. The list of valid DSCP values is shown in Table 6-7.
After you apply color-aware policing, all matching packets in the device will be policed according to the specifications of the color-aware policer.
To configure color-aware policing, follow these steps:
Step 1
Step 2
Step 3
Step 4
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
DETAILED STEPS
Step 1
config t
Example:
switch# config t
switch(config)#
Enters configuration mode.
Step 2
class-map {conform-color-in | conform-color-out | exceed-color-in | exceed-color-out}
Example:
switch(config)# class-map conform-color-in
switch(config-color-map)#
Accesses the color-aware class map, and enters color-map mode. When you enter this command, the system returns the following message:
Warning: Configuring match for any DSCP values in this class-map will make ALL policers in the system color-aware for those DSCP values.
Step 3
match dscp dscp-value
Example:
switch(config-color-map)# match dscp af22
switch(config-color-map)#
Specifies the DSCP value to match for color-aware policers. See Table 6-7 for list of valid values.
Step 4
policy-map [type qos] [match-first] policy-map-name
Example:
switch(config)# policy-map policy1
switch(config-pmap-qos)#
Creates or accesses the policy-map named policy-map-name, and then enters policy-map mode. The policy-map name can contain alphabetic, hyphen, or underscore characters, is case sensitive, and can be up to 40 characters.
Step 5
class [type qos] {class-map-name | class-default} [insert-before before-class-map-name]
Example:
switch(config-pmap-qos)# class class-default
switch(config-pmap-c-qos)#
Creates a reference to class-map-name and enters policy-map class configuration mode. The class is added to the end of the policy map unless insert-before is used to specify the class to insert before. Specify class-default to select all traffic that is not matched by classes in the policy map so far.
Step 6
police [cir] {committed-rate [data-rate] | percent cir-link-percent} [[bc committed-burst-rate [link-speed]][pir] {peak-rate [data-rate] | percent cir-link-percent} [[be peak-burst-rate [link-speed]] [conform {transmit | set-prec-transmit | set-dscp-transmit | set-cos-transmit | set-qos-transmit | set-discard-class-transmit} [exceed {drop | set dscp dscp table {cir-markdown-map}} [violate {drop | set dscp dscp table {pir-markdown-map}}]]]
Example #1:
switch(config-pmap-c-qos)# police cir 256000 be 300 ms conform-class my_conform_class_map exceed-class my_exceed_class_map conform transmit exceed set dscp dscp table cir-markdown-map violate drop
switch(config-pmap-c-qos)#
Example #2:
switch(config-pmap-c-qos)# police cir 256000 pir 512000 conform-class my_conform_class_map exceed-class my_exceed_class_map conform transmit exceed set dscp dscp table cir-markdown-map violate drop
switch(config-pmap-c-qos)#
Polices cir in bits or as a percentage of the link rate. The conform action is taken if the data rate is <= cir. If be and pir are not specified, all other traffic takes the violate action. If be or violate are specified, then the exceed action is taken if the data rate <= pir, and the violate action is taken otherwise. The actions are described in Table 6-3 and Table 6-4. The data rates and link speeds are described in Table 6-5 and Table 6-6.
This first example shows a 1-rate, 3-color color-aware policer that transmits if conform-class the data rate is within 200 milliseconds of traffic at 256000 bps, marks DSCP to 6 if the exceed-class the data rate is within 300 milliseconds of traffic at 256000 bps, and drops packets otherwise.
This second example shows a 2-rate, 3-color color-aware policer that transmits if the data rate is within 200 milliseconds of traffic at 256000 bps, marks CoS to 5 if the data rate exceeds 200 milliseconds of traffic at 512 bps, and drops packets otherwise
Step 7
exit
Example:
switch(config-color-map)# exit
switch(config)#
Exits color-map mode and then enters configuration mode.
Step 8
show policy-map [type qos] [policy-map-name]
Example:
switch(config)# show policy-map
(Optional) Displays information about all configured policy maps or a selected policy map of type qos.
Step 9
copy running-config startup-config
Example:
switch(config)# copy running-config startup-config
(Optional) Saves the running configuration to the startup configuration.
Use the show policy-map command to display the policy1 policy-map configuration:
switch# show policy-map policy1Configuring Ingress and Egress Policing
You can apply the policing instructions in a QoS policy map to ingress or egress packets by attaching that QoS policy map to an interface. To select ingress or egress, you specify either the input or output keyword in the service-policy command. For more information, see the "Attaching and Detaching a QoS Policy Action from an Interface" section on page 2-18.
Configuring Markdown Policing
Markdown policing is the setting of a QoS field in a packet when traffic exceeds or violates the policed data rates. You can configure markdown policing by using the set commands for policing action described in Table 6-3 and Table 6-4.
The example in this section shows you how to use a table map to perform markdown.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Step 1
config t
Example:
switch# config t
switch(config)#
Enters configuration mode.
Step 2
policy-map [type qos] [match-first] policy-map-name
Example:
switch(config)# policy-map policy1
switch(config-pmap-qos)#
Creates or accesses the policy-map named policy-map-name, and then enters policy-map mode. The policy-map name can contain alphabetic, hyphen, or underscore characters, is case sensitive, and can be up to 40 characters.
Step 3
class [type qos] {class-map-name | class-default} [insert-before before-class-map-name]
Example:
switch(config-pmap-qos)# class class-default
switch(config-pmap-c-qos)#
Creates a reference to class-map-name, and enters policy-map class configuration mode. The class is added to the end of the policy map unless insert-before is used to specify the class to insert before. Specify class-default to select all traffic not matched by classes in the policy map so far.
Step 4
police [cir] {committed-rate [data-rate] | percent cir-link-percent} [[bc | burst] burst-rate [link-speed]] [[be | peak-burst] peak-burst-rate [link-speed]] [conform conform-action [exceed set dscp dscp table cir-markdown-map [violate set dscp dscp table pir-markdown-map]]]
Example:
switch(config-pmap-c-qos)# police cir 256000 be 300 ms conform transmit exceed set dscp dscp table cir-markdown-map violate drop
switch(config-pmap-c-qos)#
Polices cir in bits or as a percentage of the link rate. The conform action is taken if the data rate is <= cir. If be and pir are not specified, all other traffic takes the violate action. If be or violate are specified, then the exceed action is taken if the data rate <= pir, and the violate action is taken otherwise. The actions are described in Table 6-3 and Table 6-4. The data rates and link speeds are described in Table 6-5 and Table 6-6.
This example shows a 1-rate, 3-color policer that transmits if the data rate is within 200 milliseconds of traffic at 256000 bps; marks down DSCP using the system-defined table map if the data rate is within 300 milliseconds of traffic at 256000 bps; and drops packets otherwise.
Step 5
exit
Example:
switch(config-pmap-c-qos)# exit
switch(config-pmap-qos)#
Exits policy-map class configuration mode and enters policy-map mode.
Step 6
exit
Example:
switch(config-pmap-qos)# exit
switch(config)#
Exits policy-map mode and enters configuration mode.
Step 7
show policy-map [type qos] [policy-map-name]
Example:
switch(config)# show policy-map
(Optional) Displays information about all configured policy maps or a selected policy map of type qos.
Step 8
copy running-config startup-config
Example:
switch(config)# copy running-config startup-config
(Optional) Saves the running configuration to the startup configuration.
Use the show policy-map command to display the policy1 policy-map configuration:
switch# show policy-map policy1Configuring Shared Policers
The shared-policer feature allows you to apply the same policing parameters to several interfaces simultaneously. You create a shared policer by assigning a name to a policer, and then applying that policer to a policy map that you attach to the specified interfaces. The shared policer is also referred to as the named aggregate policer in other Cisco documentation.
Note
To configure shared policing, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
DETAILED STEPS
Step 1
config t
Example:
switch# config t
switch(config)#
Enters configuration mode.
Step 2
qos shared-policer [type qos] shared-policer-name [cir] {committed-rate [data-rate] | percent cir-link-percent} [[bc committed-burst-rate [link-speed]][pir] {peak-rate [data-rate] | percent cir-link-percent} [[be peak-burst-rate [link-speed]] [conform conform-action [exceed set dscp dscp table cir-markdown-map [violate set dscp dscp table pir-markdown-map]]]
Example:
switch(config)# qos shared-policer test1 cir 10 mbps
switch(config)#
Creates or accesses the shared policer. The shared-policer-name can contain alphabetic, hyphen, or underscore characters, is case sensitive, and can be up to 40 characters. Polices cir in bits or as a percentage of the link rate. The conform action is taken if the data rate is <= cir. If be and pir are not specified, all other traffic takes the violate action. If be or violate are specified, then the exceed action is taken if the data rate <= pir, and the violate action is taken otherwise. The actions are described in Table 6-3 and Table 6-4. The data rates and link speeds are described in Table 6-5 and Table 6-6.
Step 3
policy-map [type qos] [match-first] policy-map-name
Example:
switch(config)# policy-map policy1
switch(config-pmap-qos)#
Creates or accesses the policy-map named policy-map-name, and then enters policy-map mode. The policy-map name can contain alphabetic, hyphen, or underscore characters, is case sensitive, and can be up to 40 characters.
Step 4
class [type qos] {class-map-name | class-default} [insert-before before-class-map-name]
Example:
switch(config-pmap-qos)# class class1
switch(config-pmap-c-qos)#
Creates a reference to class-map-name and enters policy-map class configuration mode. The class is added to the end of the policy map unless insert-before is used to specify the class to insert before. Specify class-default to select all traffic that is currently not matched by classes in the policy map.
Step 5
police aggregate shared-policer-name
Example:
switch(config-pmap-c-qos)# police aggregate test1
switch(config-pmap-c-qos)#
Creates a reference in the policy map to shared-policer-name.
Step 6
exit
Example:
switch(config-pmap-c-qos)# exit
switch(config-pmap-qos)#
Exits policy-map class configuration mode and enters policy-map mode.
Step 7
exit
Example:
switch(config-pmap-qos)# exit
switch(config)#
Exits policy-map mode and enters configuration mode.
Step 8
show qos shared-policer [type] [shared-policer-name]
Example:
switch(config)# show qos shared-policer test1
(Optional) Displays information about the configuration of all shared policers.
Step 9
copy running-config startup-config
Example:
switch(config)# copy running-config startup-config
(Optional) Saves the running configuration to the startup configuration.
Use the show qos shared-policer command to display the test1 shared-policer configurations:
switch# show qos shared-policer test1Verifying the Policing Configuration
Use these command to verify the policing configuration.
show policy-map
Displays information about policy maps and policing.
show qos shared-policer [type qos] [policer-name]
Displays information about all shared policing.
Example Configurations
The following are examples of how to configure policing:
•
config tpolicy-map policy1class one_rate_2_color_policerpolice cir 256000 conform transmit violate drop•
config tpolicy-map policy2class one_rate_2_color_policer_with_dscp_markdownpolice cir 256000 conform transmit violate drop•
config tpolicy-map policy3class one_rate_3_color_policerpolice cir 256000 pir 256000 conform transmit exceed set dscp dscp table cir-markdown-map violate drop•
config tpolicy-map policy4class two_rate_3_color_policerpolice cir 256000 pir 256000 conform transmit exceed set dscp dscp table cir-markdown-map violate drop•
config tclass-map conform-color-inmatch dscp 0-10policy-map policy5class one_rate_2_color_policerpolice cir 256000 conform transmit violate drop•
config tqos shared-policer type qos udp_policer type cir 10 mbps pir 20 mbps conform transmit exceed set dscp dscp table cir-markdown-map violate droppolicy-may type qos udp_policyclass type qos udp_qospolice aggregate udp_1mbps
