Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Data plane policing

Updated: April 17, 2026

Want to summarize with AI?

Log in

Data plane policing (DPP) controls ingress and egress bandwidth on Cisco ACI fabric access interfaces by marking or dropping traffic that exceeds configured rates.

DPP manages bandwidth consumption on Cisco Application Centric Infrastructure ( ACI ) fabric access interfaces.

  • DPP policies can apply to ingress traffic, egress traffic, or both.

  • DPP monitors the data rate on an interface and immediately marks or drops packets when traffic exceeds the configured rate.

  • Policing does not buffer traffic and therefore does not affect transmission delay.

Policer sharing

Before Release 3.2, policer-sharing behavior was implicit and depended on where the DPP policy was applied. A policy that was applied to an endpoint group (EPG) used a policer for each EPG member. Policer allocation for Layer 2 and Layer 3 interfaces followed per-interface behavior. The per-member behavior prevented multiple EPG members on the same leaf switch from sharing a policer and causing unwanted packet drops.

Beginning with Release 3.2, the sharing-mode setting explicitly controls policer allocation:

  • shared —All entities on a leaf switch that reference the same DPP policy share one hardware policer.

  • dedicated —The leaf switch allocates a separate hardware policer to each Layer 2 interface, Layer 3 interface, or EPG member.

Policer rates and packet colors

DPP policies can use single-rate or dual-rate policing and can be color-aware.

  • Single-rate policies monitor the committed information rate (CIR).

  • Dual-rate policies monitor the CIR and peak information rate (PIR).

  • Color-aware policies use a packet's existing color when determining the policing action.

The system also monitors the associated burst sizes. Based on the configured rate parameters, the policer assigns one of the following conditions to each packet:

  • Conform (green)

  • Exceed (yellow)

  • Violate (red)

Policy attachment and administration

DPP policies typically apply to physical or virtual Layer 2 connections for devices such as servers and hypervisors, and to Layer 3 connections for routers.

  • DPP policies for leaf switch access ports are configured in the fabric access ( infra ) portion of the Cisco ACI fabric. A fabric administrator must configure these policies.

  • DPP policies for interfaces on border leaf switch access ports ( l3extOut or l2extOut ) are configured in the tenant ( fvTenant ) portion of the Cisco ACI fabric. A tenant administrator can configure these policies.

You can also apply a DPP policy to an EPG. The policy limits traffic that enters the fabric from the EPG separately for each member access interface. This configuration prevents a single EPG from monopolizing access links that multiple EPGs share.

Policing actions

Configure only one action for each packet condition. For example, a DPP policy can specify a data rate of 256,000 bits per second with bursts of up to 200 milliseconds. The system applies the conform action to traffic that remains within the configured rate and the violate action to traffic that exceeds the rate.

Color-aware policies assume that packets were previously marked with a color. The policer uses the existing color when determining the action to apply.

Packets-per-second mode

Beginning with Cisco APIC Release 6.1(2), DPP supports packets-per-second (PPS) mode in addition to bits-per-second (BPS) mode.

For information about traffic storm control, see the Cisco APIC Layer 2 Networking Configuration Guide .