Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Configure data plane policing for a Layer 3 interface by using the GUI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Create an ingress data plane policing (DPP) policy and apply it to a routed interface, switched virtual interface, or routed subinterface.

Before you begin

Create the tenant, VRF, external routed network, and logical node profile that contain the Layer 3 interface.

Create the DPP policy from the logical interface profile and configure the Layer 3 interface to which the policy applies.

Procedure

  1. In the Navigation pane, choose tenant-name > Networking > External Routed Network > network-name > Logical Node Profiles > logical-node-profile-name > Logical Interface Profiles .

  2. Right-click Logical Interface Profiles and choose Create Interface Profile .

  3. In the Create Interface Profile dialog box, enter a profile name in the Name field.

  4. Next to Ingress Data Plane Policing Policy , choose Create Data Plane Policing Policy .

  5. Configure the DPP policy.

    1. In the Name field, enter a policy name.
    2. For Administrative State , choose enabled .
    3. For Policer Mode , choose Bit Policer or Packet Policer .
    4. For Type , choose 1 Rate 2 Color or 2 Rate 3 Color .

      Switch models with names that end in -EX or -FX, such as the N9K-C93180YC-EX, and later switch models do not support 2 Rate 3 Color.

    5. Configure the policing actions and, when marking is selected, the class of service (CoS) and differentiated services code point (DSCP) values in the Conform and Violate fields.
    6. For Sharing Mode , choose the policer-sharing mode.

      Shared Policer applies the same policing parameters to multiple interfaces.

    7. Configure the traffic rate and burst values.

      • For 1 Rate 2 Color , configure Rate and Burst , and choose the appropriate units.

      • For 2 Rate 3 Color , also configure Peak Rate and Excessive Burst .

    8. Click Submit .

  6. Configure the required Layer 3 interface type.

    1. To configure a routed interface, expand Routed Interfaces and choose the interface in the Path field.
    2. For IPv4/IPv6 Preferred Address , enter the interface IP address and prefix length.
    3. Click OK .
    4. To configure a switched virtual interface (SVI), expand SVI and choose the interface in the Path field.
    5. For Encap , enter the VLAN encapsulation.
    6. For IPv4/IPv6 Preferred Address , enter the SVI IP address and prefix length.
    7. Click OK .
    8. To configure a routed subinterface, expand Routed Sub-Interfaces and configure the path, encapsulation, and preferred IP address.
    9. Click OK to create the logical interface profile.

The DPP policy is applied to the selected Layer 3 interface or subinterface.