Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Configure data plane policing by using the NX-OS-style CLI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Configure and verify data plane policing (DPP) policies for Layer 2 and Layer 3 interfaces by using the NX-OS-style CLI.

The following examples configure Layer 2 DPP on leaf switch 101 and Layer 3 DPP on leaf switch 102.

Note

The commands use example object names, interfaces, VLANs, and IP addresses. Replace these values with the values for your fabric.

Procedure

  1. Configure a Layer 2 port with two VLANs that map to the same EPG.

    Example:

    apic1# configure terminal
            apic1(config)# vlan-domain test
            apic1(config-vlan)# vlan 1000-2000
            apic1(config-vlan)# exit
            apic1(config)# leaf 101
            apic1(config-leaf)# interface ethernet 1/10
            apic1(config-leaf-if)# vlan-domain member test
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# exit
            apic1(config)# tenant test1
            apic1(config-tenant)# vrf context v1
            apic1(config-tenant-vrf)# exit
            apic1(config-tenant)# bridge-domain bd1
            apic1(config-tenant-bd)# vrf member v1
            apic1(config-tenant-bd)# exit
            apic1(config-tenant)# application ap1
            apic1(config-tenant-app)# epg e1
            apic1(config-tenant-app-epg)# bridge-domain member bd1
            apic1(config-tenant-app-epg)# exit
            apic1(config-tenant-app)# exit
            apic1(config-tenant)# exit
            apic1(config)# leaf 101
            apic1(config-leaf)# interface ethernet 1/10
            apic1(config-leaf-if)# switchport trunk allowed vlan 1001 tenant test1 application ap1 epg e1
            apic1(config-leaf-if)# switchport trunk allowed vlan 1501 tenant test1 application ap1 epg e1
            apic1(config-leaf-if)# end

    Ethernet interface 1/10 on leaf switch 101 carries VLANs 1001 and 1501. Both VLANs map to tenant test1, application profile ap1, and EPG e1.

  2. Create ingress and egress DPP policies and apply them to the Layer 2 interface.

    Example:

    apic1# configure terminal
            apic1(config)# policy-map type data-plane qosTest
            apic1(config-pmap-dpp)# set burst 2400 mega
            apic1(config-pmap-dpp)# set cir 78 mega
            apic1(config-pmap-dpp)# set sharing-mode shared
            apic1(config-pmap-dpp)# exit
            apic1(config)# leaf 101
            apic1(config-leaf)# interface ethernet 1/10
            apic1(config-leaf-if)# service-policy type data-plane input qosTest
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# exit
            apic1(config)# policy-map type data-plane qosTest2
            apic1(config-pmap-dpp)# set cir 78 mega
            apic1(config-pmap-dpp)# exit
            apic1(config)# leaf 101
            apic1(config-leaf)# interface ethernet 1/10
            apic1(config-leaf-if)# service-policy type data-plane output qosTest2
            apic1(config-leaf-if)# end

  3. Verify the Layer 2 DPP policy configuration.

    Example:

    apic1# show policy-map type data-plane infra

  4. Verify the Layer 2 running configuration.

    Example:

    apic1# show running-config policy-map
            apic1# show running-config leaf 101

  5. Configure the tenant, VRF, physical Layer 3 interface, routed subinterface, and switched virtual interface.

    Example:

    apic1# configure terminal
            apic1(config)# vlan-domain l3ports
            apic1(config-vlan)# vlan 3000-3001
            apic1(config-vlan)# exit
            apic1(config)# tenant l3test1
            apic1(config-tenant)# vrf context v1
            apic1(config-tenant-vrf)# exit
            apic1(config-tenant)# exit
            apic1(config)# leaf 102
            apic1(config-leaf)# vrf context tenant l3test1 vrf v1
            apic1(config-leaf-vrf)# exit
            apic1(config-leaf)# interface ethernet 1/20
            apic1(config-leaf-if)# no switchport
            apic1(config-leaf-if)# vlan-domain member l3ports
            apic1(config-leaf-if)# vrf member tenant l3test1 vrf v1
            apic1(config-leaf-if)# ip address 56.1.1.1/24
            apic1(config-leaf-if)# ipv6 address 2000::1/64 preferred
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# interface ethernet 1/21
            apic1(config-leaf-if)# vlan-domain member l3ports
            apic1(config-leaf-if)# no switchport
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# interface ethernet 1/21.3001
            apic1(config-leaf-if)# vrf member tenant l3test1 vrf v1
            apic1(config-leaf-if)# ip address 60.1.1.1/24
            apic1(config-leaf-if)# ipv6 address 2001::1/64 preferred
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# interface vlan 3000
            apic1(config-leaf-if)# vrf member tenant l3test1 vrf v1
            apic1(config-leaf-if)# ip address 70.1.1.1/24
            apic1(config-leaf-if)# ipv6 address 3000::1/64 preferred
            apic1(config-leaf-if)# end

  6. Create ingress and egress DPP policies in the tenant.

    Example:

    apic1# configure terminal
            apic1(config)# tenant l3test1
            apic1(config-tenant)# policy-map type data-plane iPol
            apic1(config-tenant-pmap-dpp)# set cir 56 mega
            apic1(config-tenant-pmap-dpp)# set burst 2000 kilo
            apic1(config-tenant-pmap-dpp)# exit
            apic1(config-tenant)# policy-map type data-plane ePol
            apic1(config-tenant-pmap-dpp)# set cir 56 mega
            apic1(config-tenant-pmap-dpp)# set burst 2000 kilo
            apic1(config-tenant-pmap-dpp)# exit
            apic1(config-tenant)# end

  7. Apply the ingress and egress DPP policies to the Layer 3 interfaces.

    Example:

    apic1# configure terminal
            apic1(config)# leaf 102
            apic1(config-leaf)# interface ethernet 1/20
            apic1(config-leaf-if)# service-policy type data-plane input iPol
            apic1(config-leaf-if)# service-policy type data-plane output ePol
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# interface ethernet 1/21.3001
            apic1(config-leaf-if)# service-policy type data-plane input iPol
            apic1(config-leaf-if)# service-policy type data-plane output ePol
            apic1(config-leaf-if)# exit
            apic1(config-leaf)# interface vlan 3000
            apic1(config-leaf-if)# service-policy type data-plane input iPol
            apic1(config-leaf-if)# service-policy type data-plane output ePol
            apic1(config-leaf-if)# end

  8. Verify the Layer 3 DPP policies.

    Example:

    apic1# show tenant l3test1 policy-map type data-plane

  9. Verify the Layer 3 running configuration.

    Example:

    apic1# show running-config tenant l3test1
            apic1# show running-config leaf 102

The ingress and egress DPP policies are applied to the configured Layer 2 and Layer 3 interfaces.