Cisco APIC Security Configuration Guide, Release 6.2(x)

Data plane policing at the endpoint group level

Updated: April 17, 2026

Want to summarize with AI?

Data plane policing (DPP) limits traffic from endpoint group (EPG) members on each leaf switch where the EPG is deployed.

EPG-level DPP applies a data plane policer policy to the members of an EPG.

The policer is enforced on every leaf switch where the EPG is deployed.
The sharing mode determines whether each EPG member uses a dedicated policer or eligible members share a hardware policer.
Policing is enforced independently on each leaf switch.

Policer sharing behavior

Before Cisco Application Policy Infrastructure Controller (APIC) Release 3.2(1), each EPG member used a separate policer.

Beginning with Cisco APIC Release 3.2(1), the sharing-mode property of the data plane policer determines the behavior:

In dedicated mode, each EPG member uses an independent hardware policer.
In shared mode, members in the same slice that use the same data plane policer policy share a hardware policer on the leaf switch.

Dedicated-mode example

Consider an EPG with the following members:

Leaf 101, Eth1/1 , VLAN 300
Leaf 101, Eth1/2 , VLAN 301
Leaf 102, Eth1/2 , VLAN 500

Assume that Policer-A, which has a rate of 100 Mbps, is applied to EPG1 in dedicated mode. The resulting policing behavior is as follows:

On Leaf 101, traffic through Eth1/1 on VLAN 300 and traffic through Eth1/2 on VLAN 301 are each limited to 100 Mbps.
On Leaf 102, traffic through Eth1/2 on VLAN 500 is independently limited to 100 Mbps.

EPG1 can therefore transmit up to a combined total of 300 Mbps across the three members.

Shared-mode example

Assume that Policer-A, which has a rate of 100 Mbps, is applied to EPG1 and EPG2 in shared mode. When the relevant interfaces are in the same slice, the resulting policing behavior is as follows:

On Leaf 101, EPG1 and EPG2 share a total rate of 100 Mbps.
On Leaf 102, EPG1 and EPG2 share a separate total rate of 100 Mbps.

EPG1 and EPG2 can therefore transmit up to a combined total of 200 Mbps across the two leaf switches.

Guidelines and limitations

The following guidelines and limitations apply to EPG-level DPP:

EPG-level policing is supported on switch models whose product IDs have an -EX, -FX, or later suffix.
Egress traffic policing is not supported.
Packets-per-second (PPS) policing mode is not supported.
Two-rate, three-color (2R3C) policing is not supported.
EPG-level policing is not supported when intra-EPG isolation is enforced on the EPG.
A maximum of 128 EPG policers is supported per node.

Configure data plane policing at the endpoint group level by using the NX-OS-style CLI

This example creates a data plane policer policy named pol1 in tenant test1 and applies it to EPG e1.

Procedure

Define the policer:

Example:

apic1# conf t
apic1(config)# vlan-domain test
apic1(config-vlan)# vlan 1000-2000
apic1(config-vlan)# exit
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/10
apic1(config-leaf-if)# vlan-domain member test
apic1(config-leaf-if)# exit
apic1(config-leaf)# exit
apic1(config)# tenant test1
apic1(config-tenant)# vrf context v1
apic1(config-tenant-vrf)# exit
apic1(config-tenant)# bridge-domain bd1
apic1(config-tenant-bd)# vrf member v1
apic1(config-tenant-bd)# exit
apic1(config)# policy-map type data-plane pol1
apic1(config-pmap-dpp)# set burst 2400 mega
apic1(config-pmap-dpp)# set cir 78 mega
apic1(config-pmap-dpp)# exit
apic1(config-tenant)# application ap1
apic1(config-tenant-app)# epg e1
apic1(config-tenant-app-epg)# bridge-domain member db1
apic1(config-tenant-app-epg)# service-policy type data-plane poll
apic1(config-tenant-app-epg)# exit
apic1(config-tenant-app)# exit
apic1(config-tenant)# exit
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/10
apic1(config-leaf-if)# switchport trunk allowed vlan 1001 tenant test1 application ap1 epg e1
apic1(config-leaf-if)# exit
apic1(config-leaf)# exit

The data plane policer policy is applied to EPG e1 on the configured leaf switch interface.

Configure data plane policing for an endpoint group by using the APIC GUI

EPG-level data plane policing supports bit-based, single-rate, two-color policing. Packets-per-second policing and two-rate, three-color policing are not supported at the EPG level.

Procedure

On the menu bar, choose Tenants > tenant_name .
In the Navigation pane, choose Policies > Protocol > Data Plane Policing .
Right-click Data Plane Policing and choose Create Data Plane Policing Policy .

The Create Data Plane Policing Policy dialog box opens.
In the Name field, enter a name for the policy.
In the Administrative State field, choose Enabled .
For Policer Mode , choose Bit Policer .

Packet Policer is not supported for an EPG-level policer.
For Type , choose 1 Rate 2 Color .
For Conform Action , choose Drop , Mark , or Transmit .
Configure the action for traffic that violates the configured rate.
If you selected Mark for an action, configure the applicable class of service (CoS) or differentiated services code point (DSCP) value in the Conform or Violate field.
Enter the required values in the Burst , Excessive Burst , and Rate fields, and choose the applicable unit for each value.
The available units are:
- Bytes/Packets
- Kilo Bytes/Packets
- Mega Bytes/Packets
- Giga Bytes/Packets
- Milli Seconds
- Micro Seconds
Click Submit .

The data plane policer policy is created in the tenant.

What to do next

Apply the data plane policer policy to the required EPG.

REST API configuration for data plane policing at the endpoint group level

Use the REST API payload in this example to police traffic that enters a leaf switch from an EPG.

XML payload

The payload creates data plane policer policy gmeo in tenant t1 and applies it to EPG ep1 in application profile ap1.

<!-- api/node/mo/.xml -->
        <polUni>
        <fvTenant name="t1">
        <qosDppPol name="gmeo" burst="2000" rate="2000"/>
        <fvAp name="ap1">
        <fvAEPg name="ep1">
        <fvRsDppPol tnQosDppPolName="gmeo"/>
        </fvAEPg>
        </fvAp>
        </fvTenant>
        </polUni>

View endpoint group data plane policer statistics by using the GUI

EPG-level DPP statistics are reported for each EPG member. Use these statistics to determine whether the policer is dropping a significant amount of traffic.

Procedure

On the menu bar, choose Tenants > tenant_name .
In the Navigation pane, choose Application Profiles > application_profile_name > Application EPGs > epg_name > EPG Members > Static EPG Members .
Select the node for which you want to view the policer statistics.
Click Select Stats .

The Select Stats dialog box opens.
1. From the Sampling Interval field, choose a sampling interval.
2. From the Available list, select up to two policer attributes and use the arrows to move them to the selected attributes list.
3. Click Submit .

The GUI displays a graphical representation of the selected DPP statistics.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.