Cisco APIC Security Configuration Guide, Release 6.2(x)

Guidelines and limitations for data plane policing

Updated: April 17, 2026

Want to summarize with AI?

Review the supported data plane policing modes, actions, statistics, platforms, and feature combinations.

Data plane policing (DPP) monitors traffic rates and applies configured actions to traffic on Cisco Application Centric Infrastructure (ACI) fabric interfaces.

General guidelines and limitations

The data plane policer does not police CPU-originated or CPU-bound packets on ACI fabric access interfaces.
The dedicated policer-sharing mode is supported only for EPG-level policers. It is not supported for physical, Layer 2, or Layer 3 interfaces.
Egress traffic policing is not supported on Fabric Extender (FEX) ports or with EPG-level policers.
EPG policing is supported on switch models with names that end in -EX or -FX and on later switch models. The N9K-C93180YC-EX is an example of a supported switch.
Two-rate, three-color (2R3C) policing is not supported.
DPP is not supported on an EPG that has intra-EPG isolation enforced.
In certain cases, packets longer than 2184 bytes might be dropped when they pass through devices that support Fibre Channel over Ethernet (FCoE).

Policer statistics

Statistics are available for each EPG member. These statistics are most useful when the DPP policy uses the dedicated sharing mode.
For a shared policer, the statistics include traffic from all ports on the leaf switch that use the policer.
Policer statistics are available in the GUI and through the REST API in the same manner as other Cisco ACI fabric statistics.
Use the statistics for allowed and dropped packets to identify configuration issues and excessive resource usage.

Supported policer modes

Egress policing supports bits-per-second (BPS) and packets-per-second (PPS) modes. PPS mode requires Cisco ACI Release 6.1(2) or later.
Egress PPS policing is supported on -FX switches and later switch models.
Ingress policing supports only BPS mode.
Policer statistics are available only for the currently configured mode. Changing the mode deletes all previously accumulated policer statistics.

Supported policing actions

The following actions are supported for conforming and violating traffic:


Direction	Conform actions	Violate actions
Ingress	Drop or Transmit	Drop or Mark and Transmit
Egress	Drop or Transmit	Drop

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.