To configure QoS policies for an L3Out, use the following guidelines:
To configure the QoS policy to be enforced on the border leaf where the L3Out is
located, the VRF instance must be in egress mode (Policy Control Enforcement
Direction must be "Egress").
To enable the QoS policy to be enforced, the VRF Policy Control Enforcement Preference must be "Enforced."
When configuring the contract governing communication between the L3Out and other
EPGs, include the QoS class or target DSCP in the contract or subject.
Only configure a QoS class or target DSCP in the contract, not in the
external EPG (l3extInstP).
When creating a contract subject, you must choose a QoS priority level. You
cannot choose Unspecified.
Configuring QoS for L3Outs Using the REST API
QoS for L3Out is configured as part of the L3Out configuration.
When configuring the tenant, VRF, and bridge domain, configure the VRF for
egress mode (pcEnfDir="egress") with policy enforcement enabled
(pcEnfPref="enforced"). Send a post with XML similar to the following
When creating the filters and contracts to enable the EPGs participating in the
L3Out to communicate, configure the QoS priority.
The contract in this example includes the QoS priority,
level1, for traffic ingressing on the L3Out.
Alternatively, it could define a target DSCP value. QoS policies are
supported on either the contract or the subject.
The filter also has the matchDscp="EF"
criteria, so that traffic with this specific TAG received by the L3out
processes through the queue specified in the contract subject.
When creating filters (access-lists), include the
match dscp command, in this example with target DSCP
level EF. When configuring contracts, include the QoS class, for example,
level1, for traffic ingressing on the L3Out. Alternatively, it could
define a target DSCP value. QoS policies are supported on either the contract or
apic1(config)# tenant t1
apic1(config-tenant)# access-list http-filter
apic1(config-tenant-acl)# match ip
apic1(config-tenant-acl)# match tcp dest 80
apic1(config-tenant-acl)# match dscp EF
apic1(config-tenant)# contract httpCtrct
apic1(config-tenant-contract)# scope vrf
apic1(config-tenant-contract)# qos-class level1
apic1(config-tenant-contract)# subject http-subject
apic1(config-tenant-contract-subj)# access-group http-filter both
Configuring QoS for L3Outs Using the GUI
QoS for an L3Out is configured as part of the L3Out configuration.
Configure the VRF instance for the tenant consuming the L3Out to support QoS to
be enforced on the border leaf switch that is used by the L3Out.
On the menu bar, choose Tenants > tenant-name.
In the Navigation pane, expand
VRFs, and choose Create
Enter the name of the VRF.
In the Policy Control Enforcement Preference
field, choose Enforced.
In the Policy Control Enforcement Direction choose
Complete the VRF configuration according to the requirements for the
When configuring filters for contracts to enable communication between the EPGs
consuming the L3Out, include a QoS class or target DSCP to enforce the QoS
priority in traffic ingressing through the L3Out.
On the Navigation pane, under the tenant that that will consume the
L3Out, expand Contracts, right-click
Filters and choose Create
In the Name field, enter a filter name.
In the Entries field, click
+ to add a filter entry.
Add the Entry details, click Update and
Expand the previously created filter and click on a filter entry.
Set the Match DSCP field to the desired DSCP
level for the entry, for example, EF.
Add a contract.
Under Contracts, right-click
Standard and choose Create
Enter the name of the contract.
In the QoS Class field, choose the QoS priority
for the traffic governed by this contract. Alternatively, you can choose
a Target DSCP value.
Click the + icon on
Subjects to add a subject to the
Enter a name for the subject.
In the QoS Priority field, choose the desired priority level. You
cannot choose Unspecified.
Under Filter Chain, click the
+ icon on Filters and
choose the filter you previously created, from the drop down list.
On the Create Contract Subject dialog box, click