Use data plane policing (DPP) to manage bandwidth consumption on Cisco Application Centric
Infrastructure (ACI) fabric access interfaces. DPP policies can apply to egress traffic, ingress traffic, or both. DPP monitors the data rates
for a particular interface. When the data rate exceeds user-configured values, marking or dropping of packets occurs immediately.
Policing does not buffer the traffic; therefore, the transmission delay is not affected. When traffic exceeds the data rate,
the Cisco ACI fabric can either drop the packets or mark QoS fields in them.
Before the 3.2 release, the standard behavior for the policer was to be per-EPG member in the case of DPP policy being applied
to the EPG, while the same policer was allocated on the leaf switch for the Layer 2 and Layer 3 case. This distinction was
done because the DPP policer for Layer 2/Layer 3 case was assumed to be per-interface already, hence it was assumed different
interfaces might get different ones. While the per-EPG DPP policy was introduced, it was clear that on a given leaf switch,
several members could be present and therefore the policer it made sense to be per-member in order to avoid unwanted drops.
Starting with release 3.2, a clear semantic is given to the Data Plane Policer policy itself, as well as a new flag introducing
the sharing-mode setting as presented in the CLI. Essentially, there is no longer an implicit behavior, which is different
if the Data Plane Policer is applied to Layer 2/Layer 3 or to per-EPG case. Now the user has the control of the behavior.
If the sharing-mode is set to shared, then all the entities on the leaf switch referring to the same Data Plane Policer, will share the same hardware policer.
If the sharing-mode is set to dedicated then there would be a different HW policer allocated for each Layer 2 or Layer 3 or EPG member on the leaf switch. The policer
is then dedicated to the entity that needs to be policed.
DPP policies can be single-rate, dual-rate, and color-aware. Single-rate policies monitor the committed information rate (CIR)
of traffic. Dual-rate policers monitor both CIR and peak information rate (PIR) of traffic. In addition, the system monitors
associated burst sizes. Three colors, or conditions, are determined by the policer for each packet depending on the data rate
parameters supplied: conform (green), exceed (yellow), or violate (red).
Typically, DPP policies are applied to physical or virtual layer 2 connections for virtual or physical devices such as servers
or hypervisors, and on layer 3 connections for routers. DPP policies applied to leaf switch access ports are configured in
the fabric access (infra) portion of the Cisco ACI fabric, and must be configured by a fabric administrator. DPP policies applied to interfaces on border leaf switch access
ports (l3extOut or l2extOut) are configured in the tenant (fvTenant) portion of the Cisco ACI fabric, and can be configured by a tenant administrator.
The data plane policer can also be applied on an EPG so that traffic that enters the Cisco ACI fabric from a group of endpoints are limited per member access interface of the EPG. This is useful to prevent monopolization
of any single EPG where access links are shared by various EPGs.
Only one action can be configured for each condition. For example, a DPP policy can to conform to the data rate of 256000
bits per second, with up to 200 millisecond bursts. The system applies the conform action to traffic that falls within this
rate, and it would apply the violate action to traffic that exceeds this rate. Color-aware policies assume that traffic has
been previously marked with a color. This information is then used in the actions taken by this type of policer.
For information about traffic storm control, see the Cisco APIC Layer 2 Networking Configuration Guide.
Feedback