Downloads |
 Feedback
|
Table Of Contents
Policer Enhancement: Multiple Actions
Configuring Multiple Policer Actions
Verifying the Multiple Policer Actions Configuration
Monitoring and Maintaining the Multiple Policer Actions
Multiple Actions in a Two-Rate Policer Example
Verifying the Multiple Policer Actions Example
Policer Enhancement: Multiple Actions
First Published: 12.2(8)TLast Updated: February 28, 2006This document describes the Policer Enhancement: Multiple Actions feature. With both the Traffic Policing feature and the Two-Rate Policer feature, you can specify only one conform action, one exceed action, and one violate action. The Policer Enhancement: Multiple Actions feature allows you to specify multiple conform, exceed, and violate actions for the marked packets.
History for the Policer Enhancement: Multiple Actions Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Monitoring and Maintaining the Multiple Policer Actions
Feature Overview
This feature extends the functionality of the Cisco IOS Traffic Policing feature (a single-rate policer) and the Two-Rate Policer feature. The Traffic Policing and Two-Rate Policer features are traffic policing mechanisms that allow you to control the maximum rate of traffic sent or received on an interface. Both of these traffic policing mechanisms mark packets as either conforming to, exceeding, or violating a specified rate. After a packet is marked, you can specify an action to be taken on the packet based on that marking.
With both the Traffic Policing feature and the Two-Rate Policer feature, you can specify only one conform action, one exceed action, and one violate action. With the Policer Enhancement: Multiple Actions feature, you can specify multiple conform, exceed, and violate actions for the marked packets.
You specify the multiple actions by using the action argument of the police command. The resulting actions are listed in Table 1.
Table 1 Police Command Action Arguments
For more information about the police command and how to use it with the Policer Enhancement: Multiple Actions feature, see the Command Reference section of this document.
For more information about the Cisco IOS Traffic Policing feature, refer to the "Policing and Shaping" section of the Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.2. See also the the Two-Rate Policer feature in Release 12.0(26)S.
Benefits
Before this feature, you could specify only one marking action for a packet, in addition to transmitting the packet. This feature provides enhanced flexibility by allowing you to specify multiple marking actions for a packet, as required. For example, if you know the packet will be transmitted through both a TCP/IP and a Frame Relay environment, you can change the DSCP value of the exceeding or violating packet, and also set the Frame Relay Discard Eligibility (DE) bit from 0 to 1 to indicate lower priority.
Restrictions
•
•
•
•
•
•
–
–
–
Prerequisites
•
–
Specifically, the "Configuring Traffic Policing" chapter and the "Policing and Shaping Overview" chapter.
–
•
•
Configuration Tasks
See the following sections for configuration tasks for the Police Enhancement: Multiple Actions feature. Each task in the list is identified as either required or optional.
•
•
Configuring Multiple Policer Actions
To configure multiple policer actions, use the following commands beginning in global configuration mode:
Verifying the Multiple Policer Actions Configuration
To verify that the multiple policer actions have been configured on the interface, use the following command in EXEC or privileged EXEC mode:
Router# show policy-map interface
Displays statistics and configurations of all input and output policies attached to an interface.
Troubleshooting Tips
•
•
•
Monitoring and Maintaining the Multiple Policer Actions
To monitor and maintain the multiple policer actions, use the following EXEC or privileged EXEC mode commands, as needed:
Configuration Examples
This section provides the following configuration examples:
•
•
Multiple Actions in a Two-Rate Policer Example
In the following example, a policy map called police is configured to use a two-rate policer to police traffic leaving an interface. Two rates, a committed information rate (CIR) of 1 Mbps and a peak information rate (PIR) of 2 Mbps, have been specified.
Router(config)# policy-map policeRouter(config-pmap)# class class-defaultRouter(config-pmap-c)# police cir 1000000 pir 2000000Router(config-pmap-c-police)# conform-action transmitRouter(config-pmap-c-police)# exceed-action set-prec-transmit 4Router(config-pmap-c-police)# exceed-action set-frdeRouter(config-pmap-c-police)# violate-action set-prec-transmit 2Router(config-pmap-c-police)# violate-action set-frde-transmitRouter(config-pmap-c-police)# endThe following actions will be performed on packets associated with the policy map called police:
•
•
•
Verifying the Multiple Policer Actions Example
The following sample output of the show policy-map command displays the configuration for a service policy called police. In this service policy, multiple actions for packets marked as exceeding the specified CIR rate have been configured. For those packets, the IP Precedence level is set to 4, the DE bit is set to 1, and the packet is transmitted. Multiple actions for packets marked as violating the specified PIR rate have also been configured. For those packets, the IP Precedence level is set to 2, the DE bit is set to 1, and the packet is transmitted.
Router# show policy-map policePolicy Map policeClass class-defaultpolice cir 1000000 bc 31250 pir 2000000 be 31250conform-action transmitexceed-action set-prec-transmit 4exceed-action set-frde-transmitviolate-action set-prec-transmit 2violate-action set-frde-transmitAdditional References
The following sections provide references related to Policer Enhancement: Multiple Actions.
Related Documents
Quality of Service
Cisco IOS Quality of Service Solutions Command Reference, Release 12.3
Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.3
Modular Quality of Service
Traffic Policing
Standards
MIBs
RFCs
Technical Assistance
Command Reference
This section documents modified commands only.
police
To configure traffic policing, use the police command in policy-map class configuration mode or policy-map class police configuration mode. To remove traffic policing from the configuration, use the no form of this command.
police bps [burst-normal] [burst-max] conform-action action exceed-action action [violate-action action]
no police bps [burst-normal] [burst-max] conform-action action exceed-action action [violate-action action]
Syntax Description
Defaults
Disabled
Command Modes
Policy-map class configuration (when specifying a single action to be applied to a marked packet)
Policy-map class police configuration (when specifying multiple actions to be applied to a marked packet)
Command History
Usage Guidelines
Use the police command to mark a packet with different quality of service (QoS) values based on conformance to the service-level agreement.
Traffic policing will not be executed for traffic that passes through an interface.
Specifying Multiple Actions
The police command allows you to specify multiple policing actions. When specifying multiple policing actions when configuring the police command, note the following points:
•
•
Using the police Command with the Traffic Policing Feature
The police command can be used with the Traffic Policing feature. The Traffic Policing feature works with a token bucket algorithm. Two types of token bucket algorithms are in Cisco IOS Release 12.1(5)T: a single-token bucket algorithm and a two-token bucket algorithm. A single-token bucket system is used when the violate-action option is not specified, and a two-token bucket system is used when the violate-action option is specified.
The token bucket algorithm for the police command that was introduced in Cisco IOS Release 12.0(5)XE is different from the token bucket algorithm for the police command introduced in Cisco IOS Release 12.1(5)T. For information on the token bucket algorithm introduced in Release 12.0(5)XE, refer to the Traffic Policing document for Release 12.0(5)XE. This document is available on the New Features for 12.0(5)XE feature documentation index (under Modular QoS CLI-related feature modules) at www.cisco.com.
The following are explanations of how the token bucket algorithms introduced in Cisco IOS Release 12.1(5)T work.
Token Bucket Algorithm with One Token Bucket
The one token bucket algorithm is used when the violate-action option is not specified in the police command command-line interface (CLI).
The conform bucket is initially set to the full size (the full size is the number of bytes specified as the normal burst size).
When a packet of a given size (for example, "B" bytes) arrives at specific time (time "T") the following actions occur:
•
(time between packets <which is equal to T - T1> * policer rate)/8 bytes
•
•
Token Bucket Algorithm with Two Token Buckets
The two-token bucket algorithm is used when the violate-action option is specified in the police command CLI.
The conform bucket is initially full (the full size is the number of bytes specified as the normal burst size).
The exceed bucket is initially full (the full exceed bucket size is the number of bytes specified in the maximum burst size).
The tokens for both the conform and exceed token buckets are updated based on the token arrival rate, or committed information rate (CIR).
When a packet of given size (for example, "B" bytes) arrives at specific time (time "T") the following actions occur:
•
The token arrival rate is calculated as follows:
(time between packets <which is equal to T-T1> * policer rate)/8 bytes
•
•
•
Examples
Token Bucket Algorithm with One Token Bucket Example
The token bucket algorithm for the police command that was introduced in Cisco IOS Release 12.0(5)XE is different from the token bucket algorithms introduced in Cisco IOS Release 12.1(5)T. The following example is for the token bucket algorithm with one token bucket introduced in Cisco IOS Release 12.1(5)T.
If the violate-action option is not specified when you configure a policy with the police command in Cisco IOS Release 12.1(5)T onward, the token bucket algorithm uses one token bucket. If the violate-action option is specified, the token bucket algorithm uses two token buckets. In the following example, the violate-action option is not specified, so the token bucket algorithm only uses one token bucket.
The following configuration shows users how to define a traffic class (using the class-map command) and associate the match criteria from the traffic class with the traffic policing configuration, which is configured in the service policy (using the policy-map command). The service-policy command is then used to attach this service policy to the interface.
In this particular example, traffic policing is configured with the average rate at 8000 bits per second and the normal burst size at 1000 bytes for all packets leaving Fast Ethernet interface 0/0:
Router(config)# class-map access-matchRouter(config-cmap)# match access-group 1Router(config-cmap)# exitRouter(config)# policy-map police-settingRouter(config-pmap)# class access-matchRouter(config-pmap-c)# police 8000 1000 conform-action transmit exceed-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy output police-settingThe treatment of a series of packets leaving Fast Ethernet interface 0/0 depends on the size of the packet and the number of bytes remaining in the conform bucket. These packets are policed based on the following rules:
•
(time between packets <which is equal to T - T1> * policer rate)/8 bytes
•
•
In this example, the initial token buckets starts full at 1000 bytes. If a 450-byte packet arrives, the packet conforms because enough bytes are available in the conform token bucket. The conform action (send) is taken by the packet and 450 bytes are removed from the conform token bucket (leaving 550 bytes).
If the next packet arrives 0.25 seconds later, 250 bytes are added to the token bucket ((0.25 * 8000)/8), leaving 800 bytes in the token bucket. If the next packet is 900 bytes, the packet exceeds and the exceed action (drop) is taken. No bytes are taken from the token bucket.
Token Bucket Algorithm with Two Token Buckets Example
If the violate-action option is specified when you configure a policy with the police command in Cisco IOS Release 12.1(5)T onward, the token bucket algorithm uses two token buckets. The following example uses the token bucket algorithm with two token buckets.
The following configuration shows users how to define a traffic class (using the class-map command) and associate the match criteria from the traffic class with the traffic policing configuration, which is configured in the service policy (using the policy-map command). The service-policy command is then used to attach this service policy to the interface.
In this particular example, traffic policing is configured with the average rate at 8000 bits per second, the normal burst size at 1000 bytes, and the excess burst size at 1000 bytes for all packets leaving Fast Ethernet interface 0/0.
Router(config)# class-map access-matchRouter(config-cmap)# match access-group 1Router(config-cmap)# exitRouter(config)# policy-map police-settingRouter(config-pmap)# class access-matchRouter(config-pmap-c)# police 8000 1000 1000 conform-action transmit exceed-action set-qos-transmit 1 violate-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy output police-settingThe treatment of a series of packets leaving Fast Ethernet interface 0/0 depends on the size of the packet and the number of bytes remaining in the conform and exceed token buckets. The series of packets are policed based on the following rules:
•
(time between packets <which is equal to T - T1> * policer rate)/8 bytes
•
•
•
In this example, the initial token buckets starts full at 1000 bytes. If a 450-byte packet arrives, the packet conforms because enough bytes are available in the conform token bucket. The conform action (send) is taken by the packet and 450 bytes are removed from the conform token bucket (leaving 550 bytes).
If the next packet arrives 0.25 seconds later, 250 bytes are added to the conform token bucket
((0.25 * 8000)/8), leaving 800 bytes in the conform token bucket. If the next packet is 900 bytes, the packet does not conform because only 800 bytes are available in the conform token bucket.The exceed token bucket, which starts full at 1000 bytes (as specified by the excess burst size) is then checked for available bytes. Because enough bytes are available in the exceed token bucket, the exceed action (set the QoS transmit value of 1) is taken and 900 bytes are taken from the exceed bucket (leaving 100 bytes in the exceed token bucket.
If the next packet arrives 0.40 seconds later, 400 bytes are added to the token buckets ((.40 * 8000)/8). Therefore, the conform token bucket now has 1000 bytes (the maximum number of tokens available in the conform bucket) and 200 bytes overflow the conform token bucket (because it only 200 bytes were needed to fill the conform token bucket to capacity). These overflow bytes are placed in the exceed token bucket, giving the exceed token bucket 300 bytes.
If the arriving packet is 1000 bytes, the packet conforms because enough bytes are available in the conform token bucket. The conform action (transmit) is taken by the packet, and 1000 bytes are removed from the conform token bucket (leaving 0 bytes).
If the next packet arrives 0.20 seconds later, 200 bytes are added to the token bucket ((.20 * 8000)/8). Therefore, the conform bucket now has 200 bytes. If the arriving packet is 400 bytes, the packet does not conform because only 200 bytes are available in the conform bucket. Similarly, the packet does not exceed because only 300 bytes are available in the exceed bucket. Therefore, the packet violates and the violate action (drop) is taken.
Conforming to the MPLS EXP Value Example
The following example shows that if packets conform to the rate limit, the MPLS EXP field is set to 5. If packets exceed the rate limit, the MPLS EXP field is set to 3.
policy-map input-IP-dscpclass dscp24police 8000 1500 1000conform-action set-mpls-experimental-imposition-transmit 5exceed-action set-mpls-experimental-imposition-transmit 3violate-action dropRelated Commands
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2003-2006 Cisco Systems, Inc. All rights reserved.
