-
Cisco IOS Quality of Service Solutions Command Reference, Release 12.2
-
About Cisco IOS Software Documentation
-
Using Cisco IOS Software
-
Commands: access-list rate-limit -- fair-queue (WFQ)
-
Commands: fair-queue aggregate-limit -- ip nbar pdlm
-
Commands: ip nbar port-map -- ip rsvp reservation
-
Commands: ip rsvp reservation-host -- match ip dscp
-
Commands: match ip precedence -- police
-
Commands: policy-map -- qos pre-classify
-
Commands: queue-limit -- random-detect precedence
-
Commands: rate-limit -- set qos-group
-
Commands: shape -- show ip nbar pdlm
-
Commands: show ip nbar port-map -- show qdm status
-
Commands: show queue -- vc-hold-queue
-
Feedback
Table Of Contents
match ip precedence
To identify IP precedence values as match criteria, use the match ip precedence command in class-map configuration mode. To remove IP precedence values from a class map, use the no form of this command.
match ip precedence ip-precedence-value [ip-precedence-value ip-precedence-value ip-precedence-value]
no match ip precedence ip-precedence value [ip-precedence-value ip-precedence-value ip-precedence-value]
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
12.0(5)XE
This command was introduced.
12.1(5)T
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
Up to four precedence values can be matched in one match statement. For example, if you wanted the IP precedence values of 0, 1, 2, or 3 (note that only one of the IP precedence values must be a successful match criterion, not all of the specified IP precedence values), enter the match ip precedence 0 1 2 3 command.
The ip-precedence-value arguments are used as markings only. The IP precedence values have no mathematical significance. For instance, the ip-precedence-value of 2 is not greater than 1. The value simply indicates that a packet marked with the ip-precedence-value of 2 is different than a packet marked with the ip-precedence-value of 1. The treatment of these different packets is defined by the user through the setting of QoS policies in policy-map class configuration mode.
Examples
The following example shows how to configure the service policy called priority50 and attach service policy priority50 to an interface. In this example, the class map called ipprec5 will evaluate all packets entering Fast Ethernet interface 1/0/0 for an IP precedence value of 5. If the incoming packet has been marked with the IP precedence value of 5, the packet will be treated with a priority level of 50.
Router(config)# class-map ipprec5Router(config-cmap)# match ip precedence 5Router(config)# exitRouter(config)# policy-map priority50Router(config-pmap)# class ipprec5Router(config-pmap-c)# priority 50Router(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fa1/0/0Router(config-if)# service-policy input priority50Related Commands
match ip rtp
To configure a class map to use the Real-Time Protocol (RTP) protocol port as the match criterion, use the match ip rtp class-map configuration command. To remove the RTP protocol port match criterion, use the no form of this command.
match ip rtp starting-port-number port-range
no match ip rtp
Syntax Description
starting-port-number
The starting RTP port number. Values range from 2000 to 65535.
port-range
The RTP port number range. Values range from 0 to 16383.
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
Usage Guidelines
This command is used to match IP RTP packets that fall within the specified port range. It matches packets destined to all even User Datagram Port (UDP) port numbers in the range <starting port range> <starting port range + port range>.
Use of an RTP port range as the match criterion is particularly effective for applications that use RTP, such as voice or video.
Examples
The following example specifies a class map called eth1 and configures the RTP port number 2024 and range 1000 to be used as the match criteria for this class:
class-map eth1match ip rtp 2024 1000Related Commands
match mpls experimental
To configure a class map to use the specified value of the EXP field as a match criterion, use the match mpls experimental class-map configuration command. To remove the EXP field match criterion from a class map, use the no form of this command.
match mpls experimental number
no match mpls experimental number
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
Usage Guidelines
For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria including input interfaces, access control lists (ACLs), protocols, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
The match mpls experimental command specifies the name of an EXP field value to be used as the match criterion against which packets are checked to determine if they belong to the class specified by the class map.
To use the match mpls experimental command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:
•
match access-group
•
•
•
If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.
Examples
The following example specifies a class map called eth1 and configures the EXP field value 0 to be used as the match criterion for this class:
class-map eth1match mpls experimental 1Related Commands
match not
To specify the single match criterion value to use as an unsuccessful match criterion, use the match not class-map configuration command. To remove a previously specified source value to not use as a match criterion, use the no form of this command.
match not match-criteria
no match not match-criteria
Syntax Description
match-criteria
(Required) Specifies the match criterion value that is an unsuccessful match criterion. All other values of the specified match criterion will be considered successful match criteria.
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
12.0(5)XE
This command was introduced.
12.0(5)T
This command was integrated into Cisco IOS Release 12.0(5)T.
12.1(1)E
This command was integrated into Cisco IOS Release 12.1(1)E.
Usage Guidelines
The match not command is used to specify a QoS policy value that is not used as a match criterion. When the match not command is used, all other values of that QoS policy become successful match criteria.
For instance, if the match not qos-group 4 command is issued in class-map configuration mode, the specified class will accept all QoS group values except 4 as successful match criteria.
Examples
In the following traffic class, all protocols except IP are considered successful match criteria:
Router(config)# class-map noipRouter(config-cmap)# match not protocol ipRouter(config-cmap)# exitRelated Commands
class-map
Creates a class map to be used for matching packets to a specified class.
match protocol
To configure the match criteria for a class map on the basis of the specified protocol, use the match protocol class-map configuration command. To remove protocol-based match criteria from a class map, use the no form of this command.
match protocol protocol-name
no match protocol protocol-name
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
Usage Guidelines
For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria including protocols, access control lists (ACLs), input interfaces, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.
The match protocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.
To use the match protocol command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:
•
•
•
•
If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.
This command can be used to match protocols that are known to the Network-Based Application Recognition (NBAR) feature. For a list of protocols currently supported by NBAR, see the "Classification" section of the Cisco IOS Quality of Service Solutions Configuration Guide.
Examples
The following example specifies a class map called ipx and configures the Internetwork Packet
Exchange (IPX) protocol as a match criterion for it:class-map ipxmatch protocol ipxThe following example configures NBAR to match File Transfer Protocol (FTP) traffic:
match protocol ftpRelated Commands
match protocol citrix
To configure Network-Based Application Recognition (NBAR) to match Citrix traffic, use the match protocol citrix class-map configuration command. To disable NBAR from matching Citrix traffic, use the no form of this command.
match protocol citrix [app application-name-string]
no match protocol citrix [app application-name-string]
Syntax Description
app
(Optional) Specifies matching of an application name string.
application-name-string
(Optional) Specifies string to be used as the subprotocol parameter.
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
12.1(2)E
This command was introduced.
12.1(5)T
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
Entering the match protocol citrix command without the app keyword establishes all Citrix traffic as successful match criteria.
Examples
The following example configures NBAR to match all Citrix traffic:
match protocol citrixThe following example configures NBAR to match Citrix traffic with the application name of packet1:
match protocol citrix app packet1match protocol http
To configure Network-Based Application Recognition (NBAR) to match Hypertext Transfer Protocol (HTTP) traffic by URL, HOST, or Multipurpose Internet Mail Extension (MIME)-type, use the match protocol http class-map configuration command. To disable NBAR from matching HTTP traffic by URL, HOST, or MIME-type, use the no form of this command.
match protocol http [url url-string | host hostname-string | mime MIME-type]
no match protocol http [url url-string | host hostname-string | mime MIME-type]
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
Usage Guidelines
When matching by MIME-type, the MIME-type can contain any user-specified text string. Refer to the the Internet Assigned Numbers Authority (IANA) web page (www.iana.com) for a list of the IANA-registered MIME types.
When matching by MIME-type is performed, NBAR matches a packet containing the MIME-type and all subsequent packets until the next HTTP transaction.
When matching by HOST is performed, NBAR performs a regular expression match on the host field contents inside an HTTP GET packet and classifies all packets from that host.
When matching by URL is performed, NBAR recognizes the HTTP GET packets containing the URL, and then matches all packets that are part of the HTTP GET request. When specifying a URL for classification, include only the portion of the URL following www.hostname.domain in the match statement. For example, in the URL www.anydomain.com/latest/whatsnew.html, include only /latest/whatsnew.html.
To match the www.anydomain.com portion, use the host name matching feature. The URL or host specification strings can take the form of a regular expression with options shown in Table 8.
Examples
The following example classifies, within the class map called class1, HTTP packets based on any URL containing the string whatsnew/latest followed by zero or more characters:
class-map class1match protocol http url whatsnew/latest*The following example classifies, within the class map called class2, packets based on any host name containing the string cisco followed by zero or more characters:
class-map class2match protocol http host cisco*The following example classifies, within the class map called class3, packets based on the Joint Photographics Expert Group (JPEG) MIME type:
class-map class3match protocol http mime "*jpeg"match qos-group
To identify a specific QoS group value as a match criterion, use the match qos-group command in class-map configuration mode. To remove a specific QoS group value from a class map, use the no form of this command.
match qos-group qos-group-value
no match qos-group qos-group-value
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
12.0(5)XE
This command was introduced.
12.0(9)S
This command was integrated into Cisco IOS Release 12.0(9)S.
Usage Guidelines
This command is used by the class map to identify a specific QoS group value marking on a packet.
The qos-group-value arguments are used as markings only. The QoS group values have no mathematical significance. For instance, the qos-group-value of 2 is not greater than 1. The value simply indicates that a packet marked with the qos-group-value of 2 is different than a packet marked with the qos-group-value of 1. The treatment of these packets is defined by the user through the setting of QoS policies in policy-map class configuration mode.
The QoS group value is local to the router, meaning that the QoS group value that is marked on a packet does not leave the router when the packet leaves the router. If you need a marking that resides in the packet, use IP precedence setting, IP Differentiated Services Code Point (DSCP) setting, or another method of packet marking.
Examples
The following example shows how to configure the service policy called priority50 and attach service policy priority50 to an interface. In this example, the class map called qosgroup5 will evaluate all packets entering Fast Ethernet interface 1/0/0 for a QoS group value of 5. If the incoming packet has been marked with the QoS group value of 5, the packet will be treated with a priority level of 50.
Router(config)# class-map qosgroup5Router(config-cmap)# match qos-group 5Router(config)# exitRouter(config)# policy-map priority50Router(config-pmap)# class qosgroup5Router(config-pmap-c)# priority 50Router(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fa1/0/0Router(config-if)# service-policy output priority50Related Commands
match source-address mac
To use the source MAC address as a match criterion, use the match source-address mac class-map configuration command. To remove a previously specified source MAC address as a match criterion in class map configuration mode, use the no form of this command.
match source-address mac address-destination
no match source-address mac address-destination
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
Class-map configuration
Command History
12.0(5)XE
This command was introduced.
12.1(1)E
This command was integrated into Cisco IOS Release 12.1(1)E.
12.1(5)T
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
This command can be used only on an input interface with a MAC address. These interfaces include Fast Ethernet and Ethernet interfaces.
This command cannot be used on output interfaces with no MAC address, such as serial and ATM interfaces.
Examples
The following example uses the mac address mac 0.0.0 as a match criterion:
class-map matchsrcmac match source-address mac 0.0.0Related Commands
class-map
Creates a class map to be used for matching packets to a specified class.
max-reserved-bandwidth
To change the percent of interface bandwidth allocated for Resource Reservation Protocol (RSVP), class-based weighted fair queueing (CBWFQ), low latency queueing (LLQ), IP RTP Priority, Frame Relay IP RTP Priority, and Frame Relay PVC Interface Priority Queueing (PIPQ), use the max-reserved bandwidth interface configuration command. To restore the default value, use the no form of this command.
max-reserved-bandwidth percent
no max-reserved-bandwidth
Syntax Description
percent
Percent of interface bandwidth allocated for RSVP, CBWFQ, LLQ, IP RTP Priority, Frame Relay IP RTP Priority, and Frame Relay PIPQ.
Defaults
75 percent
Command Modes
Interface configuration
Command History
Usage Guidelines
The sum of all bandwidth allocation on an interface should not exceed 75 percent of the available bandwidth on an interface. The remaining 25 percent of bandwidth is used for overhead, including Layer 2 overhead, control traffic, and best-effort traffic.
If you need to allocate more than 75 percent for RSVP, CBWFQ, LLQ, IP RTP Priority, Frame Relay IP RTP Priority, and Frame Relay PIPQ, you can use the max-reserved-bandwidth command. The percent argument specifies the maximum percentage of the total interface bandwidth that can be used.
If you do use the max-reserved-bandwidth command, make sure that not too much bandwidth is taken away from best-effort and control traffic.
The max-reserved-bandwidth command is intended for use on main interfaces only; it has no effect on virtual circuits (VCs) or ATM permanent virtual circuits (PVCs).
Examples
In the following example, the policy map called policy1 is configured for three classes with a total of 8 Mbps configured bandwidth, as shown in the output from the show policy-map command:
Router# show policy-map policy1Policy Map policy1Weighted Fair QueueingClass class1Bandwidth 2500 (kbps) Max Threshold 64 (packets)Class class2Bandwidth 2500 (kbps) Max Threshold 64 (packets)Class class3Bandwidth 3000 (kbps) Max Threshold 64 (packets)When you enter the service-policy command in an attempt to attach the policy map on a 10-Mbps Ethernet interface, an error message such as the following is produced:
I/f Ethernet1/1 class class3 requested bandwidth 3000 (kbps) Available only 2500 (kbps)The error message is produced because the default maximum configurable bandwidth is 75 percent of the available interface bandwidth, which in this example is 7.5 Mbps. To change the maximum configurable bandwidth to 80 percent, use the max-reserved-bandwidth command in interface configuration mode, as follows:
max-reserved-bandwidth 80service output policy1endTo verify that the policy map was attached, enter the show policy-map interface command:
Router# show policy-map interface e1/1Ethernet1/1 output :policy1Weighted Fair QueueingClass class1Output Queue:Conversation 265Bandwidth 2500 (kbps) Packets Matched 0 Max Threshold 64 (packets)(discards/tail drops) 0/0Class class2Output Queue:Conversation 266Bandwidth 2500 (kbps) Packets Matched 0 Max Threshold 64 (packets)(discards/tail drops) 0/0Class class3Output Queue:Conversation 267Bandwidth 3000 (kbps) Packets Matched 0 Max Threshold 64 (packets)(discards/tail drops) 0/0Virtual Template Configuration Example
The following example configures a strict priority queue in a virtual template configuration with CBWFQ. The max-reserved-bandwidth command changes the maximum bandwidth allocated between CBWFQ and IP RTP Priority from the default (75 percent) to 80 percent.
multilink virtual-template 1interface virtual-template 1ip address 172.16.1.1 255.255.255.0no ip directed-broadcastip rtp priority 16384 16383 25service-policy output policy1ppp multilinkppp multilink fragment-delay 20ppp multilink interleavemax-reserved-bandwidth 80endinterface Serial0/1bandwidth 64ip address 10.1.1.2 255.255.255.0no ip directed-broadcastencapsulation pppppp multilinkend
Note
Related Commands
oam-bundle
To enable end-to-end F5 Operation, Administration, and Maintenance (OAM) loopback cell generation and OAM management for a virtual circuit (VC) class that can be applied to a VC bundle, use the oam-bundle vc-class configuration command. To remove OAM management from the class configuration, use the no form of this command.
To enable end-to-end F5 OAM loopback cell generation and OAM management for all VC members of a bundle, use the oam-bundle bundle configuration command. To remove OAM management from the bundle, use the no form of this command.
oam-bundle [manage] [frequency]
no oam-bundle [manage] [frequency]
Syntax Description
Defaults
End-to-end F5 OAM loopback cell generation and OAM management are disabled, but if OAM cells are received, they are looped back. The default value for the frequency argument is 10 seconds.
Command Modes
VC-class configuration (for a VC class)
Bundle configuration (for an ATM VC bundle)
Command History
Usage Guidelines
This command defines whether a VC bundle is OAM-managed. If this command is configured for a bundle, every VC member of the bundle is OAM-managed. If OAM management is enabled, further control of OAM management is configured using the oam retry command.
This command has no effect if the VC class that contains the command is attached to a standalone VC, that is, if the VC is not a bundle member. In this case, the attributes are ignored by the VC.
To use this command in bundle configuration mode, enter the bundle subinterface configuration command to create the bundle or to specify an existing bundle before you enter this command.
To use this command in vc-class configuration mode, first enter the vc-class atm global configuration command.
VCs in a VC bundle are subject to the following configuration inheritance rules (listed in order of next highest precedence):
•
•
Examples
The following example enables OAM management for a bundle called chicago:
bundle chicago oam-bundle manageRelated Commands
police
To configure the Traffic Policing feature, use the police QoS policy-map class configuration command. To remove the Traffic Policing feature from the configuration, use the no form of this command.
police bps burst-normal burst-max conform-action action exceed-action action [violate-action action]
no police bps burst-normal burst-max conform-action action exceed-action action [violate-action action]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
QoS policy-map class configuration
Command History
Usage Guidelines
The violate-action option is not available in Cisco IOS Release 12.0 XE or Release 12.1 E. The violate-action option is not available with the rate-limit command.
The Traffic Policing feature works with a token bucket algorithm. Two types of token bucket algorithms are in Cisco IOS Release 12.1(5)T: a single-token bucket algorithm and a two-token bucket algorithm. A single-token bucket system is used when the violate-action option is not specified, and a two-token bucket system is used when the violate-action option is specified.
The token bucket algorithm for the police command that was introduced in Cisco IOS Release 12.0(5)XE is different from the token bucket algorithm for the police command introduced in Cisco IOS Release 12.1(5)T. For information on the token bucket algorithm introduced in Release 12.0(5)XE, see the Traffic Policing document for Release 12.0(5)XE. This document is available on the New Features for 12.0(5)XE feature documentation index (under Modular QoS CLI-related feature modules) at www.cisco.com.
The following are explanations of how the token bucket algorithms introduced in Cisco IOS Release 12.1(5)T work.
Token Bucket Algorithm with One Token Bucket
The one token bucket algorithm is used when the violate-action option is not specified in the police command command-line interface (CLI).
The conform bucket is initially set to the full size (the full size is the number of bytes specified as the normal burst size).
When a packet of a given size (for example, "B" bytes) arrives at specific time (time "T") the following actions occur:
•
(time between packets<which is equal to T - T1> * policer rate)/8 bytes
•
•
Token Bucket Algorithm with Two Token Buckets
The two-token bucket algorithm is used when the violate-action is specified in the police command CLI.
The conform bucket is initially full (the full size is the number of bytes specified as the normal burst size).
The exceed bucket is initially full (the full exceed bucket size is the number of bytes specified in the maximum burst size).
The tokens for both the conform and exceed token buckets are updated based on the token arrival rate, or committed information rate (CIR).
When a packet of given size (for example, "B" bytes) arrives at specific time (time "T") the following actions occur:
•
The token arrival rate is calculated as follows:
(time between packets<which is equal to T-T1> * policer rate)/8 bytes
•
•
•
Examples
Token Bucket Algorithm with One Token Bucket
The following example shows how to define a traffic class (using the class-map command) and associate the match criteria from the traffic class with the Traffic Policing configuration, which is configured in the service policy (using the policy-map command). The service-policy command is then used to attach this service policy to the interface.
In this particular example, Traffic Policing is configured with the average rate at 8000 bits per second and the normal burst size at 1000 bytes for all packets leaving Fast Ethernet interface 0/0:
Router(config)# class-map access-matchRouter(config-cmap)# match access-group 1Router(config-cmap)# exitRouter(config)# policy-map police-settingRouter(config-pmap)# class access-matchRouter(config-pmap-c)# police 8000 1000 conform-action transmit exceed-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy output police-settingIn this example, the initial token buckets starts full at 1000 bytes. If a 450-byte packet arrives, the packet conforms because enough bytes are available in the conform token bucket. The conform action (send) is taken by the packet and 450 bytes are removed from the conform token bucket (leaving 550 bytes).
If the next packet arrives 0.25 seconds later, 250 bytes are added to the token bucket ((0.25 * 8000)/8), leaving 800 bytes in the token bucket. If the next packet is 900 bytes, the packet exceeds and the exceed action (drop) is taken. No bytes are taken from the token bucket.
Token Bucket Algorithm with Two Token Buckets Example
In this particular example, Traffic Policing is configured with the average rate at 8000 bits per second, the normal burst size at 1000 bytes, and the excess burst size at 1000 bytes for all packets leaving Fast Ethernet interface 0/0.
Router(config)# class-map access-matchRouter(config-cmap)# match access-group 1Router(config-cmap)# exitRouter(config)# policy-map police-settingRouter(config-pmap)# class access-matchRouter(config-pmap-c)# police 8000 1000 1000 conform-action transmit exceed-action set-qos-transmit 1 violate-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy output police-settingIn this example, the initial token buckets starts full at 1000 bytes. If a 450-byte packet arrives, the packet conforms because enough bytes are available in the conform token bucket. The conform action (send) is taken by the packet and 450 bytes are removed from the conform token bucket (leaving 550 bytes).
If the next packet arrives 0.25 seconds later, 250 bytes are added to the conform token bucket ((0.25 * 8000)/8), leaving 800 bytes in the conform token bucket. If the next packet is 900 bytes, the packet does not conform because only 800 bytes are available in the conform token bucket.
The exceed token bucket, which starts full at 1000 bytes (as specified by the excess burst size) is then checked for available bytes. Because enough bytes are available in the exceed token bucket, the exceed action (set the QoS transmit value of 1) is taken and 900 bytes are taken from the exceed bucket (leaving 100 bytes in the exceed token bucket.
If the next packet arrives 0.40 seconds later, 400 bytes are added to the token buckets ((.40 * 8000)/8). Therefore, the conform token bucket now has 1000 bytes (the maximum number of tokens available in the conform bucket) and 200 bytes overflow the conform token bucket (because it only 200 bytes were needed to fill the conform token bucket to capacity). These overflow bytes are placed in the exceed token bucket, giving the exceed token bucket 300 bytes.
If the arriving packet is 1000 bytes, the packet conforms because enough bytes are available in the conform token bucket. The conform action (transmit) is taken by the packet and 1000 bytes are removed from the conform token bucket (leaving 0 bytes).
If the next packet arrives 0.20 seconds later, 200 bytes are added to the token bucket ((.20 * 8000)/8). Therefore, the conform bucket now has 200 bytes. If the arriving packet is 400 bytes, the packet does not conform because only 200 bytes are available in the conform bucket. Similarly, the packet does not exceed because only 300 bytes are available in the exceed bucket. Therefore, the packet violates and the violate action (drop) is taken.
Related Commands
