Cisco Industrial Ethernet 4000, 4010 and 5000 Switch Software. Configuration Guide (2022)

Configuring QoS

QoS Treatment for Performance-Monitoring Protocols

This example shows how to configure a policy map that shapes a port to 90 Mbps, allocated according to the out-policy

policy map configured in the previous example. The service-policy policy map class command is used to create a child

policy to the parent:

Switch(config)# policy-map out-policy-parent

Switch(config-pmap)# class class-default

Switch(config-pmap-c)# shape average 90000000

Switch(config-pmap-c)# service-policy out-policy

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy output out-policy-parent

Switch(config-if)# exit

Parent-Child Hierarchy

The switch also supports parent policy levels and child policy levels for traffic shaping. The QoS parent-child structure

is used for specific purposes where a child policy is referenced in a parent policy to provide additional control of a

specific traffic type.

The first policy level, the parent level, is used for port shaping, and you can specific only one class of type class-default

within the policy. This is an example of a parent-level policy map:

Switch(config)# policy-map parent

Switch(config-pmap)# class class-default

Switch(config-pmap-c)# shape average 50000000

Switch(config-pmap-c)# exit

The second policy level, the child level, is used to control a specific traffic stream or class, as in this example:

Switch(config)# policy-map child

Switch(config-pmap)# class class1

Switch(config-pmap-c)# priority

Switch(config-pmap-c)# exit

Note: The total of the minimum bandwidth guarantees (CIR) for each queue of the child policy cannot exceed the total

port-shape rate.

This is an example of a parent-child configuration:

Switch(config)# policy-map parent

Switch(config-pmap)# class class-default

Switch(config-pmap-c)# shape average 50000000

Switch(config-pmap-c)# service-policy child

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy output parent

Switch(config-if)# exit

Class-Based Weighted Fair Queuing

You can configure class-based weighted fair queuing (CBWFQ) to set the relative precedence of a queue by allocating

a portion of the total bandwidth that is available for the port. You use the bandwidth policy-map class configuration

command to set the output bandwidth for a class of traffic as a rate (kilobits per second), a percentage of total

bandwidth, or a percentage of remaining bandwidth.

Note: When you configure bandwidth in a policy map, you must configure all rates in the same format, either a configured

rate or a percentage. The total of the minimum bandwidth guarantees (CIR) for each queue of the policy cannot exceed

the total speed of the parent.

637

Configuring QoS

QoS Treatment for Performance-Monitoring Protocols

When you use the bandwidth policy-map class configuration command to configure a class of traffic as an absolute

rate (kilobits per second) or a percentage of total bandwidth, this represents the minimum bandwidth guarantee

(CIR) for that traffic class. This means that the traffic class gets at least the bandwidth indicated by the command,

but is not limited to that bandwidth. Any excess bandwidth on the port is allocated to each class in the same ratio in

which the CIR rates are configured.

You cannot configure bandwidth as an absolute rate or a percentage of total bandwidth when strict priority

(priority without police) is configured for another class in the output policy.

When you use the bandwidth policy-map class configuration command to configure a class of traffic as a

percentage of remaining bandwidth, this represents the portion of the excess bandwidth of the port that is allocated

to the class. This means that the class is allocated bandwidth only if there is excess bandwidth on the port, and if

there is no minimum bandwidth guarantee for this traffic class.

You can configure bandwidth as percentage of remaining bandwidth only when strict priority (priority without

police) is configured for another class in the output policy map.

For more information, see Configuring Output Policy Maps with Class-Based-Weighted-Queuing, page 672.

Note: You cannot configure bandwidth and traffic shaping (shape average) or priority queuing (priority) for the same

class in an output policy map.

Note: When you configure CIR bandwidth for a class as an absolute rate or percentage of the total bandwidth, any excess

bandwidth remaining after servicing the CIR of all the classes in the policy map is divided among the classes in the same

proportion as the CIR rates. If the CIR rate of a class is configured as 0, that class is also not eligible for any excess

bandwidth and as a result receives no bandwidth.

Priority Queuing

You can use the priority policy-map class configuration command to ensure that a particular class of traffic is given

preferential treatment. With strict priority queuing, the priority queue is constantly serviced. All packets in the queue are

scheduled and sent until the queue is empty. Priority queuing allows traffic for the associated class to be sent before

packets in other queues are sent.

Note: You should exercise care when using the priority command. Excessive use of strict priority queuing might cause

congestion in other queues.

The switch supports strict priority queuing or priority used with the police policy-map command.

Strict priority queuing (priority without police) assigns a traffic class to a low-latency queue to ensure that packets

in this class have the lowest possible latency. When this is configured, the priority queue is continually serviced until

it is empty, possibly at the expense of packets in other queues.

You cannot configure priority without policing for a traffic class when traffic shaping or CBWFQ are configured

for another class in the same output policy map.

You can use priority with the police policy-map command, or unconditional priority policing, to reduce the bandwidth

used by the priority queue. This is the only form of policing that is supported in output policy maps. Using this

combination of commands configures a maximum rate on the priority queue, and you can use the bandwidth and

shape average policy-map commands for other classes to allocate traffic rates on other queues.

When priority is configured in an output policy map without the police command, you can only configure the other

queues for sharing by using the bandwidth remaining percent policy-map command to allocate excess

bandwidth.

Priority queuing has these restrictions:

You can associate the priority command with a single unique class for all attached output polices on the switch.

You cannot configure priority and any other scheduling action (shape average or bandwidth) in the same class.

638

Configuring QoS

QoS Treatment for Performance-Monitoring Protocols

You cannot configure priority queuing for the class-default of an output policy map.

For more information, see Configuring Output Policy Maps with Class-Based Priority Queuing, page 675.

This example shows how to configure the class out-class1 as a strict priority queue so that all packets in that class are

sent before any other class of traffic. Other traffic queues are configured so that out-class-2 gets 50 percent of the

remaining bandwidth and out-class3 gets 20 percent of the remaining bandwidth. The class class-default receives the

remaining 30 percent with no guarantees.

Switch(config)# policy-map policy1

Switch(config-pmap)# class out-class1

Switch(config-pmap-c)# priority

Switch(config-pmap-c)# exit

Switch(config-pmap)# class out-class2

Switch(config-pmap-c)# bandwidth remaining percent 50

Switch(config-pmap-c)# exit

Switch(config-pmap)# class out-class3

Switch(config-pmap-c)# bandwidth remaining percent 20

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface gigabitethernet 0/1

Switch(config-if)# service-policy output policy1

Switch(config-if)# exit

This example shows how to use the priority with police commands to configure out-class1 as the priority queue, with

traffic going to the queue limited to 20000000 bps so that the priority queue will never use more than that. Traffic above

that rate is dropped. The other traffic queues are configured to use 50 and 20 percent of the bandwidth that is left, as in

the previous example.

Switch(config)# policy-map policy1

Switch(config-pmap)# class out-class1

Switch(config-pmap-c)# priority

Switch(config-pmap-c)# police 200000000

Switch(config-pmap-c)# exit

Switch(config-pmap)# class out-class2

Switch(config-pmap-c)# bandwidth percent 50

Switch(config-pmap-c)# exit

Switch(config-pmap)# class out-class3

Switch(config-pmap-c)# bandwidth percent 20

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface gigabitethernet 0/1

Switch(config-if)# service-policy output policy1

Switch(config-if)# exit

Congestion Avoidance and Queuing

Congestion avoidance uses algorithms such as tail drop to control the number of packets entering the queuing and

scheduling stage to avoid congestion and network bottlenecks. The switch uses weighted tail drop (WTD) to manage the

queue sizes and provide a drop precedence for traffic classifications. You set the queue size limits depending on the

markings of the packets in the queue. Each packet that travels through the switch can be assigned to a specific queue

and threshold. For example, specific DSCP or CoS values can be mapped to a specific egress queue and threshold.

WTD is implemented on traffic queues to manage the queue size and to provide drop precedences for different traffic

classifications. As a frame enters a particular queue, WTD uses the packet classification to subject it to different

thresholds. If the total destination queue size is greater than the threshold of any reclassified traffic, the next frame of

that traffic is dropped.

639

Configuring QoS

QoS Treatment for Performance-Monitoring Protocols

Figure 84 on page 640 shows an example of WTD operating on a queue of 1000 frames. Three drop percentages are

configured: 40 percent (400 frames), 60 percent (600 frames), and 100 percent (1000 frames). These percentages mean

that traffic reclassified to the 40-percent threshold is dropped when the queue depth exceeds 400 frames, traffic

reclassified to 60 percent is dropped when the queue depth exceeds 600 frames, and traffic up to 400 frames can be

queued at the 40-percent threshold, up to 600 frames at the 60-percent threshold, and up to 1000 frames at the

100-percent threshold.

Figure 84

WTD and Queue Operation

CoS 6-7

100%

1000

CoS 4-5

60%

600

CoS 0-3

40%

400

In this example, CoS values 6 and 7 have a greater importance than the other CoS values, and they are assigned to the

100-percent drop threshold (queue-full state). CoS values 4 and 5 are assigned to the 60-percent threshold, and CoS

values 0 to 3 are assigned to the 40-percent threshold.

If the queue is already filled with 600 frames, and a new frame arrives containing CoS values 4 and 5, the frame is

subjected to the 60-percent threshold. When this frame is added to the queue, the threshold would be exceeded, so the

switch drops it.

WTD is configured by using the queue-limit policy-map class command. The command adjusts the queue size (buffer

size) associated with a particular class of traffic. You specify the threshold as the number of packets, where each packet

is a fixed unit of 256 bytes. You can specify different queue sizes for different classes of traffic (CoS, DSCP, precedence,

or QoS group) in the same queue. Setting a queue limit establishes a drop threshold for the associated traffic when

congestion occurs.

Note: You cannot configure queue size by using the queue-limit policy map class command without first configuring a

scheduling action (bandwidth, shape average, or priority). The only exception to this is when you configure queue-limit

for the class-default of an output policy map.

The switch supports up to three unique queue-limit configurations across all output policy maps. Within an output policy

map, only four queues (classes) are allowed, including the class default. Each queue has three thresholds defined. Only

three unique threshold value configurations are allowed on the switch. However, multiple policy maps can share the same

queue-limits. When two policy maps a share queue-limit configuration, all threshold values must be the same for all the

classes in both policy maps.

For more information, see Configuring Output Policy Maps with Class-Based-Weighted-Queuing, page 672.

This example configures class A to match DSCP values and a policy map, PM1. The DSCP values of 30 and 50 are

mapped to unique thresholds (32 and 64, respectively). The DSCP values of 40 and 60 are mapped to the maximum

threshold of 112 packets.

Switch(config)# class-map match-any classA

Switch(config-cmap)# match ip dscp 30 40 50 60

Switch(config-cmap)# exit

Switch(config)# policy-map PM1

Switch(config-pmap)# class classA

Switch(config-pmap-c)# bandwidth percent 50

Switch(config-pmap-c)# queue-limit 112

Switch(config-pmap-c)# queue-limit dscp 30 32

Switch(config-pmap-c)# queue-limit dscp 50 64

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface gigabitethernet 0/1

Switch(config-if)# service-policy output PM1

640

Configuring QoS

QoS Treatment for Performance-Monitoring Protocols

Switch(config-if)# exit

You can use these same queue-limit values in multiple output policy maps on the switch. However, changing one of the

queue-limit values in a class creates a new, unique queue-limit configuration. You can attach only three unique

queue-limit configurations in output policy maps to interfaces at any one time. If you attempt to attach an output policy

map with a fourth unique queue-limit configuration, you see this error message:

QoS: Configuration failed. Maximum number of allowable unique queue-limit configurations exceeded.

Note: When you configure a queue limit for a class in an output policy map, all other output policy maps must use the

same qualifier type and qualifier value format. Only the queue-limit threshold values can be different. For example, when

you configure class A queue limit thresholds for dscp 30 and dscp 50 in policy map PM1, and you configure class A

queue limits in policy map PM2, you must use dscp 30 and dscp 50 as qualifiers. You cannot use dscp 20 and dscp 40.

The threshold values can be different, but different threshold values creates a new queue-limit configuration.

By default, the total amount of buffer space is divided equally among all ports and all queues per port, which is adequate

for many applications. You can decrease the queue size for latency-sensitive traffic or increase the queue size for bursty

traffic.

Note: When you use the queue-limit command to configure queue thresholds for a class, the WTD thresholds must be

less than or equal to the queue maximum threshold. A queue size configured with no qualifier must be larger than any

queue sizes configured with qualifiers.

When you configure queue limit, the range for the number of packets is from 16 to 544, in multiples of 16, where each

packet is a fixed unit of 256 bytes.

Note: For optimal performance, we strongly recommend that you configure the queue-limit to 272 or less.

Queue bandwidth and queue size (queue limit) are configured separately and are not interdependent. You should

consider the type of traffic being sent when you configure bandwidth and queue-limit:

A large buffer (queue limit) can better accommodate bursty traffic without packet loss, but at the cost of increased

latency.

A small buffer reduces latency but is more appropriate for steady traffic flows than for bursty traffic.

Very small buffers are typically used to optimize priority queuing. For traffic that is priority queued, the buffer size

usually needs to accommodate only a few packets; large buffer sizes that increase latency are not usually necessary.

For high-priority latency-sensitive packets, configure a relatively large bandwidth and relatively small queue size.

These restrictions apply to WTD qualifiers:

You cannot configure more than two threshold values for WTD qualifiers (cos, dscp, precedence, qos-group) by

using the queue-limit command. However, there is no limit to the number of qualifiers that you can map to these

thresholds. You can configure a third threshold value to set the maximum queue by using the queue-limit command

with no qualifiers.

A WTD qualifier in the queue-limit command must be the same as at least one match qualifier in the associated

class map.

This example shows how to configure bandwidth and queue limit so that out-class1, out-class2, out-class3, and

class-default get a minimum of 40, 20, 10 and 10 percent of the traffic bandwidth, respectively. The corresponding

queue-sizes are set to 48, 32, 16 and 272 (256-byte) packets:

Switch(config)# policy-map out-policy

Switch(config-pmap)# class outclass1

Switch(config-pmap-c)# bandwidth percent 40

Switch(config-pmap-c)# queue-limit 48

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass2

641

Configuring QoS

Switch(config-pmap-c)# bandwidth percent 20

Switch(config-pmap-c)# queue-limit 32

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass3

Switch(config-pmap-c)# bandwidth percent 10

Switch(config-pmap-c)# queue-limit 16

Switch(config-pmap-c)# exit

Switch(config-pmap)# class class-default

Switch(config-pmap-c)# bandwidth percent 10

Switch(config-pmap-c)# queue-limit 272

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface gigabitethernet 0/1

Switch(config-if)# service-policy output out-policy

Switch(config-if)# exit

You can configure and attach as many output policy maps as there are switch ports, but only three unique queue-limit

configurations are allowed. When another output policy map uses the same queue-limit and class configurations, even

if the bandwidth percentages are different, it is considered to be the same queue-limit configuration.

Configuring QoS

Before configuring QoS, you must have a thorough understanding of these factors:

The types of applications used and the traffic patterns on your network.

Traffic characteristics and needs of your network. Is the traffic bursty? Do you need to reserve bandwidth for voice

and video streams?

Bandwidth requirements and speed of the network.

Location of congestion points in the network.

These sections describe how to classify, police, and mark incoming traffic, and schedule and queue outgoing traffic.

Depending on your network configuration, you must perform one or more of these tasks.

Default QoS Configuration, page 642

QoS Configuration Guidelines, page 643

Using ACLs to Classify Traffic, page 644

Using Class Maps to Define a Traffic Class, page 648

Configuring Table Maps, page 650

Attaching a Traffic Policy to an Interface, page 651

Configuring Input Policy Maps, page 652

Configuring Output Policy Maps, page 670

Configuring QoS Marking and Queuing for CPU-Generated Traffic, page 682

Default QoS Configuration

There are no policy maps, class maps, table maps, or policers configured. At the egress port, all traffic goes through a

single default queue that is given the full operational port bandwidth. The default size of the default queue is 160

(256-byte) packets.

642

Configuring QoS

The packets are not modified (the CoS, DSCP, and IP precedence values in the packet are not changed). Traffic is

switched in pass-through mode without any rewrites and classified as best effort without any policing.

QoS Configuration Guidelines

You can configure QoS only on physical ports.

On a port configured for QoS, all traffic received through the port is classified, policed, and marked according to the

input policy map attached to the port. On a trunk port configured for QoS, traffic in all VLANs received through the

port is classified, policed, and marked according to the policy map attached to the port. If a per-port, per-VLAN

policy map is attached, traffic on the trunk port is classified, policed, and marked for the VLANs specified in the

parent-level policy, according to the child policy map associated with each VLAN.

If you have EtherChannel ports configured on your switch, you must configure QoS classification, policing, mapping,

and queuing on the individual physical ports that comprise the EtherChannel. You must decide whether the QoS

configuration should match on all ports in the EtherChannel.

Control traffic (such as spanning-tree bridge protocol data units [BPDUs] and routing update packets) received by

the switch are subject to all ingress QoS processing.

You are likely to lose data when you change queue settings; therefore, try to make changes when traffic is at a

minimum.

When you try to attach a new policy to an interface and this brings the number of policer instances to more than

1024 minus 1 more than the number of interfaces on the switch255, you receive an error message, and the

configuration fails.

When you try to attach new policy to an interface, increasing the number of policer profiles to more than 256, you

receive an error message, and the configuration fails. A profile is a combination of commit rate, peak rate, commit

burst, and peak burst. You can attach one profile to multiple instances, but if one of these characteristics differs, the

policer is considered to have a new profile.

You can specify 256 unique VLAN classification criteria within a per-port, per-VLAN policy-map, across all ports on

the switch. Any policy attachment or change that causes this limit to be exceeded fails with a VLAN label resources

exceeded error message.

You can attach per-port and per-port, per-VLAN policy-maps across all ports on the switch until QoS ACE

classification resource limitations are reached. Any policy attachment or change that causes this limit to be exceeded

fails with a TCAM resources exceeded error message.

When CPU protection is enabled, you can configure only 45 policers per port. Disabling CPU protection allows you

to configure up to 64 policers per port. You can enter the show policer cpu uni-eni {drop | rate} privileged EXEC

command to see if CPU protection is enabled.

Note these limitations when you disable CPU protection:

— When CPU protection is disabled, you can configure a maximum of 63 policers per port (62 on every 4th port)

for user-defined classes, and one for class-default. Any policy attachment or change that causes this limit to be

exceeded fails with a policer resources exceeded error message.

— When CPU protection is disabled, you can configure a maximum of 256 policers on the switch. Any policy

attachment or change that causes this limit to be exceeded fails with a policer resources exceeded error

message.

— If you disable CPU protection and attach a policy map with more than 45 policers, and then enable CPU

protection again, and reload, 19 policers per port are again required for CPU protection. During reload, the

policers 46 and above will reach the policer resources exceeded error condition and no policers are attached

to those classes.

643

Configuring QoS

If the number of internal QoS labels exceeds 256, you receive an error message.

Table maps are not supported for violate-action for aggregate policing unless you configure a table map for

exceed-action and no explicit action is configured for violate-action. For both individual and aggregate policers, if

you do not configure a violate-action, by default the violate class is assigned the same action as the exceed-action.

If double-tagged packets are received on a trunk or 802.1Q tunnel interface, these packets can be classified on

DSCP and IP precedence along with other parameters, but you cannot set DSCP or IP precedence on the outgoing

packets. You can set CoS on the outgoing packets.

See the configuration sections for specific QoS features for more configuration guidelines related to each feature.

Using ACLs to Classify Traffic

You can classify IP traffic by using IP standard or IP extended ACLs. You can classify IP and non-IP traffic by using Layer

2 MAC ACLs.

Follow these guidelines when configuring QoS ACLs:

You cannot match IP fragments against configured IP extended ACLs to enforce QoS. IP fragments are sent as

best-effort. IP fragments are denoted by fields in the IP header.

The switch supports only one access group per class in an input policy map.

You cannot configure match-access group in an output policy map.

These sections describe how to create QoS ACLs:

Creating IP Standard ACLs, page 644

Creating IP Extended ACLs, page 645

Creating Layer 2 MAC ACLs, page 647

Creating IP Standard ACLs

Beginning in privileged EXEC mode, follow these steps to create an IP standard ACL for IP traffic:

644

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

access-list access-list-number

Create an IP standard ACL, repeating the command as many times as

permit source [source-wildcard]

necessary.

For access-list-number, enter the access list number. The range is 1 to 99

and 1300 to 1999.

Always use the permit keyword for ACLs used as match criteria in QoS

policies. QoS policies do not match ACLs that use the deny keyword.

For source, enter the network or host from which the packet is being sent.

You can use the any keyword as an abbreviation for 0.0.0.0

255.255.255.255.

(Optional) For source-wildcard, enter the wildcard bits in dotted decimal

notation to be applied to the source.

ip access-list standard name

Define a standard IPv4 access list using a name, and enter access-list

configuration mode. The name can be a number from 1 to 99.

In access-list configuration mode, enter permit source [source-wildcard]

end

Return to privileged EXEC mode.

show access-lists

Verify your entries.

copy running-config

(Optional) Save your entries in the configuration file.

startup-config

To delete an access list, use the no access-list access-list-number global configuration command.

This example shows how to allow access for only those hosts on the three specified networks. The wildcard bits apply

to the host portions of the network addresses.

Switch(config)# access-list 1 permit 192.5.255.0 0.0.0.255

Switch(config)# access-list 1 permit 128.88.0.0 0.0.255.255

Switch(config)# access-list 1 permit 36.0.0.0 0.0.0.255

Creating IP Extended ACLs

Beginning in privileged EXEC mode, follow these steps to create an IP extended ACL for IP traffic:

645

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

access-list access-list-number permit

Create an IP extended ACL. Repeat the step as many times as necessary.

protocol {source source-wildcard

destination destination-wildcard}

For access-list-number, enter the access list number. The range is

100 to 199 and 2000 to 2699.

[precedence precedence] [tos tos]

[dscp dscp]

Always use the permit keyword for ACLs used as match criteria in

Note: If you enter a dscp value, you

QoS policies. QoS policies do not match deny ACLs.

cannot enter tos or precedence. You

For protocol, enter the name or number of an IP protocol. Use the

can enter both a tos and a precedence

question mark (?) to see a list of available protocols. To match any

value with no dscp.

Internet protocol (including ICMP, TCP, and UDP), enter ip.

The source is the number of the network or host sending the packet.

The source-wildcard applies wildcard bits to the source.

The destination is the network or host number receiving the packet.

The destination-wildcard applies wildcard bits to the destination.

You can specify source, destination, and wildcards as:

The 32-bit quantity in dotted-decimal format.

The keyword any for 0.0.0.0 255.255.255.255 (any host).

The keyword host for a single host 0.0.0.0.

Other keywords are optional and have these meanings:

precedence—Enter to match packets with a precedence level

specified as a number from 0 to 7 or by name: routine (0), priority

(1), immediate (2), flash (3), flash-override (4), critical (5),

internet (6), network (7).

tos—Enter to match by type of service level, specified by a number

from 0 to 15 or a name: normal (0), max-reliability (2),

max-throughput (4), min-delay (8).

dscp—Enter to match packets with the DSCP value specified by a

number from 0 to 63, or use the question mark (?) to see a list of

available values.

ip access-list extended name

Define an extended IPv4 access list using a name, and enter access-list

configuration mode. The name can be a number from 100 to 199.

In access-list configuration mode, enter permit protocol {source

source-wildcard destination destination-wildcard} [precedence

precedence] [tos tos] [dscp dscp] as defined in Step 2.

end

Return to privileged EXEC mode.

show access-lists

Verify your entries.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

To delete an access list, use the no access-list access-list-number global configuration command.

646

Configuring QoS

This example shows how to create an ACL that permits IP traffic from any source to any destination that has the DSCP

value set to 32:

Switch(config)# access-list 100 permit ip any any dscp 32

This example shows how to create an ACL that permits IP traffic from a source host at 10.1.1.1 to a destination host at

10.1.1.2 with a precedence value of 5:

Switch(config)# access-list 100 permit ip host 10.1.1.1 host 10.1.1.2 precedence 5

Creating Layer 2 MAC ACLs

Beginning in privileged EXEC mode, follow these steps to create a Layer 2 MAC ACL for non-IP traffic:

Command

Purpose

configure terminal

Enter global configuration mode.

mac access-list extended name

Create a Layer 2 MAC ACL by specifying the name of the list and enter

extended MAC ACL configuration mode.

permit {host src-MAC-addr mask | any

Always use the permit keyword for ACLs used as match criteria in QoS

| host dst-MAC-addr | dst-MAC-addr

policies.

mask} [type mask]

For src-MAC-addr, enter the MAC address of the host from which

the packet is being sent. You can specify in hexadecimal format

(H.H.H), use the any keyword for source 0.0.0, source-wildcard

ffff.ffff.ffff, or use the host keyword for source 0.0.0.

For mask, enter the wildcard bits by placing ones in the bit positions

that you want to ignore.

For dst-MAC-addr, enter the MAC address of the host to which the

packet is being sent. You can specify in hexadecimal format (H.H.H),

use the any keyword for source 0.0.0, source-wildcard ffff.ffff.ffff, or

use the host keyword for source 0.0.0.

(Optional) For type mask, specify the Ethertype number of a packet

with Ethernet II or SNAP encapsulation to identify the protocol of the

packet. For type, the range is from 0 to 65535, typically specified in

hexadecimal. For mask, enter the don’t care bits applied to the

Ethertype before testing for a match.

end

Return to privileged EXEC mode.

show access-lists [access-list-number

Verify your entries.

| access-list-name]

copy running-config startup-config

(Optional) Save your entries in the configuration file.

To delete an access list, use the no mac access-list extended access-list-name global configuration command.

This example shows how to create a Layer 2 MAC ACL with two permit statements. The first statement allows traffic

from the host with MAC address 0001.0000.0001 to the host with MAC address 0002.0000.0001. The second statement

allows only Ethertype XNS-IDP traffic from the host with MAC address 0001.0000.0002 to the host with MAC address

0002.0000.0002.

Switch(config)# mac access-list extended maclist1

Switch(config-ext-macl)# permit 0001.0000.0001 0.0.0 0002.0000.0001 0.0.0

Switch(config-ext-macl)# permit 0001.0000.0002 0.0.0 0002.0000.0002 0.0.0 xns-idp

Switch(config-ext-macl)# exit

647

Configuring QoS

Using Class Maps to Define a Traffic Class

You use the class-map global configuration command to name and to isolate a specific traffic flow (or class) from all

other traffic. A class map defines the criteria to use to match against a specific traffic flow to further classify it. Match

statements can include criteria such as an ACL, CoS value, DSCP value, IP precedence values, QoS group values, or

VLAN IDs. You define match criterion with one or more match statements entered in the class-map configuration mode.

Follow these guidelines when configuring class maps:

A match-all class map cannot have more than one classification criterion (one match statement), but a match-any

class map can contain multiple match statements.

The match cos and match vlan commands are supported only on Layer 2 802.1Q trunk ports.

You use a class map with the match vlan command in the parent policy in input hierarchical policy maps for per-port,

per-VLAN QoS on trunk ports. A policy is considered a parent policy map when it has one or more of its classes

associated with a child policy map. Each class within a parent policy map is called a parent class. You can configure

only the match vlan command in parent classes. You cannot configure the match vlan command in classes within

the child policy map.

For an input policy map, you cannot configure an IP classification (match ip dscp, match ip precedence, match

access-group for an IP ACL) and a non-IP classification (match cos or match access-group for a MAC ACL) in the

same policy map or class map. For a per-port, per-VLAN hierarchical policy map, this applies to the child policy map.

You cannot configure match qos-group for an input policy map.

In an output policy map, no two class maps can have the same classification criteria; that is, the same match

qualifiers and values.

The maximum number of class maps on the switch is 1024.

Beginning in privileged EXEC mode, follow these steps to create a class map and to define the match criterion to classify

traffic:

648

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

class-map [match-all | match-any]

Create a class map, and enter class-map configuration mode. By default, no

class-map-name

class maps are defined.

(Optional) Use the match-all keyword to perform a logical-AND of all

matching statements under this class map. All match criteria in the class

map must be matched.

(Optional) Use the match-any keyword to perform a logical-OR of all

matching statements under this class map. One or more match criteria

must be matched.

For class-map-name, specify the name of the class map.

If no matching statements are specified, the default is match-all.

Note: A match-all class map cannot have more than one classification

criterion (match statement).

match {access-group

Define the match criterion to classify traffic. By default, no match criterion is

acl-index-or-name | cos cos-list | ip

defined.

dscp dscp-list | ip precedence

ip-precedence-list | qos-group

Only one match type per class map is supported, and only one ACL per class

value | vlan vlan-list}

map is supported.

For access-group acl-index-or-name, specify the number or name of

an ACL. Matching access groups is supported only in input policy maps.

For cos cos-list, enter a list of up to four CoS values in a single line to

match against incoming packets. Separate each value with a space. You

can enter multiple cos-list lines to match more than four CoS values.

The range is 0 to 7.

For ip dscp dscp-list, enter a list of up to eight IPv4 DSCP values to

match against incoming packets. Separate each value with a space. You

can enter multiple dscp-list lines to match more than eight DSCP values.

The numerical range is 0 to 63. You can also configure DSCP values in

other forms. See Classification Based on IP DSCP, page 620.

For ip precedence ip-precedence-list, enter a list of up to four IPv4

precedence values to match against incoming packets. Separate each

value with a space. You can enter multiple ip-precedence-list lines to

match more than four precedence values. The range is 0 to 7.

For vlan vlan-list, specify a VLAN ID or a range of VLANs to be used in

a parent policy map for per-port, per-VLAN QoS on a trunk port. The

VLAN ID range is 1 to 4094.

For qos-group value, specify the QoS group number. The range is

0 to 99. Matching of QoS groups is supported only in output policy

maps.

end

Return to privileged EXEC mode.

show class-map

Verify your entries.

copy running-config

(Optional) Save your entries in the configuration file.

startup-config

649

Configuring QoS

Use the no form of the appropriate command to delete an existing class map or remove a match criterion.

This example shows how to create access list 103 and configure the class map called class1. The class1 has one match

criterion, which is access list 103. It permits traffic from any host to any destination that matches a DSCP value of 10.

Switch(config)# access-list 103 permit any any dscp 10

Switch(config)# class-map class1

Switch(config-cmap)# match access-group 103

Switch(config-cmap)# exit

This example shows how to create a class map called class2, which matches incoming traffic with DSCP values of 10,

11, and 12.

Switch(config)# class-map match-any class2

Switch(config-cmap)# match ip dscp 10 11 12

Switch(config-cmap)# exit

This example shows how to create a class map called class3, which matches incoming traffic with IP-precedence values

of 5, 6, and 7:

Switch(config)# class-map match-any class3

Switch(config-cmap)# match ip precedence 5 6 7

Switch(config-cmap)# exit

This example shows how to create a parent class-map called parent-class, which matches incoming traffic with VLAN

IDs in the range from 30 to 40.

Switch(config)# class-map match-any parent-class

Switch(config-cmap)# match vlan 30-40

Switch(config-cmap)# exit

Configuring Table Maps

You can configure table maps to manage a large number of traffic flows with a single command. You use table maps to

correlate specific DSCP, IP precedence and CoS values to each other, to mark down a DSCP, IP precedence, or CoS

value, or to assign default values. You can specify table maps in set commands and use them as mark-down mapping

for the policers.

These table maps are supported on the switch:

DSCP to CoS, precedence, or DSCP

CoS to DSCP, precedence, or CoS

Precedence to CoS, DSCP, or precedence

Note these guidelines when configuring table maps:

The switch supports a maximum of 256 unique table maps.

The maximum number of map statements within a table map is 64.

Table maps cannot be used in output policy maps.

Table maps are not supported for violate-action for aggregate policing unless you configure a table map for

exceed-action and no explicit action is configured for violate-action.

Beginning in privileged EXEC mode, follow these steps to create a table map:

650

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

table-map table-map-name

Create a table map by entering a table-map name and entering

table-map configuration mode.

map from from-value to to-value

Enter the mapping values to be included in the table. For example, if the

table map is a DSCP-to-CoS table map, the from-value would be the

DSCP value and the to_value would be the CoS value. Both ranges are

from 0 to 63.

Enter this command multiple times to include all the values that you want

to map.

default {default-value | copy | ignore}

Set the default behavior for a value not found in the table map.

Enter a default-value to specify a certain value. For example, in a

DSCP-to-CoS table map, this would be a specific CoS value to apply

to all unmapped DSCP values. The range is from 0 to 63.

Enter copy to map unmapped values to an equivalent value. In a

DSCP-to-CoS table map, this command maps all unmapped DSCP

values to the equivalent CoS value.

Enter ignore to leave unmapped values unchanged. In a

DSCP-to-CoS table map, the switch does not change the CoS value

of unmapped DSCP values.

end

Return to privileged EXEC mode.

show table-map [table-map-name]

Verify your entries.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

To delete a table map, use the no table-map table-map-name global configuration command.

This example shows how to create a DSCP-to-CoS table map. A complete table would typically include additional map

statements for the higher DSCP values. The default of 4 in this table means that unmapped DSCP values will be assigned

a CoS value of 4.

Switch(config)# table-map dscp-to-cos

Switch(config-tablemap)# map from 1 to 1

Switch(config-tablemap)# map from 2 to 1

Switch(config-tablemap)# map from 3 to 1

Switch(config-tablemap)# map from 4 to 2

Switch(config-tablemap)# map from 5 to 2

Switch(config-tablemap)# map from 6 to 3

Switch(config-tablemap)# default 4

Switch(config-tablemap)# end

Switch# show table-map dscp-to-cos

Attaching a Traffic Policy to an Interface

You use the service-policy interface configuration command to attach a traffic policy to an interface and to specify the

direction in which the policy should be applied: either an input policy map for incoming traffic or an output policy map

for outgoing traffic. Input and output policy maps support different QoS features. See Configuring Input Policy Maps,

page 652 and the Configuring Output Policy Maps, page 670 for restrictions on input and output policy maps.

You can attach a service policy only to a physical port. You can attach only one input policy map and one output policy

map per port.

651

Configuring QoS

Beginning in privileged EXEC mode, follow these steps to attach a policy map to a port:

Command

Purpose

configure terminal

Enter global configuration mode.

interface interface-id

Specify the port to attach to the policy map, and enter interface

configuration mode. Valid interfaces are physical ports.

service-policy {input | output}

Specify the policy-map name and whether it is an input policy

policy-map-name

map or an output policy map.

end

Return to privileged EXEC mode.

show policy-map interface [interface-id]

Verify your entries.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

To remove the policy map and port association, use the no service-policy {input | output} policy-map-name interface

configuration command.

Configuring Input Policy Maps

Policy maps specify which traffic class to act on and what actions to take. All traffic that fails to meet matching criteria

of a traffic class belongs to the default class. Input policy maps regulate traffic entering the switch. In an input policy, you

can match CoS, DSCP, IP precedence, ACLs, or VLAN IDs and configure individual policing, aggregate policing, or

marking to a CoS, DSCP, IP precedence, or QoS group value.

Follow these guidelines when configuring input policy maps:

You can attach only one input policy map per port.

The maximum number of policy maps configured on the switch is 256.

The total number of configurable policer profiles on the switch is 256; the total number of supported policer

instances on the switch is 1024 minus one more than the total number of interfaces on the switch. On a 24-port

switch, the number of available policer instances is 999. You can use a policer profile in multiple instances.

The maximum number of classes in each input policy map is 64 plus class-default.

The number of input policy maps that can be attached in a switch is limited by the availability of hardware resources.

If you attempt to attach an input policy map that causes any hardware resource limitation to be exceeded, the

configuration fails.

After you have attached a single-level policy map to an interface by using the service-policy input interface

configuration command, you can modify the policy without detaching it from the interface. You can add or delete

classification criteria, add or delete classes, add or delete actions, or change the parameters of the configured

actions (policers, rates, mapping, marking, and so on). This also applies to changing criteria for the child policy of a

hierarchical policy map, as in a per-port per-VLAN hierarchical policy map.

For the parent policy of a hierarchical policy map, you cannot add or delete a class at the parent level if the policy

map is attached to an interface. You must detach the policy from the interface, modify the policy, and then re-attach

it to the interface.

You can configure a maximum 2-level hierarchical policy map as an input policy map only with VLAN-based

classification at the parent level and no VLAN-based classification at the child level.

When an input policy map with only Layer 2 classification is attached to a routed port or a switch port containing a

routed SVI, the service policy acts only on switching eligible traffic and not on routing eligible traffic.

652

Configuring QoS

On an 802.1Q tunnel port, you can use only an input policy map with Layer 2 classification based on MAC ACLs to

classify traffic. Input policy maps with Layer 3 classification or with Layer 2 classification based on CoS or VLAN ID

are not supported on tunnel ports.

Input policy maps support policing and marking, not scheduling or queuing. You cannot configure bandwidth,

priority, queue-limit, or shape average in input policy maps.

These sections describe how to configure different types of input policy maps:

Configuring Input Policy Maps with Individual Policing, page 653

Configuring Input Policy Maps with Aggregate Policing, page 659

Configuring Input Policy Maps with Marking, page 664

Configuring Per-Port Per-VLAN QoS with Hierarchical Input Policy Maps, page 665

Configuring Input Policy Maps with Individual Policing

You use the police policy-map class configuration command to configure individual policers to define the committed rate

limitations, committed burst size limitations of the traffic, and the action to take for a class of traffic.

Follow these guidelines when configuring individual policers:

Policing is supported only on input policy maps.

The switch supports a maximum of 229 policers. (228 user-configurable policers and 1 policer reserved for internal

use).

When CPU protection is enabled (the default), you can configure 45 ingress policers per port. If you disable CPU

protection by entering the no policer cpu uni all global configuration command and reloading the switch, you can

configure a maximum of 63 policers per port (62 on every 4th port) for user-defined classes and one for

class-default. You can enter the show policer cpu uni-eni {drop | rate} privileged EXEC command to see if CPU

protection is enabled.

When you use a table map for police exceed-action in an input policy map, the protocol type of the map from type

of action must be the same as the protocol type of the associated classification. For example, if the associated class

map represents an IP classification, the map from type of action that references the table map must be dscp or

precedence. If the associated class map represents a non-IP classification, the map from type of action that

references the table map must be cos.

2-rate, 3-color policing is supported only on input policy maps; 1-rate, 2-color policing is supported on both input

and output policy maps.

The number of policer instances on the switch can be 1024 minus 1 more than the number interfaces. The switch

supports a maximum of 256 policer profiles.

If you do not configure a violate-action, by default the violate class is assigned the same action as the exceed-action.

Beginning in privileged EXEC mode, follow these steps to create an input policy map with individual policing:

653

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

policy-map policy-map-name

Create a policy map by entering the policy map name, and enter

policy-map configuration mode. By default, no class maps are

defined.

class {class-map-name | class-default}

Enter a class-map name or class-default to match all unclassified

packets, and enter policy-map class configuration mode.

If you enter a class-map name, you must have already created the

class map by using the class-map global configuration command.

police {rate-bps | cir cir-bps} [burst-bytes |

Define a policer for the class of traffic.

bc burst-bytes]

By default, no policer is defined.

For rate-bps, specify average traffic rate in bits per second

(bps). The range is 8000 to 1000000000.

For cir cir-bps, specify a committed information rate (CIR) in

bits per second (bps). The range is 8000 to 1000000000.

For burst-bytes (optional), specify the normal burst size in

bytes. The range is 8000 to 1000000.

For bc burst-bytes (optional), specify the conformed burst (bc)

or the number of acceptable burst bytes. The range is 8000 to

1000000.

conform-action cos {cos_value | cos [table

(Optional) Enter the action to be taken on packets that conform to

table-map-name] | dscp [table

the CIR.

table-map-name] | precedence [table

table-map-name]}

For cos cos_value, enter a new CoS value to be assigned to the

classified traffic. The range is 0 to 7.

conform-action [ip] dscp {dscp_value | cos

For [ip] dscp dscp_value, enter a new DSCP value to be

[table table-map-name] | dscp [table

assigned to the classified traffic. The range is 0 to 63.

table-map-name] | precedence [table

table-map-name]}

For [ip] precedence precedence_value, enter a new

IP-precedence value to be assigned to the classified traffic.

conform-action [ip] precedence

The range is 0 to 7.

{precedence_value | cos [table

table-map-name] | dscp [table

Or you can configure a CoS, DSCP, or IP precedence table and

table-map-name] | precedence [table

optionally enter the table name. If you do not enter table

table-map-name]}

table-map name, the table map default behavior is copy. See

Configuring Table Maps, page 650.

conform-action qos-group value

For qos-group value, identify a QoS group to be used at egress

transmit

to identify specific packets. The range is from 0 to 99.

Note: You can enter a single conform-action as part of the

command string following the police command. You can also press

Enter after the police command to enter policy-map class police

configuration mode, where you can enter multiple actions. In

policy-map class police configuration mode, you must enter an

action to take.

654

Configuring QoS

Command

Purpose

exceed-action cos {cos_value | cos [table

(Optional) Enter the action to be taken for packets that do not

table-map-name] | dscp [table

conform to the CIR.

table-map-name] | precedence [table

table-map-name]}

For cos cos_value, enter a new CoS value to be assigned to the

classified traffic. The range is 0 to 7.

exceed-action [ip] dscp {dscp_value | cos

For [ip] dscp dscp_value, enter a new DSCP value to be

[table table-map-name] | dscp [table

assigned to the classified traffic. The range is 0 to 63.

table-map-name] | precedence [table

table-map-name]}

For [ip] precedence precedence_value, enter a new

IP-precedence value to be assigned to the classified traffic.

exceed-action [ip] precedence

The range is 0 to 7.

{precedence_value | cos [table

table-map-name] | dscp [table

Or you can configure a CoS, DSCP, or IP precedence table and

table-map-name] | precedence [table

optionally enter the table name. If you do not enter table

table-map-name]}

table-map name, the table map default behavior is copy. See

Configuring Table Maps, page 650.

exceed-action qos-group value

For qos-group value, identify a QoS group to be used at egress

to identify specific packets. The range is from 0 to 99.

Note: You can enter a single exceed-action as part of the command

string following the police command. Or you can press Enter after

the police command to enter policy-map class police configuration

mode, where you can enter multiple actions. In policy-map class

police configuration mode, you must enter an action to take.

Note: If you explicitly configure exceed-action drop as keywords

in the command, you must enter policy-map class police

configuration mode and enter the no exceed-action drop

command to remove the previously configured exceed action

before you can enter the new exceed-action.

exit

Return to policy-map configuration mode.

exit

Return to global configuration mode.

interface interface-id

Enter interface configuration mode for the interface to which you

want to attach the policy.

10.

service-policy input policy-map-name

Attach the policy map (created in Step 2) to the ingress interface.

11.

end

Return to privileged EXEC mode.

12.

show policy-map [policy-map-name [class

Verify your entries.

class-map-name]]

13.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

Beginning in privileged EXEC mode, follow these steps to create an input policy map with individual 2-rate, 3-color

policing:

655

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

policy-map policy-map-name

Create a policy map by entering the policy map name, and enter

policy-map configuration mode. By default, no class maps are

defined.

class {class-map-name | class-default}

Enter a class-map name or class-default to match all unclassified

packets, and enter policy-map class configuration mode.

If you enter a class-map name, you must have already created the

class map by using the class-map global configuration command.

police {rate-bps | cir {cir-bps} [burst-bytes]

Define a policer using one or two rates—committed information rate

[bc [conform-burst] [pir pir-bps [be

(CIR) and peak information rate (PIR) for the class of traffic.

peak-burst]]

By default, no policer is defined.

For rate-bps, specify average traffic rate in bits per second

(bps). The range is 8000 to 1000000000.

For cir cir-bps, specify a committed information rate at which

the bc token bucket is updated in bits per second (b/s). The

range is 8000 to 1000000000.

For burst-bytes (optional), specify the normal burst size in

bytes. The range is 8000 to 1000000.

(Optional) For bc conform-burst, specify the conformed burst

used by the bc token bucket for policing.The range is 8000 to

1000000 bytes.

(Optional) For pir pir-bps, specify the peak information rate at

which the be token bucket for policing is updated. The range is

8000 to 1000000000 b/s. If you do not enter a pir pir-bps, the

policer is configured as a 1-rate, 2-color policer.

For be peak-burst, specify the peak burst size used by the be

token bucket. The range is 8000 to 1000000 bytes. The default

is internally calculated based on the user configuration.

656

Configuring QoS

Command

Purpose

conform-action [drop | set-cos-transmit

(Optional) Enter the action to be taken on packets, depending on

{cos_value | [cos | dscp | precedence] [table

whether or not they conform to the CIR and PIR.

table-map name]} | set-dscp-transmit

{dscp_value | [cos | dscp | precedence]

(Optional) For conform-action, specify the action to perform

[table table-map name]} | set-prec-transmit

on packets that conform to the CIR and PIR. The default is

{precedence_value | [cos | dscp |

transmit.

precedence] [table table-map name]} |

(Optional) For exceed-action, specify the action to perform on

set-qos-transmit qos-group_value |

packets that conform to the PIR but not the CIR. The default is

transmit]

drop.

| exceed-action [drop | set-cos-transmit

(Optional) For violate-action, specify the action to perform on

{cos_value | [cos | dscp | precedence] [table

packets that exceed the PIR. The default is drop.

table-map name]} | set-dscp-transmit

{dscp_value | [cos | dscp | precedence]

(Optional) For action, specify one of these actions to perform

[table table-map name]} | set-prec-transmit

on the packets:

{precedence_value | [cos | dscp |

precedence] [table table-map name]} |

— drop—Drop the packet.

set-qos-transmit qos-group_value |

transmit]

Note: If the conform action is set to drop, the exceed and violate

actions are automatically set to drop. If the exceed action is set to

| violate- action [drop | set-cos-transmit

drop, the violate action is automatically set to drop.

{cos_value | [cos | dscp | precedence] [table

table-map name]} | set-dscp-transmit

— set-cos-transmit cos-value—Enter a new CoS value to be

{dscp_value | [cos | dscp | precedence]

assigned to the packet, and send the packet. The range is

[table table-map name]} | set-prec-transmit

from 0 to 7.

{precedence_value | [cos | dscp |

precedence] [table table-map name]} |

— set-dscp-transmit dscp-value—Enter a new IP DSCP

set-qos-transmit qos-group_value |

value to be assigned to the packet, and send the packet.

transmit]

The range is from 0 to 63. You can also enter a mnemonic

name for a commonly used value.

— set-prec-transmit cos-value—Enter a new IP precedence

value to be assigned to the packet, and send the packet.

The range is from 0 to 7.

— set-qos-transmit qos-group-value—Identify a qos-group

to be used at egress to specify packets. The range is from

0 to 99.

— transmit—Send the packet without altering it.

Note: You can enter a single conform-action as part of the

command string following the police command. You can also press

Enter after the police command to enter policy-map class police

configuration mode, where you can enter multiple actions. In

policy-map class police configuration mode, you must enter an

action to take.

exit

Return to policy-map configuration mode.

exit

Return to global configuration mode.

interface interface-id

Enter interface configuration mode for the interface to which you

want to attach the policy.

service-policy input policy-map-name

Attach the policy map (created in Step 2) to the ingress interface.

657

Configuring QoS

Command

Purpose

10.

end

Return to privileged EXEC mode.

11.

show policy-map [policy-map-name|

Verify your entries.

interface]

12.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

After you have created an input policy map, you attach it to an interface in the input direction. See Attaching a Traffic

Policy to an Interface, page 651.

Use the no form of the appropriate command to delete an existing policy map, class map, or policer.

This example shows how to configure 2-rate, 3-color policing using policy-map configuration mode.

Switch(config)# class-map cos-4

Switch(config-cmap)# match cos 4

Switch(config-cmap)# exit

Switch(config)# policy-map in-policy

Switch(config-pmap)# class cos-4

Switch(config-pmap-c)# police cir 5000000 pir 8000000 conform-action transmit exceed-action

set-dscp-transmit 24 violate-action drop

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input in-policy

Switch(config-if)# exit

This example shows how to create the same configuration using policy-map class police configuration mode.

Switch(config)# class-map cos-4

Switch(config-cmap)# match cos 4

Switch(config-cmap)# exit

Switch(config)# policy-map in-policy

Switch(config-pmap)# class cos-4

Switch(config-pmap-c)# police cir 5000000 pir 8000000

Switch(config-pmap-c-police)# conform-action transmit

Switch(config-pmap-c-police)# exceed-action set-dscp-transmit 24

Switch(config-pmap-c-police)# violate-action drop

Switch(config-pmap-c-police)# end

This example shows how to create a traffic classification with a CoS value of 4, create a policy map, and attach it to an

ingress port. The average traffic rate is limited to 10000000 b/s with a burst size of 10000 bytes:

Switch(config)# class-map video-class

Switch(config-cmap)# match cos 4

Switch(config-cmap)# exit

Switch(config)# policy-map video-policy

Switch(config-pmap)# class video-class

Switch(config-pmap-c)# police 10000000 10000

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input video-policy

Switch(config-if)# exit

This example shows how to create policy map with a conform action of set dscp and a default exceed action.

Switch(config)# class-map in-class-1

Switch(config-cmap)# match dscp 14

Switch(config-cmap)# exit

Switch(config)# policy-map in-policy

Switch(config-pmap)# class in-class-1

658

Configuring QoS

Switch(config-pmap-c)# police 230000 8000 conform-action set-dscp-transmit 33 exceed-action drop

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input in-policy

Switch(config-if)# exit

This example shows how to use policy-map class police configuration mode to set multiple conform actions and an

exceed action. The policy map sets a committed information rate of 23000 bits per second (bps) and a conform burst

size of 10000 bytes. The policy map includes multiple conform actions (for DSCP and for Layer 2 CoS) and an exceed

action.

Switch(config)# class-map cos-set-1

Switch(config-cmap)# match cos 3

Switch(config-cmap)# exit

Switch(config)# policy-map map1

Switch(config-pmap)# class cos-set-1

Switch(config-pmap-c)# police cir 23000 bc 10000

Switch(config-pmap-c-police)# conform-action set-dscp-transmit 48

Switch(config-pmap-c-police)# conform-action set-cos-transmit 5

Switch(config-pmap-c-police)# exceed-action drop

Switch(config-pmap-c-police)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input map1

Switch(config-if)# exit

This example shows how to use policy-map class police configuration mode to set exceed action mark-down using

table-maps. The policy map sets a committed information rate of 23000 bps and a conform burst-size of 10000 bytes.

The policy map includes the default conform action (transmit) and the exceed action to mark the Layer 2 CoS value

based on the table map and to mark IP DSCP to af41.

Switch(config)# policy-map in-policy

Switch(config-pmap)# class in-class-1

Switch(config-pmap-c)# police cir 23000 bc 10000

Switch(config-pmap-c-police)# exceed-action set-cos-transmit cos table police-cos-markdn-tablemap

Switch(config-pmap-c-police)# exceed-action set-dscp-transmit af41

Switch(config-pmap-c-police)# exit

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input in-policy

Switch(config-if)# exit

Configuring Input Policy Maps with Aggregate Policing

You use the policer aggregate global configuration command to configure an aggregate policer. An aggregate policer

is shared by multiple traffic classes within the same policy map. You define the aggregate policer, create a policy map,

associate a class map with the policy map, associate the policy map with the aggregate policer, and apply the service

policy to a port.

Follow these guidelines when configuring aggregate policers:

Aggregate policing is supported only on input policy maps.

The switch supports a maximum of 229 policers associated with ports (228 user-configurable policers and 1 policer

reserved for internal use). You can configure up to 45 policers on a port.

659

Configuring QoS

When CPU protection is enabled (the default), you can configure 45 ingress policers per port. If you disable CPU

protection by entering the no policer cpu uni all global configuration command and reloading the switch, you can

configure a maximum of 63 policers per port (62 on every 4th port) for user-defined classes and one for

class-default. You can enter the show policer cpu uni-eni {drop | rate} privileged EXEC command to see if CPU

protection is enabled.

The maximum number of configured aggregate policers is 256.

The number of policer instances on the switch can be 1024 minus 1 more than the total number interfaces on the

switch. The switch supports a maximum of 256 policer profiles.

If you do not configure a violate-action, by default the violate class is assigned the same action as the exceed-action.

Only one policy map can use any specific aggregate policer. Aggregate policing cannot be used to aggregate

streams across multiple interfaces. You can use aggregate policing only to aggregate streams across multiple

classes in a policy map attached to an interface and to aggregate traffic streams across VLANs on a port in a

per-port, per-VLAN policy map.

When you use a table map for police exceed-action in an input policy map, the protocol type of the map from type

of action must be the same as the protocol type of the associated classification. For example, if the associated class

map represents an IP classification, the map from type of action that references the table map must be either dscp

or precedence. If the associated class map represents a non-IP classification, the map from type of action that

references the table map must be cos.

Table maps are not supported for violate-action for aggregate policing unless a table map is configured for

exceed-action and no explicit action is configured for violate-action.

You can configure multiple conform and exceed actions conform, exceed, and violate actions simultaneously for an

aggregate policer as parameters in the policer aggregate global configuration command, but you must enter the actions

in this order:

conform-action must be followed by drop or transmit or by set actions in this order:

set-qos-transmit

set-dscp-transmit or set-prec-transmit

set-cos-transmit

exceed-action must be followed by drop or transmit or by set actions in this order:

set-qos-transmit

set-dscp-transmit or set-prec-transmit

set-cos-transmit

violate-action must be followed by drop or transmit or by set actions in this order:

set-qos-transmit

set-dscp-transmit or set-prec-transmit

set-cos-transmit

Note: You do not configure aggregate policer conform-action, exceed-action, and violate-action in policy-map class

police configuration mode; you must enter all actions in a string. Consequently, if you enter multiple conform, exceed,

and violate actions, the command can become quite long, in which case it might be truncated and difficult to read.

Beginning in privileged EXEC mode, follow these steps to create an aggregate policer:

660

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

policer aggregate aggregate-policer-name

Define the policer parameters that can be applied to multiple traffic

{rate-bps | cir cir-bps} [bc burst- value]

classes within the same policy map.

[conform-action [set-cos-transmit

For aggregate-policer-name, specify the name of the

{cos_value | [cos | dscp | precedence] [table

table-map name]} | set-dscp-transmit

aggregate policer.

{dscp_value | [cos | dscp | precedence]

For rate-bps, specify average traffic rate in bits per second

[table table-map name]} | set-prec-transmit

(bps). The range is 8000 to 1000000000.

{precedence_value | [cos | dscp |

precedence] [table table-map name]} |

For cir cir-bps, specify the committed information rate in bits

set-qos-transmit qos-group_value |

per second. The range is 8000 to 1000000000 bps.

transmit] [exceed action [drop |

set-cos-transmit {cos_value | [cos | dscp |

(Optional) For bc burst-value, specify conform burst and the

precedence] [table table-map name]} |

number of acceptable burst bytes. The range is 8000 to

set-dscp-transmit {dscp_value | [cos | dscp

1000000 bytes.

| precedence] [table table-map name]} |

set-prec-transmit {precedence_value | [cos

(Optional) For conform-action, specify the action to take on

| dscp | precedence] [table table-map

packets that conform to the CIR. The default is to send the

name]} | set-qos-transmit qos-group_value

packet.

| transmit]]

(Optional) For exceed-action, specify the action to take on

packets that exceed the CIR. The default is to drop the packet.

See the command reference for this release or Configuring Input

Policy Maps with Individual Policing, page 653 for definitions of the

available keywords.

policy-map policy-map-name

Create a policy map by entering the policy map name, and enter

policy-map configuration mode.

class {class-map-name | class-default}

Enter a class-map name or class-default to match all unclassified

packets, and enter policy-map class configuration mode.

If you enter a class-map name, you must have already created the

class map by using the class-map global configuration command.

police aggregate aggregate-policer-name

Apply an aggregate policer to multiple classes in the same policy

map. For aggregate-policer-name, enter the name specified in

Step 2.

exit

Return to policy-map configuration mode.

exit

Return to global configuration mode.

interface interface-id

Enter interface configuration mode for the interface to which you

want to attach the policy.

service-policy input policy-map-name

Attach the policy map (created in Step 3) to the ingress interface.

10.

end

Return to privileged EXEC mode.

11.

end

Return to privileged EXEC mode.

12.

show policer aggregate

Verify your entries.

[aggregate-policer-name]

13.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

Beginning in privileged EXEC mode, follow these steps to create a 2-rate, 3-color aggregate policer:

661

Configuring QoS

Command

Purpose

configure terminal

Enter global configuration mode.

policer aggregate aggregate-policer-name

Define the policer parameters that can be applied to multiple traffic

{rate-bps | cir cir-bps} [burst-bytes] [bc

classes within the same policy map.

[conform-burst] [pir pir-bps [be peak-burst]]

For aggregate-policer-name, specify the name of the

[conform-action [drop | set-cos-transmit

{cos_value | [cos | dscp | precedence] [table

aggregate policer.

table-map name]} | set-dscp-transmit

For rate-bps, specify average traffic rate in bits per second

{dscp_value | [cos | dscp | precedence]

(b/s). The range is 8000 to 1000000000.

[table table-map name]} | set-prec-transmit

{precedence_value | [cos | dscp |

For cir cir-bps, specify a committed information rate (CIR) at

precedence] [table table-map name]} |

which the first token bucket is updated in bits per second (b/s).

set-qos-transmit qos-group_value |

The range is 8000 to 1000000000.

transmit]

For burst-bytes (optional), specify the normal burst size in

[exceed-action [drop | set-cos-transmit

bytes. The range is 8000 to 1000000.

{cos_value | [cos | dscp | precedence] [table

table-map name]} | set-dscp-transmit

(Optional) For bc conform-burst, specify the conformed burst

{dscp_value | [cos | dscp | precedence]

used by the first token bucket for policing.The range is 8000 to

[table table-map name]} | set-prec-transmit

1000000 bytes.

{precedence_value | [cos | dscp |

precedence] [table table-map name]} |

(Optional) For pir pir-bps, specify the peak information rate at

set-qos-transmit qos-group_value |

which the second token bucket for policing is updated. The

transmit]]

range is 8000 to 1000000000 bits per second. If you do not

enter a pir pir-bps, the policer is configured as a 1-rate,

[violate- action [drop | set-cos-transmit

2-color policer.

{cos_value | [cos | dscp | precedence]} |

set-dscp-transmit {dscp_value | [cos | dscp

For be peak-burst, specify the peak burst size used by the

| precedence]} | set-prec-transmit

second token bucket. The range is 8000 to 1000000 bytes. The

{precedence_value | [cos | dscp |

default is internally calculated based on the user configuration.

precedence]} | set-qos-transmit

qos-group_value | transmit]]

(Optional) For conform-action, specify the action to take on

packets that conform to the CIR. The default is to send the

packet.

Note: If the conform action is set to drop, the exceed and violate

actions are automatically set to drop. If the exceed action is set to

drop, the violate action is automatically set to drop.

(Optional) For exceed-action, specify the action to take on

packets that exceed the CIR. The default is to drop the packet.

(Optional) For violate-action, specify the action to take on

packets that exceed the CIR. The default is to drop the packet.

see Configuring Input Policy Maps with Individual Policing,

page 653 for definitions of the action keywords.

Note: You cannot configure table maps for violate-action for

aggregate policing unless a table map is configured for

exceed-action and no explicit action is configured for

violate-action.

policy-map policy-map-name

Create a policy map by entering the policy map name, and enter

policy-map configuration mode.

662

Configuring QoS

Command

Purpose

class {class-map-name | class-default}

Enter a class-map name or class-default to match all unclassified

packets, and enter policy-map class configuration mode.

If you enter a class-map name, you must have already created the

class map by using the class-map global configuration command.

police aggregate aggregate-policer-name

Apply an aggregate policer to multiple classes in the same policy

map. For aggregate-policer-name, enter the name specified in

Step 2.

exit

Return to policy-map configuration mode.

exit

Return to global configuration mode.

interface interface-id

Enter interface configuration mode for the interface to which you

want to attach the policy.

service-policy input policy-map-name

Attach the policy map (created in Step 3) to the ingress interface.

10.

end

Return to privileged EXEC mode.

11.

show policer aggregate

Verify your entries.

[aggregate-policer-name]

12.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

After you have created an aggregate policer, you attach it to an ingress port. See Attaching a Traffic Policy to an Interface,

page 651.

To remove the specified aggregate policer from a policy map, use the no police aggregate aggregate-policer-name

policy map configuration mode. To delete an aggregate policer and its parameters, use the no policer aggregate

aggregate-policer-name global configuration command.

This example shows how to create an aggregate policer and attach it to multiple classes within a policy map. The policy

map is attached to an ingress port.

Switch(config)# policer aggregate example 10900000 80000 conform-action transmit exceed-action drop

Switch(config)# class-map testclass1

Switch(config-cmap)# match access-group 1

Switch(config-cmap)# exit

Switch(config)# class-map testclass2

Switch(config-cmap)# match access-group 2

Switch(config-cmap)# exit

Switch(config)# policy-map testexample

Switch(config-pmap)# class testclass

Switch(config-pmap-c)# police aggregate example

Switch(config-pmap-c)# exit

Switch(config-pmap)# class testclass2

Switch(config-pmap-c)# police aggregate example

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input testexample

Switch(config-if)# exit

This example shows how to create a 2-rate, 3-color aggregate policer and attach it to multiple classes within a policy

map. The policy map is attached to an ingress port.

Switch(config)# policer aggregate example cir 10900000 pir 80000000 conform-action transmit

exceed-action drop violate-action drop

Switch(config)# class-map testclass1

Switch(config-cmap)# match access-group 1

663

Configuring QoS

Switch(config-cmap)# exit

Switch(config)# class-map testclass2

Switch(config-cmap)# match access-group 2

Switch(config-cmap)# exit

Switch(config)# policy-map testexample

Switch(config-pmap)# class testclass

Switch(config-pmap-c)# police aggregate example

Switch(config-pmap-c)# exit

Switch(config-pmap)# class testclass2

Switch(config-pmap-c)# police aggregate example

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input testexample

Switch(config-if)# exit

Configuring Input Policy Maps with Marking

You use the set policy-map class configuration command to set or modify the attributes for traffic belonging to a specific

class. Follow these guidelines when configuring marking in policy maps:

You can configure a maximum of 100 QoS groups on the switch.

When you use a table map for marking in an input policy map, the protocol type of the map from type of action must

be the same as the protocol type of the associated classification. For example, if the associated class map

represents an IP classification, the map from type of action that references the table map must be either dscp or

precedence. If the associated class map represents a non-IP classification, the map from type of action that

references the table map must be cos.

Beginning in privileged EXEC mode, follow these steps to create an input policy map that marks traffic:

Command

Purpose

configure terminal

Enter global configuration mode.

policy-map policy-map-name

Create a policy map by entering the policy map name, and enter

policy-map configuration mode.

class {class-map-name | class-default}

Enter a class-map name, or class-default to match all unclassified

packets, and enter policy-map class configuration mode.

If you enter a class-map name, you must have already created the class

map by using the class-map global configuration command.

set qos-group value

Mark traffic by setting a new value in the packet, specifying a table map,

and/or

or specifying a QoS group.

set cos {cos_value | cos [table

table-map-name] | dscp [table

For qos-group value, identify a QoS group to be used at egress to

table-map-name] | precedence [table

identify specific packets. The range is from 0 to 99.

table-map-name]}

For cos cos_value, enter a new CoS value to be assigned to the

and/or

classified traffic. The range is 0 to 7.

set [ip] dscp {dscp_value | cos [table

table-map-name] | dscp [table

For [ip] dscp new-dscp, enter a new DSCP value to be assigned to

table-map-name] | precedence [table

the classified traffic. The range is 0 to 63.

table-map-name]}

and/or

For [ip] precedence new-precedence, enter a new IP-precedence

set [ip] precedence {precedence_value

value to be assigned to the classified traffic. The range is 0 to 7.

| cos [table table-map-name] | dscp

[table table-map-name] | precedence

You can also configure a CoS, DSCP, or IP precedence table and

[table table-map-name]}

optionally enter the table name. If you do not enter table table-map

name, the table map default behavior is copy. See Configuring Table

Maps, page 650.

664

Configuring QoS

Command

Purpose

exit

Return to policy-map configuration mode.

exit

Return to global configuration mode.

interface interface-id

Enter interface configuration mode for the interface to which you want to

attach the policy.

service-policy input policy-map-name

Attach the policy map (created in Step 2) to the ingress interface.

end

Return to privileged EXEC mode.

10.

show policy-map [policy-map-name

Verify your entries.

[class class-map-name]]

11.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

Use the no form of the appropriate command to delete a policy map or table map or remove an assigned CoS, DSCP,

precedence, or QoS-group value.

This example uses a policy map to remark a packet. The first marking (the set command) applies to the QoS default class

map that matches all traffic not matched by class AF31-AF33 and sets all traffic to an IP DSCP value of 1. The second

marking sets the traffic in classes AF31 to AF33 to an IP DSCP of 3.

Switch(config)# policy-map Example

Switch(config-pmap)# class class-default

Switch(config-pmap-c)# set ip dscp 1

Switch(config-pmap-c)# exit

Switch(config-pmap)# class AF31-AF33

Switch(config-pmap-c)# set ip dscp 3

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy input Example

Switch(config-if)# exit

Configuring Per-Port Per-VLAN QoS with Hierarchical Input Policy Maps

Per-port, per-VLAN QoS allows classification based on VLAN IDs for applying QoS for frames received on a given

interface and VLAN. This is achieved by using a hierarchical policy map, with a parent policy and a child policy.

Note these guidelines and limitations when configuring per-port, per-VLAN QoS:

The feature is supported only by using a two-level hierarchical input policy map, where the parent level defines the

VLAN-based classification, and the child level defines the QoS policy to be applied to the corresponding VLAN or

VLANs.

You can configure multiple service classes at the parent level to match different combinations of VLANs, and you can

apply independent QoS policies to each parent-service class using any child policy map

A policy is considered a parent policy map when it has one or more of its classes associated with a child policy map.

Each class within a parent policy-map is called a parent-class. In parent classes, you can configure only the match

vlan class-map configuration command. You cannot configure the match vlan command in classes within the child

policy map.

A per-port, per-VLAN parent level class map supports only a child-policy association; it does not allow any actions

to be configured. For a parent-level class map, you cannot configure an action or a child-policy association for the

class class-default.

665

Configuring QoS

You cannot configure a mixture of Layer 2 and Layer 3 class maps in a child policy map. When you attempt to

associate such a child policy map with a parent policy, the configuration is rejected. However, you can associate

Layer 2 child policies and Layer 3 child policies with different parent-level class maps.

Per-port, per-VLAN QoS is supported only on 802.1Q trunk ports.

When the child policy-map attached to a VLAN or set of VLANs contains only Layer 3 classification (match ip dscp,

match ip precedence, match IP ACLs), take care to ensure that these VLANs are not carried on any other port

besides the one on which the per-port, per-vlan policy is attached. Not following this rule could result in improper

QoS behavior for traffic ingressing the switch on these VLANs.

We also recommend that you restrict VLAN membership on the trunk ports to which the per-port, per-VLAN is

applied by using the switchport trunk allowed vlan interface configuration command. Overlapping VLAN

membership between trunk ports that have per-port, per-VLAN policies with Layer 3 classification could also result

in unexpected QoS behavior.

Configuring per-port, per-VLAN QoS includes these tasks:

Creating Child-Policy Class Maps, page 666

Creating Parent-Policy Class Maps, page 668

Creating Child Policy Maps, page 668

Creating a Parent Policy Map, page 669

Attaching a Parent Policy Map to an Interface, page 669

Creating Child-Policy Class Maps

Beginning in privileged EXEC mode, follow these steps to create one or more child-policy class maps:

666

Cisco Industrial Ethernet 4000, 4010 and 5000 Switch Software. Configuration Guide (2022) - page 24