Cisco ASR 900 Series User manual

QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release
3S (Cisco ASR 900 Series)
First Published: 2011-11-03
Last Modified: 2014-03-01
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
CHAPTER 1 Class-Based Policing 1
Finding Feature Information 1
Information About Class-Based Policing 1
Class-Based Policing Functionality 1
Benefits of Class-Based Policing 2
Restrictions for Class-Based Policing 2
How to Configure Class-Based Policing 3
Configuring a Traffic Policing Service Policy 3
Monitoring and Maintaining Traffic Policing 5
Verifying Class-Based Traffic Policing 6
Troubleshooting Tips 7
Configuration Examples for Class-Based Policing 8
Example Configuring a Service Policy That Includes Traffic Policing 8
Verifying Class-Based Traffic Policing 9
Additional References 10
Feature Information for Class-Based Policing 12
CHAPTER 2 Punt Policing and Monitoring 13
Finding Feature Information 13
Information About Punt Policing and Monitoring 14
Overview of Punt Policing and Monitoring 14
Limitation of Punt Policing and Monitoring 14
How to Configure Punt Policing and Monitoring 14
Configuring Punt Policing 14
Verifying Punt Policing 15
Verifying Punt Policing Statistics 15
Configuration Examples for Punt Policing and Monitoring 17
Example: Configuring Punt Policing 17
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
iii

Additional References 17
Feature Information for Punt Policing and Monitoring 19
CHAPTER 3 Port-Shaper and LLQ in the Presence of EFPs 21
Finding Feature Information 21
Restrictions for Port-Shaper and LLQ in the Presence of EFPs 21
Information About Port-Shaper and LLQ in the Presence of EFPs 22
Ethernet Flow Points and LLQ 22
How to Configure Port-Shaper and LLQ in the Presence of EFPs 22
Configuring Hierarchical Policy Maps 22
Configuring Class-default Port-Shaper Policy Maps 25
Configuring Port-Shaper Policy Maps 26
Configuring an LLQ Policy Map 27
Configuring Port Level Shaping on the Main Interface with Ethernet Flow Points 29
Configuration Examples for Port-Shaper and LLQ in the Presence of EFPs 32
Example: Configuring Hierarchical QoS Port Level Shaping on the Main Interface with
EFPs 32
Configuration Example: Class-default Port-Shaper and EFP policy 32
Example: Configuring Port Level Shaping on the Main Interface with EFPs 33
Additional References 33
Feature Information for Port-Shaper and LLQ in the Presence of EFPs 34
CHAPTER 4 Control Plane Policing 37
Finding Feature Information 37
Restrictions for Control Plane Policing 38
Information About Control Plane Policing 38
Benefits of Control Plane Policing 38
Control Plane Terms to Understand 38
Control Plane Policing Overview 39
Supported Protocols 39
Input Rate-Limiting and Silent Mode Operation 44
How to Use Control Plane Policing 44
Defining Control Plane Services 44
Verifying Control Plane Services 45
Configuring Control Plane Policing to Mitigate Denial-of-Service Attacks 46
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
iv
Contents

Configuration Examples for Control Plane Policing 50
Example: Configuring Control Plane Policing on Input Telnet Traffic 50
Additional References 50
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
v
Contents

QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
vi
Contents

CHAPTER 1
Class-Based Policing
Class-based policing allows you to control the maximum rate of traffic that is transmitted or received on an
interface. Class-based policing is often configured on interfaces at the edge of a network to limit traffic into
or out of the network.
•Finding Feature Information, page 1
•Information About Class-Based Policing, page 1
•Restrictions for Class-Based Policing, page 2
•How to Configure Class-Based Policing, page 3
•Configuration Examples for Class-Based Policing, page 8
•Additional References, page 10
•Feature Information for Class-Based Policing, page 12
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and
feature information, see Bug Search Tool and the release notes for your platform and software release. To
find information about the features documented in this module, and to see a list of the releases in which each
feature is supported, see the feature information table.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support.
To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Information About Class-Based Policing
Class-Based Policing Functionality
The Class-Based Policing feature performs the following functions:
•Limits the input or output transmission rate of a class of traffic based on user-defined criteria.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
1

The output transmission rate of a class of traffic based on user-defined criteria is not
supported on the Cisco ASR 900 RSP3 Module.
Note
Class-based policing allows you to control the maximum rate of traffic transmitted or received on an interface.
The Class-Based Policing feature is applied when you attach a traffic policy that contains the class-based
policing configuration to an interface.
The Class-Based Policing feature works with a token bucket mechanism. There are currently two types of
token bucket algorithms: a single token bucket algorithm and a two-token bucket algorithm. A single token
bucket system is used when the violate-action option is not specified, and a two-token bucket system is used
when the violate-action option is specified.
Benefits of Class-Based Policing
Bandwidth Management Through Rate Limiting
Class-based policing allows you to control the maximum rate of traffic transmitted or received on an interface.
Class-based policing is often configured on interfaces at the edge of a network to limit traffic into or out of
the network. In most class-based policing configurations, traffic that falls within the rate parameters is
transmitted, whereas traffic that exceeds the parameters is dropped or transmitted with a different priority.
Packet Marking
Packet marking allows you to partition your network into multiple priority levels or classes of service (CoS).
A packet is marked and these markings can be used to identify and classify traffic for downstream devices.
•Use class-based policing to set the IP precedence or DSCP values for packets entering the network.
Networking devices within your network can then use the adjusted IP precedence values to determine
how the traffic should be treated.
•Use class-based policing to assign packets to a QoS group. The router uses the QoS group to determine
how to prioritize packets.
Traffic can be marked without using the Class-Based Policing feature.
Restrictions for Class-Based Policing
Restrictions for the Cisco ASR 900 Router
•Hierarchical policing (policing at both parent level and child level) is not supported.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
2
Class-Based Policing
Benefits of Class-Based Policing

The following are not supported on the Cisco ASR 900 RSP3 Module:
Note
•Class-based policing on subinterfaces
•Policy-map on BDI interface
•Egress Policer
How to Configure Class-Based Policing
Configuring a Traffic Policing Service Policy
SUMMARY STEPS
1. enable
2. configure terminal
3. class-map [match-all |match-any]class-map-name
4. match ip precedence precedence-value
5. exit
6. policy-map policy-map-name
7. class {class-name |class-default}
8. police bps burst-normal burst-max conform-action action exceed-action action violate-action action
9. exit
10. exit
11. interface interface-type interface-number
12. service-policy {input |output}policy-map-name
13. end
DETAILED STEPS
PurposeCommand or Action
Enables higher privilege levels, such as privileged EXEC mode.enable
Step 1
Example:
Router> enable
•Enter your password if prompted.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
3
Class-Based Policing
How to Configure Class-Based Policing

PurposeCommand or Action
Enters global configuration mode.configure terminal
Example:
Router# configure terminal
Step 2
Specifies the name of the class map to be created and enters QoS
class map configuration mode.
class-map [match-all |match-any]
class-map-name
Step 3
Example:
Router(config)# class-map match-any
MATCH_PREC
•The class map defines the criteria to use to differentiate the
traffic. For example, you can use the class map to differentiate
voice traffic from data traffic, based on a series of match
criteria defined using the match command.
If the match-all or match-any keyword is not specified,
traffic must match all the match criteria to be classified
as part of the traffic class.
Note
Enables packet matching on the basis of the IP precedence values
you specify.
match ip precedence precedence-value
Example:
Router(config-cmap)# match ip precedence
0
Step 4
You can enter up to four matching criteria, as number
abbreviation (0 to 7) or criteria names (critical, flash, and
so on), in a single match statement.
Note
Returns to global configuration mode.exit
Example:
Router(config-cmap)# exit
Step 5
Creates or modifies a policy map that can be attached to one or
more interfaces to specify a service policy, and enters QoS
policy-map configuration mode.
policy-map policy-map-name
Example:
Router(config)# policy-map POLICE-SETTING
Step 6
Specifies the name of the class whose policy you want to create or
change or specifies the default class (commonly known as the
class {class-name |class-default}
Example:
Router(config-pmap)# class MATCH_PREC
Step 7
class-default class) before you configure its policy, and enters
policy-map class configuration mode.
Configures traffic policing according to burst sizes and any optional
actions specified.
police bps burst-normal burst-max
conform-action action exceed-action action
violate-action action
Step 8
Example:
Router(config-pmap-c)# police 8000 1000
1000 conform-action transmit exceed-action
set-qos-transmit 1 violate-action drop
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
4
Class-Based Policing
Configuring a Traffic Policing Service Policy