Cisco ASR 900 Series User manual

QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release
3S (Cisco ASR 900 Series)
First Published: 2011-11-03
Last Modified: 2014-03-01
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2017 Cisco Systems, Inc. All rights reserved.

CONTENTS
CHAPTER 1 Class-Based Policing 1
Finding Feature Information 1
Information About Class-Based Policing 1
Class-Based Policing Functionality 1
Benefits of Class-Based Policing 2
Restrictions for Class-Based Policing 2
How to Configure Class-Based Policing 3
Configuring a Traffic Policing Service Policy 3
Monitoring and Maintaining Traffic Policing 5
Verifying Class-Based Traffic Policing 6
Troubleshooting Tips 7
Configuration Examples for Class-Based Policing 8
Example Configuring a Service Policy That Includes Traffic Policing 8
Verifying Class-Based Traffic Policing 9
Additional References 10
Feature Information for Class-Based Policing 12
CHAPTER 2 Punt Policing and Monitoring 13
Finding Feature Information 13
Information About Punt Policing and Monitoring 14
Overview of Punt Policing and Monitoring 14
Limitation of Punt Policing and Monitoring 14
How to Configure Punt Policing and Monitoring 14
Configuring Punt Policing 14
Verifying Punt Policing 15
Verifying Punt Policing Statistics 15
Configuration Examples for Punt Policing and Monitoring 17
Example: Configuring Punt Policing 17
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
iii

Additional References 17
Feature Information for Punt Policing and Monitoring 19
CHAPTER 3 Port-Shaper and LLQ in the Presence of EFPs 21
Finding Feature Information 21
Restrictions for Port-Shaper and LLQ in the Presence of EFPs 21
Information About Port-Shaper and LLQ in the Presence of EFPs 22
Ethernet Flow Points and LLQ 22
How to Configure Port-Shaper and LLQ in the Presence of EFPs 22
Configuring Hierarchical Policy Maps 22
Configuring Class-default Port-Shaper Policy Maps 25
Configuring Port-Shaper Policy Maps 26
Configuring an LLQ Policy Map 27
Configuring Port Level Shaping on the Main Interface with Ethernet Flow Points 29
Configuration Examples for Port-Shaper and LLQ in the Presence of EFPs 32
Example: Configuring Hierarchical QoS Port Level Shaping on the Main Interface with
EFPs 32
Configuration Example: Class-default Port-Shaper and EFP policy 32
Example: Configuring Port Level Shaping on the Main Interface with EFPs 33
Additional References 33
Feature Information for Port-Shaper and LLQ in the Presence of EFPs 34
CHAPTER 4 Control Plane Policing 37
Finding Feature Information 37
Restrictions for Control Plane Policing 38
Information About Control Plane Policing 38
Benefits of Control Plane Policing 38
Control Plane Terms to Understand 38
Control Plane Policing Overview 39
Supported Protocols 39
Input Rate-Limiting and Silent Mode Operation 44
How to Use Control Plane Policing 44
Defining Control Plane Services 44
Verifying Control Plane Services 45
Configuring Control Plane Policing to Mitigate Denial-of-Service Attacks 46
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
iv
Contents

Configuration Examples for Control Plane Policing 50
Example: Configuring Control Plane Policing on Input Telnet Traffic 50
Additional References 50
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
v
Contents

QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
vi
Contents

CHAPTER 1
Class-Based Policing
Class-based policing allows you to control the maximum rate of traffic that is transmitted or received on an
interface. Class-based policing is often configured on interfaces at the edge of a network to limit traffic into
or out of the network.
•Finding Feature Information, page 1
•Information About Class-Based Policing, page 1
•Restrictions for Class-Based Policing, page 2
•How to Configure Class-Based Policing, page 3
•Configuration Examples for Class-Based Policing, page 8
•Additional References, page 10
•Feature Information for Class-Based Policing, page 12
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and
feature information, see Bug Search Tool and the release notes for your platform and software release. To
find information about the features documented in this module, and to see a list of the releases in which each
feature is supported, see the feature information table.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support.
To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Information About Class-Based Policing
Class-Based Policing Functionality
The Class-Based Policing feature performs the following functions:
•Limits the input or output transmission rate of a class of traffic based on user-defined criteria.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
1

The output transmission rate of a class of traffic based on user-defined criteria is not
supported on the Cisco ASR 900 RSP3 Module.
Note
Class-based policing allows you to control the maximum rate of traffic transmitted or received on an interface.
The Class-Based Policing feature is applied when you attach a traffic policy that contains the class-based
policing configuration to an interface.
The Class-Based Policing feature works with a token bucket mechanism. There are currently two types of
token bucket algorithms: a single token bucket algorithm and a two-token bucket algorithm. A single token
bucket system is used when the violate-action option is not specified, and a two-token bucket system is used
when the violate-action option is specified.
Benefits of Class-Based Policing
Bandwidth Management Through Rate Limiting
Class-based policing allows you to control the maximum rate of traffic transmitted or received on an interface.
Class-based policing is often configured on interfaces at the edge of a network to limit traffic into or out of
the network. In most class-based policing configurations, traffic that falls within the rate parameters is
transmitted, whereas traffic that exceeds the parameters is dropped or transmitted with a different priority.
Packet Marking
Packet marking allows you to partition your network into multiple priority levels or classes of service (CoS).
A packet is marked and these markings can be used to identify and classify traffic for downstream devices.
•Use class-based policing to set the IP precedence or DSCP values for packets entering the network.
Networking devices within your network can then use the adjusted IP precedence values to determine
how the traffic should be treated.
•Use class-based policing to assign packets to a QoS group. The router uses the QoS group to determine
how to prioritize packets.
Traffic can be marked without using the Class-Based Policing feature.
Restrictions for Class-Based Policing
Restrictions for the Cisco ASR 900 Router
•Hierarchical policing (policing at both parent level and child level) is not supported.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
2
Class-Based Policing
Benefits of Class-Based Policing

The following are not supported on the Cisco ASR 900 RSP3 Module:
Note
•Class-based policing on subinterfaces
•Policy-map on BDI interface
•Egress Policer
How to Configure Class-Based Policing
Configuring a Traffic Policing Service Policy
SUMMARY STEPS
1. enable
2. configure terminal
3. class-map [match-all |match-any]class-map-name
4. match ip precedence precedence-value
5. exit
6. policy-map policy-map-name
7. class {class-name |class-default}
8. police bps burst-normal burst-max conform-action action exceed-action action violate-action action
9. exit
10. exit
11. interface interface-type interface-number
12. service-policy {input |output}policy-map-name
13. end
DETAILED STEPS
PurposeCommand or Action
Enables higher privilege levels, such as privileged EXEC mode.enable
Step 1
Example:
Router> enable
•Enter your password if prompted.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
3
Class-Based Policing
How to Configure Class-Based Policing

PurposeCommand or Action
Enters global configuration mode.configure terminal
Example:
Router# configure terminal
Step 2
Specifies the name of the class map to be created and enters QoS
class map configuration mode.
class-map [match-all |match-any]
class-map-name
Step 3
Example:
Router(config)# class-map match-any
MATCH_PREC
•The class map defines the criteria to use to differentiate the
traffic. For example, you can use the class map to differentiate
voice traffic from data traffic, based on a series of match
criteria defined using the match command.
If the match-all or match-any keyword is not specified,
traffic must match all the match criteria to be classified
as part of the traffic class.
Note
Enables packet matching on the basis of the IP precedence values
you specify.
match ip precedence precedence-value
Example:
Router(config-cmap)# match ip precedence
0
Step 4
You can enter up to four matching criteria, as number
abbreviation (0 to 7) or criteria names (critical, flash, and
so on), in a single match statement.
Note
Returns to global configuration mode.exit
Example:
Router(config-cmap)# exit
Step 5
Creates or modifies a policy map that can be attached to one or
more interfaces to specify a service policy, and enters QoS
policy-map configuration mode.
policy-map policy-map-name
Example:
Router(config)# policy-map POLICE-SETTING
Step 6
Specifies the name of the class whose policy you want to create or
change or specifies the default class (commonly known as the
class {class-name |class-default}
Example:
Router(config-pmap)# class MATCH_PREC
Step 7
class-default class) before you configure its policy, and enters
policy-map class configuration mode.
Configures traffic policing according to burst sizes and any optional
actions specified.
police bps burst-normal burst-max
conform-action action exceed-action action
violate-action action
Step 8
Example:
Router(config-pmap-c)# police 8000 1000
1000 conform-action transmit exceed-action
set-qos-transmit 1 violate-action drop
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
4
Class-Based Policing
Configuring a Traffic Policing Service Policy

PurposeCommand or Action
(Optional) Exits policy-map class configuration mode.exit
Example:
Router(config-pmap-c)# exit
Step 9
(Optional) Exits QoS policy-map configuration mode.exit
Example:
Router(config-pmap)# exit
Step 10
Configures an interface type and enters interface configuration
mode.
interface interface-type interface-number
Example:
Router(config)# interface GigabitEthernet
0/0/1
Step 11
•Enter the interface type and interface number.
Attaches a policy map to an interface.
service-policy {input |output}policy-map-name
Step 12
Example:
Router(config-if)# service-policy input
POLICE-SETTING
•Enter either the input or output keyword and the policy map
name.
(Optional) Exits interface configuration mode and returns to
privileged EXEC mode.
end
Example:
Router(config-if)# end
Step 13
Monitoring and Maintaining Traffic Policing
SUMMARY STEPS
1. enable
2. show policy-map
3. show policy-map policy-map-name
4. show policy-map interface
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
5
Class-Based Policing
Monitoring and Maintaining Traffic Policing

DETAILED STEPS
PurposeCommand or Action
Enables privileged EXEC mode.enable
Step 1
Example:
Router> enable
•Enter your password if prompted.
Displays all configured policy maps.show policy-map
Example:
Router# show policy-map
Step 2
Displays the user-specified policy map.
show policy-map policy-map-name
Example:
Router# show policy-map pmap
Step 3
Verifies that the Class-Based Policing feature is configured
on your interface. If the feature is configured on your interface.
show policy-map interface
Example:
Router# show policy-map interface
Step 4
•The command output displays policing statistics.
Verifying Class-Based Traffic Policing
Use the show policy-map interface command to verify that the Class-Based Policing feature is configured
on your interface. If the feature is configured on your interface, the show policy-map interface command
output displays policing statistics.
SUMMARY STEPS
1. enable
2. show policy-map interface
3. show policy-map interface type interface
4. show policy-map interface type interface service instance service-instance number
5. exit
DETAILED STEPS
PurposeCommand or Action
Enables privileged EXEC mode.enable
Step 1
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
6
Class-Based Policing
Verifying Class-Based Traffic Policing

PurposeCommand or Action
Example:
Router> enable
•Enter your password if prompted.
Verifies that the Class-Based Policing feature is configured
on your interface. If the feature is configured on your
interface.
show policy-map interface
Example:
Router# show policy-map interface
Step 2
•The command output displays policing statistics.
Displays traffic statistics for policies applied to a specific
interface.
show policy-map interface type interface
Example:
Router# show policy-map interface
GigabitEthernet 0/0/1
Step 3
Displays the policy map information for a given service
instance under an interface.
show policy-map interface type interface service
instance service-instance number
Example:
Router# show policy-map interface
GigabitEthernet 0/0/1 service instance 1
Step 4
(Optional) Exits privileged EXEC mode.exit
Example:
Router# exit
Step 5
Example: Verifying Class-Based Traffic Policing
Router# show policy-map interface
FastEthernet1/1/1
service-policy output: x
class-map: a (match-all)
0 packets, 0 bytes
5 minute rate 0 bps
match: ip precedence 0
police:
1000000 bps, 10000 limit, 10000 extended limit
conformed 0 packets, 0 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
conformed 0 bps, exceed 0 bps, violate 0 bps
Troubleshooting Tips
Check the interface type. Verify that class-based policing is supported on your interface. .
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
7
Class-Based Policing
Verifying Class-Based Traffic Policing

Configuration Examples for Class-Based Policing
Example Configuring a Service Policy That Includes Traffic Policing
In the following example, class-based policing is configured with the average rate at 8000 bits per second,
the normal burst size at 1000 bytes, and the excess burst size at 1000 bytes for all packets leaving the interface.
class-map access-match
match access-group 1
exit
policy-map police-setting
class access-match
police 8000 1000 1000 conform-action transmit exceed-action set-qos-transmit 1
violate-action drop
exit
exit
service-policy output police-setting
The treatment of a series of packets leaving FastEthernet interface 1/1/1 depends on the size of the packet and
the number of bytes remaining in the conform and exceed token buckets. The series of packets are policed
based on the following rules:
•If the previous arrival of the packet was at T1 and the current arrival of the packet is at T, the bucket is
updated with T - T1 worth of bits based on the token arrival rate. The refill tokens are placed in the
conform bucket. If the tokens overflow the conform bucket, the overflow tokens are placed in the exceed
bucket. The token arrival rate is calculated as follows:
(time between packets < which is equal to T - T1 > * policer rate)/8 bytes
•If the number of bytes in the conform bucket is greater than the length of the packet (for example, B),
then the packet conforms and B bytes should be removed from the bucket. If the packet conforms, B
bytes are removed from the conform bucket and the conform action is taken. The exceed bucket is
unaffected in this scenario.
•If the number of bytes in the conform bucket is less than the length of the packet, but the number of
bytes in the exceed bucket is greater than the length of the packet (for example, B), the packet exceeds
and B bytes are removed from the bucket.
•If the number bytes in the exceed bucket B is fewer than 0, the packet violates the rate and the violate
action is taken. The action is complete for the packet.
In this example, the initial token buckets starts full at 1000 bytes. If a 450-byte packet arrives, the packet
conforms because enough bytes are available in the conform token bucket. The conform action (send) is taken
by the packet, and 450 bytes are removed from the conform token bucket (leaving 550 bytes).
If the next packet arrives 0.25 seconds later, 250 bytes are added to the conform token bucket ((0.25 * 8000)/8),
leaving 800 bytes in the conform token bucket. If the next packet is 900 bytes, the packet does not conform
because only 800 bytes are available in the conform token bucket.
The exceed token bucket, which starts full at 1000 bytes (as specified by the excess burst size, is then checked
for available bytes. Because enough bytes are available in the exceed token bucket, the exceed action (set the
QoS transmit value of 1) is taken, and 900 bytes are taken from the exceed bucket (leaving 100 bytes in the
exceed token bucket).
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
8
Class-Based Policing
Configuration Examples for Class-Based Policing

If the next packet arrives 0.40 seconds later, 400 bytes are added to the token buckets ((.40 * 8000)/8).
Therefore, the conform token bucket now has 1000 bytes (the maximum number of tokens available in the
conform bucket, and 200 bytes overflow the conform token bucket (because only 200 bytes were needed to
fill the conform token bucket to capacity). These overflow bytes are placed in the exceed token bucket, giving
the exceed token bucket 300 bytes.
If the arriving packet is 1000 bytes, the packet conforms because enough bytes are available in the conform
token bucket. The conform action (transmit) is taken by the packet, and 1000 bytes are removed from the
conform token bucket (leaving 0 bytes).
If the next packet arrives 0.20 seconds later, 200 bytes are added to the token bucket ((.20 * 8000)/8). Therefore,
the conform bucket now has 200 bytes. If the arriving packet is 400 bytes, the packet does not conform because
only 200 bytes are available in the conform bucket. Similarly, the packet does not exceed because only 300
bytes are available in the exceed bucket. Therefore, the packet violates and the violate action (drop) is taken.
Verifying Class-Based Traffic Policing
Use the show policy-map interface command to verify that the Class-Based Policing feature is configured
on your interface. If the feature is configured on your interface, the show policy-map interface command
output displays policing statistics:
Router# show policy-map interface
FastEthernet1/1/1
service-policy output: x
class-map: a (match-all)
0 packets, 0 bytes
5 minute rate 0 bps
match: ip precedence 0
police:
1000000 bps, 10000 limit, 10000 extended limit
conformed 0 packets, 0 bytes; action: transmit
exceeded 0 packets, 0 bytes; action: drop
conformed 0 bps, exceed 0 bps, violate 0 bps
Use the show policy-map interface type nummber command to view the traffic statistics for policies applied
to that specific interface:
Router# show policy-map interface gigabitethernet 0/0/1
GigabitEthernet0/0/1
Service-policy input: TUNNEL_MARKING
Class-map: MATCH_PREC (match-any)
72417 packets, 25418367 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: ip precedence 0
QoS Set
ip precedence tunnel 3
Marker statistics: Disabled
Class-map: MATCH_DSCP (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: ip dscp default (0)
QoS Set
ip dscp tunnel 3
Marker statistics: Disabled
Class-map: class-default (match-any)
346462 packets, 28014400 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: any
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
9
Class-Based Policing
Verifying Class-Based Traffic Policing

Service-policy output: POLICE-SETTING
Class-map: MATCH_PREC (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: ip precedence 0
police:
cir 8000 bps, bc 1000 bytes, be 1000 bytes
conformed 0 packets, 0 bytes; actions:
transmit
exceeded 0 packets, 0 bytes; actions:
set-qos-transmit 1
violated 0 packets, 0 bytes; actions:
drop
conformed 0000 bps, exceed 0000 bps, violate 0000 bps
Class-map: class-default (match-any)
31 packets, 2019 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: any
Use the show policy-map interface service instance command to view the traffic statistics for policy applied
to the specific service instance in that specific interface:
Router# show policy-map interface gig0/0/1 service instance 10
GigabitEthernet0/0/1: EFP 10
Service-policy input: ac1
Class-map: ac1 (match-all)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group 1
police:
cir 50000000 bps, bc 1562500 bytes
conformed 0 packets, 0 bytes; actions:
transmit
exceeded 0 packets, 0 bytes; actions:
drop
conformed 0000 bps, exceeded 0000 bps
Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: any
Additional References
Related Documents
Document TitleRelated Topic
Cisco IOS Quality of Service Solutions Command
Reference
QoS commands: complete command syntax,
command modes, command history, defaults, usage
guidelines, and examples
“Marking Network Traffic”module
Traffic marking
“Traffic Policing”module
Traffic policing
“Policing and Shaping Overview”
Traffic policing and shaping concepts and overview
information
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
10
Class-Based Policing
Additional References

Document TitleRelated Topic
“Applying QoS Features Using the MQC”module
Modular Quality of Service Command-Line Interface
(MQC)
Standards
TitleStandard
--None
MIBs
MIBs LinkMIB
To locate and download MIBs for selected platforms,
Cisco IOS XE Software releases, and feature sets, use
Cisco MIB Locator found at the following URL:
http://www.cisco.com/go/mibs
Class-Based Quality of Service MIB
•CISCO-CLASS-BASED-QOS-MIB
•CISCO-CLASS-BASED-QOS-CAPABILITY-MIB
RFCs
TitleRFC
A Single Rate Three Color Marker
RFC 2697
Technical Assistance
LinkDescription
http://www.cisco.com/cisco/web/support/index.html
The Cisco Support and Documentation website
provides online resources to download documentation,
software, and tools. Use these resources to install and
configure the software and to troubleshoot and resolve
technical issues with Cisco products and technologies.
Access to most tools on the Cisco Support and
Documentation website requires a Cisco.com user ID
and password.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
11
Class-Based Policing
Additional References

Feature Information for Class-Based Policing
The following table provides release information about the feature or features described in this module. This
table lists only the software release that introduced support for a given feature in a given software release
train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support.
To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1: Feature Information for Class-Based Policing
Feature InformationReleasesFeature Name
This feature was introduced on
Cisco ASR 1000 Series Routers.
In Cisco IOS XE Release 3.5S,
support was added for the Cisco
ASR 903 Router.
In Cisco IOS XE Release 3.16,
support was added for the Cisco
ASR 900 RSP3 Module.
The following command was
introduced or modified: police.
Cisco IOS XE Release 2.1
Cisco IOS XE Release 3.5S
Cisco IOS XE Release 3.16
Class-Based Policing
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
12
Class-Based Policing
Feature Information for Class-Based Policing

CHAPTER 2
Punt Policing and Monitoring
Punt Policing and Monitoring chapter is not supported on the Cisco ASR 900 RSP3 Module.
Note
Punt policing protects the Route Processor (RP) from having to process noncritical traffic, which increases
the CPU bandwidth available to critical traffic. Traffic is placed into different CPU queues based on various
criteria. The Punt Policing and Monitoring feature allows you to police the punt rate on a per-queue basis.
•Finding Feature Information, page 13
•Information About Punt Policing and Monitoring, page 14
•Limitation of Punt Policing and Monitoring, page 14
•How to Configure Punt Policing and Monitoring, page 14
•Configuration Examples for Punt Policing and Monitoring, page 17
•Additional References, page 17
•Feature Information for Punt Policing and Monitoring, page 19
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and
feature information, see Bug Search Tool and the release notes for your platform and software release. To
find information about the features documented in this module, and to see a list of the releases in which each
feature is supported, see the feature information table.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support.
To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
13

Information About Punt Policing and Monitoring
Overview of Punt Policing and Monitoring
Packets received on an interface are punted to the Router Processor (RP) for various reasons. Some examples
of these various reasons include, unicast and multicast control plane traffic that are destined for a routing
protocol process running on the RP, and IP packets that generate Internet Control Message Protocol (ICMP)
exceptions such as a Time to live (TTL) expiration. The RP has a limited capacity to process the punted
packets, and while some of them are critical for the router operation and should not be dropped, some can be
dropped without impacting the router operation.
Punt policing frees the RP from having to process noncritical traffic. Traffic is placed in queues based on
various criteria, and you can configure the maximum punt rate for each queue which allows you to configure
the system so that packets are less likely to be dropped from queues that contain critical traffic.
Traffic on certain CPU queues could still be dropped, regardless of the configured punt rate, based on
other criteria such as the queue priority, queue size, and traffic punt rate.
Note
Limitation of Punt Policing and Monitoring
•Most of the packets destined to the router get punted to CPU via HOST Queue. If any particular protocol
packets are getting punted to CPU in excess, other protocols might suffer although the CPU is protected
by the overall punt rate configured for the queue.
How to Configure Punt Policing and Monitoring
Configuring Punt Policing
Traffic on a specific CPU queue may be dropped irrespective of the configured maximum punt rate, based
on the queue priority, queue size, and the configured traffic punt rate.
Note
Perform this task to specify the maximum punt rate on the specified queue.
SUMMARY STEPS
1. enable
2. configure terminal
3. platform qos-policer queue queue-id cir
4. end
QoS: Policing and Shaping Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series)
14
Punt Policing and Monitoring
Information About Punt Policing and Monitoring