Hierarchical Color-Aware Policing
First Published: November 24, 2010
Last Updated: March 23, 2011
The Hierarchical Color-Aware Policing feature provides two levels of policing where the policer ordering is evaluated from child to parent, and there is preferential treatment of certain traffic at the parent level. Beginning in Cisco IOS XE Release 3.2S, this feature is enabled on the Cisco ASR 1000 series Aggregation Services Routers through the following support and changes:
•Reverse the order of dataplane policing in hierarchical policies so that they are evaluated from child to parent. In prior releases, the policies are evaluated from parent to child.
•Limited support for color-aware policing (RFC 2697 and RFC 2698) within Quality of Service (QoS) policies.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Hierarchical Color-Aware Policing" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•Prerequisites for Hierarchical Color-Aware Policing
•Restrictions for Hierarchical Color-Aware Policing
•Information About Hierarchical Color-Aware Policing
•How to Configure Hierarchical Color-Aware Policing
•Configuration Examples for Hierarchical Color-Aware Policing
•Additional References
•Feature Information for Hierarchical Color-Aware Policing
•Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Prerequisites for Hierarchical Color-Aware Policing
You must have Cisco IOS XE Release 3.2S or a later version installed and running on your Cisco ASR 1000 series router.
You must already be familiar with relevant features and technologies including modular QoS CLI (MQC) and the master control processor (MCP) software and hardware architecture. The "Additional References" section provides pointers to relevant feature and technology documents.
Restrictions for Hierarchical Color-Aware Policing
The following restrictions apply to the Hierarchical Color-Aware Policing feature:
•Color-aware class maps support only QoS group matching.
•Only one filter (one match statement) per color-aware class is supported.
•Color-aware statistics are not supported, only existing policer statistics.
•Color-aware class map removal (using the no class-map class-map-name command) is not allowed while the class map is being referenced in a color-aware policer. It must be removed from all color-aware policers (using either the no conform-color class-map-name or no exceed-color class-map-name command first).
•Hierarchical policer evaluation is permanently reversed (not configurable) to support child-to-parent ordering.
Information About Hierarchical Color-Aware Policing
•Hierarchical Order Policing
•Limited Color-Aware Policing
•Policing Traffic in Child Classes and Parent Classes
Hierarchical Order Policing
Prior to Cisco IOS XE Release 3.2S, the Cisco ASR 1000 series platform supported policers in hierarchical policies with an evaluation order of parent to child. With the introduction of the Hierarchical Color-Aware Policing feature, the evaluation order is reversed so that policers are evaluated from child to parent in QoS policies. This ordering is a permanent change to the default behavior and is not configurable. The reverse order policer functionality is shared for both ingress and egress directions.
The following sample configuration for a simple two-level policer would result in the changed behavior shown in Figure 1:
Figure 1
Changed Behavior for a Two-Level Policer
Limited Color-Aware Policing
The following sample configuration for a simple two-level color-aware policer would result in the changed behavior shown in Figure 2:
ip access-list extended user1-acl
permit ip host 192.168.1.1 any
permit ip host 192.168.1.2 any
ip access-list extended user2-acl
permit ip host 192.168.2.1 any
permit ip host 192.168.2.2 any
class-map match-all user1-acl-child
match access-group name user1-acl
class-map match-all user2-acl-child
match access-group name user2-acl
class-map match-all hipri-conform
conform-action set-qos-transmit 5
conform-action set-qos-transmit 5
conform-color hipri-conform
service-policy child-policy
Figure 2
Simple Two-Level Color-Aware Policer
Note To avoid drops at the parent level for "conformed" child traffic, the parent policer must have a rate and burst that are equal to or greater than the sum of the child conform rates and burst sizes. There is no check for inappropriate (parent-to-child) rates and burst sizes in code.
You must be aware of this limitation and configure appropriately. In the following example, explicit marking actions are supported in conjunction with color-aware policing and operate similarly color-aware policer marking actions. If these marking actions ("set qos-group," for example) are present in the child policies, the resulting bit values are evaluated by the parent color-aware policer (same as for child policer marking actions):
50k >= 10k (user1-acl-child) + 20k (user2-acl-child)
Policing Traffic in Child Classes and Parent Classes
Prior to the release of the Hierarchical Color-Aware Policing feature, policing and marking were typically used as input QoS options. For example, a voice customer was limited to 112 kb/s for voice control and 200 kb/s for voice traffic. The class-default class has no policer. The only limit is the physical bandwidth of the xDSL connection. As shown in Figure 3, a customer could send up to 1000 kb/s. However, this involved sending more voice and voice-control packets, which required policing the traffic for both classes.
Figure 3 Policing Traffic in Child Classes
As shown in Figure 4, it is important to control the overall input bandwidth. The important requirement is that the premium traffic in the overall limit is not affected. In Figure 4, voice and voice-control packets are not dropped in the overall limit. Only packets from the child class-default class are dropped to fulfill the limit.
Figure 4 Policing Traffic in Parent Classes
The first classes function the same way. Voice and voice-control are policed to the allowed level and the class-default class is not affected. In the next level, the overall bandwidth is forced to 500 kb/s and must only drop packets from the class-default class. Voice and voice-control must remain unaffected.
The order of policer execution is as follows:
1. Police the traffic in the child classes, as shown in Figure 3, police VoIP-Control class to 112 kb/s, police VoIP class to 200 kb/s, and police class-default to 500 kb/s.
2. Police the traffic in the class default of the parent policy map, but only drop the traffic from the child class default, and do not drop the remaining child classes. As shown in Figure 4, 112 kb/s VoIP-Control and 200 kb/s VoIP traffic are unaffected at the parent policer, but 500 kb/s class default from the child is policed to 188kb/s to meet the overall police policy of 500 kb/s at the parent level.
How to Configure Hierarchical Color-Aware Policing
Configuring the Hierarchical Color-Aware Policing Feature
SUMMARY STEPS
1. enable
2. configure terminal
3. policy-map policy-map-name
4. class {class-name | class-default [fragment fragment-class-name]} [insert-before class-name] [service-fragment fragment-class-name]
5. police [cir cir] [bc conform-burst] [pir pir] [be peak-burst] [conform-action action [exceed-action action [violate-action action]]] [conform-color hipr-conform]
6. service-policy policy-map-name
7. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
policy-map policy-map-name
Router(config)# policy-map parent-policy |
Enters policy-map configuration mode and creates a policy map. |
Step 4 |
class {class-name | class-default [fragment fragment-class-name]} [insert-before class-name] [service-fragment fragment-class-name]
Router(config-pmap)# class class-default |
Enters policy-map class configuration mode. •Specifies the name of the class whose policy you want to create or change or specifies the default class (commonly known as the class-default class) before you configure its policy. Repeat this command as many times as necessary to specify the child or parent classes that you are creating or modifying: •class name—Name of the class to be configured or whose policy is to be modified. The class name is used for both the class map and to configure a policy for the class in the policy map. •class-default—Specifies the default class so that you can configure or modify its policy. •fragment fragment-class-name—(Optional) Specifies the default traffic class as a fragment, and names the fragment traffic class. •insert-before class-name—(Optional) Adds a class map between any two existing class maps. Inserting a new class map between two existing class maps provides more flexibility when modifying existing policy map configurations. Without this option, the class map is appended to the policy map. Note This keyword is supported only on flexible packet matching (FPM) policies. •service-fragment fragment-class-name—(Optional) Specifies that the class is classifying a collection of fragments. The fragments being classified by this class must all share the same fragment class name. |
Step 5 |
police [cir cir] [bc conform-burst] [pir pir] [be peak-burst] [conform-action action [exceed-action action [violate-action action]]][conform-color hipri-conform]
Router(config-pmap-c)# police 50000 bc 3000
Router(config-pmap-c-police)# exceed-action
transmit
Router(config-pmap-c-police)# violate-action
drop
Router(config-pmap-c-police)# conform-color
hipri-conform
|
Configures traffic policing and specifies multiple actions applied to packets marked as conforming to, exceeding, or violating a specific rate. •Enters policy-map class police configuration mode. Use one line per action that you want to specify: •cir—Committed information rate. Indicates that the CIR will be used for policing traffic. •conform-action—(Optional) Action to take on packets when the rate is less than the conform burst. •exceed-action—(Optional) Action to take on packets whose rate is within the conform and conform plus exceed burst. •violate-action—(Optional) Action to take on packets whose rate exceeds the conform plus exceed burst. You must specify the exceed action before you specify the violate action. •conform-color—(Optional) Enables color-aware policing (on the policer being configured) and assigns the class map to be used for conform color determination. The hipri-conform keyword is the class map (previously configured via the class-map command) to be used. |
Step 6 |
service-policy policy-map-name
Router(config-pmap-c-police)# service-policy child-policy |
Specifies a service policy as a QoS policy within a policy map (called a hierarchical service policy). •policy-map-name—Name of the predefined policy map to be used as a QoS policy. The name can be a maximum of 40 alphanumeric characters. |
Step 7 |
end
Router(config-pmap-c-police)# end |
Exits the current configuration mode. |
Example
The following is a sample configuration for the Hierarchical Color-Aware Policing feature, showing the reverse order for policing:
service-policy child-policy
Configuration Examples for Hierarchical Color-Aware Policing
The examples provided in this section show how to configure the Hierarchical Color-Aware Policing feature and how to dismantle the configuration:
•Example: Sample Configuration to Enable the Hierarchical Color-Aware Policing Feature
•Example: Disallowing Multiple Entries in Class Map
•Example: Disallowing the Removal of an Active Color-Aware Class Map
•Example: Dismantling a Configuration of the Hierarchical Color-Aware Policing Feature
•Example: Sample Configuration of Hierarchical Color-Aware Policing for a Cisco ASR 1000 Series Router
•Example: show policy-map interface Command with Hierarchical Color-Aware Policing Applied
Example: Sample Configuration to Enable the Hierarchical Color-Aware Policing Feature
The following example shows a sample configuration that enables the Hierarchical Color-Aware Policing feature:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# ip access-list extended user1-acl
Router(config-ext-nacl)# permit ip host 192.168.1.1 any
Router(config-ext-nacl)# permit ip host 192.168.1.2 any
Router(config-ext-nacl)# ip access-list extended user2-acl
Router(config-ext-nacl)# permit ip host 192.168.2.1 any
Router(config-ext-nacl)# permit ip host 192.168.2.2 any
Router(config-ext-nacl)# exit
Router(config)# class-map match-all user1-acl-child
Router(config-cmap)# match access-group name user1-acl
Router(config-cmap)# class-map match-all user2-acl-child
Router(config-cmap)# match access-group name user2-acl
Router(config-cmap)# class-map match-all hipri-conform
Router(config-cmap)# match qos-group 5
Router(config-cmap)# exit
Router(config)# policy-map child-policy
Router(config-pmap)# class user1-acl-child
Router(config-pmap-c)# police cir 10000 bc 1500
Router(config-pmap-c-police)# class user2-acl-child
Router(config-pmap-c)# police cir 20000 bc 1500
Router(config-pmap-c-police)# exit
Router(config-pmap-c)# exit
Router(config-pmap)# exit
Router(config)# policy-map parent-policy
Router(config-pmap)# class class-default
Router(config-pmap-c)# police cir 50000 bc 3000
Router(config-pmap-c-police)# exceed-action transmit
Router(config-pmap-c-police)# violate-action drop
Router(config-pmap-c-police)# conform-color hipri-conform
Router(config-pmap-c-police)# service-policy child-policy
Example: Disallowing Multiple Entries in Class Map
The following example shows a rejected attempt to configure multiple entries in a class map:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# class-map hipri-conform
Router(config-cmap)# match qos-group 5
Router(config-cmap)# match qos-group 6
Only one match statement is supported for color-aware policing
Router(config-cmap)# no match qos-group 6
Example: Disallowing the Removal of an Active Color-Aware Class Map
The following example shows that an active color-aware class map cannot be disallowed:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# no class-map hipri-conform
Class-map hipri-conform is being used
Example: Dismantling a Configuration of the Hierarchical Color-Aware Policing Feature
The following example shows how to dismantle the configuration of the Hierarchical Color-Aware Policing feature:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# no policy-map parent-policy
Router(config)# no policy-map child-policy
Router(config)# no class-map hipri-conform
Router(config)# no class-map user1-acl-child
Router(config)# no class-map user2-acl-child
Example: Sample Configuration of Hierarchical Color-Aware Policing for a Cisco ASR 1000 Series Router
The following example shows a sample configuration to enable the Hierarchical Color-Aware Policing feature on a Cisco ASR 1000 series router:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# ip access-list extended user1-acl
Router(config-ext-nacl)# permit ip host 192.168.1.1 any
Router(config-ext-nacl)# permit ip host 192.168.1.2 any
Router(config-ext-nacl)# ip access-list extended user2-acl
Router(config-ext-nacl)# permit ip host 192.168.2.1 any
Router(config-ext-nacl)# permit ip host 192.168.2.2 any
Router(config-ext-nacl)# class-map match-all user1-acl-child
Router(config-cmap)# match access-group name user1-acl
Router(config-cmap)# class-map match-all user2-acl-child
Router(config-cmap)# match access-group name user2-acl
Router(config-cmap)# class-map match-all hipri-conform
Router(config-cmap)# match qos-group 5
Router(config-cmap)# policy-map child-policy
Router(config-pmap)# class user1-acl-child
Router(config-pmap-c)# police 10000 bc 1500
Router(config-pmap-c-police)# conform-action set-qos-transmit 5
Router(config-pmap-c-police)# class user2-acl-child
Router(config-pmap-c)# police 20000 bc 1500
Router(config-pmap-c-police)# conform-action set-qos-transmit 5
Router(config-pmap-c-police)# class class-default
Router(config-pmap-c)# police 50000 bc 1500
Router(config-pmap-c-police)# policy-map parent-policy
Router(config-pmap)# class class-default
Router(config-pmap-c)# police 50000 bc 3000
Router(config-pmap-c-police)# exceed-action transmit
Router(config-pmap-c-police)# violate-action drop
Router(config-pmap-c-police)# conform-color hipri-conform
Router(config-pmap-c-police)# service-policy child-policy
Router(config-pmap-c)# end
*Sep 16 12:31:11.536: %SYS-5-CONFIG_I: Configured from console by console
Class Map match-all user1-acl-child (id 4)
Match access-group name user1-acl
Class Map match-all user2-acl-child (id 5)
Match access-group name user2-acl
Class Map match-any class-default (id 0)
Class Map match-all hipri-conform (id 3)
police cir 50000 bc 3000 be 3000
conform-color hipri-conform
service-policy child-policy
priority level 1 20000 (kb/s)
conform-action set-qos-transmit 5
conform-action set-qos-transmit 5
Example: show policy-map interface Command with Hierarchical Color-Aware Policing Applied
The following is sample output from the show policy-map interface command when a policy with hierarchical color-aware policing is applied:
Router# show policy-map interface
Service-policy input: parent-policy
Class-map: class-default (match-any)
5 minute offered rate 0000 bps, drop rate 0000 bps
cir 50000 bps, bc 3000 bytes, be 3000 bytes
conformed 0 packets, 0 bytes; actions:
exceeded 0 packets, 0 bytes; actions:
violated 0 packets, 0 bytes; actions:
No color-aware policing statistics available
conformed 0000 bps, exceed 0000 bps, violate 0000 bps
Service-policy : child-policy
Class-map: user1-acl-child (match-all)
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group name user1-acl
cir 10000 bps, bc 1500 bytes
conformed 0 packets, 0 bytes; actions:
exceeded 0 packets, 0 bytes; actions:
conformed 0000 bps, exceed 0000 bps
Class-map: user2-acl-child (match-all)
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group name user2-acl
cir 20000 bps, bc 1500 bytes
conformed 0 packets, 0 bytes; actions:
exceeded 0 packets, 0 bytes; actions:
conformed 0000 bps, exceed 0000 bps
Class-map: class-default (match-any)
5 minute offered rate 0000 bps, drop rate 0000 bps
cir 50000 bps, bc 1500 bytes
conformed 0 packets, 0 bytes; actions:
exceeded 0 packets, 0 bytes; actions:
conformed 0000 bps, exceed 0000 bps
Additional References
Related Documents
Standards
|
|
No new or modified standards are supported by this feature. |
— |
MIBs
|
|
•CISCO-CLASS-BASED-QOS-MIB •CISCO-CLASS-BASED-QOS-CAPABILITY-MIB |
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs |
RFCs
|
|
RFC 2697 |
A Single Rate Three Color Marker |
RFC 2698 |
A Two Rate Three Color Marker |
Technical Assistance
|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
http://www.cisco.com/cisco/web/support/index.html |
Feature Information for Hierarchical Color-Aware Policing
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Table 1 Feature Information for Hierarchical Color-Aware Policing
|
|
|
Hierarchical Color-Aware Policing |
Cisco IOS XE Release 3.2S |
The Hierarchical Color-Aware Policing feature provides for two levels of policing where the policer ordering is evaluated from child to parent, and there is preferential treatment of certain traffic at the parent level. |
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2011 Cisco Systems, Inc. All rights reserved.