police
To apply QoS policing to a class map, use the police command in class configuration mode. To remove rate limiting, use the no form of this command.
police { output | input } conform-rate [ conform-burst ] [ conform-action [ drop | transmit ] [ exceed-action [ drop | transmit ]]]
no police
Syntax Description
|
conform-rate |
Sets the rate limit for this traffic class, from 8000 and 2000000000 bits per second. For the ASA virtual and Firepower 4100/9300, the range is 8000-100000000000. For example, to limit traffic to 5Mbps, enter 5000000. |
|
conform-burst |
Specifies the maximum number of instantaneous bytes allowed in a sustained burst before throttling to the conforming rate value, between 1000 and 512000000 bytes. For the ASA virtual and Firepower 4100/9300, the range is 1000-25600000000. If you omit this parameter, the default value is 1/32 of the conform-rate in bytes (that is, with a conform rate of 100,000, the default conform-burst value would be 100,000/32 = 3,125). Note that the conform-rate is in bits/second, whereas the conform-burst is in bytes. |
|
conform-action [drop | transmit ] |
Sets the action to take when the traffic is below the policing rate and burst size. You can drop or transmit the traffic. The default is to transmit the traffic. |
|
exceed-action [drop | transmit ] |
Sets the action to take when traffic exceeds the policing rate and burst size. You can drop or transmit packets that exceed the policing rate and burst size. The default is to drop excess packets. |
|
input |
Enables policing of traffic flowing in the input direction. |
|
output |
Enables policing of traffic flowing in the output direction. |
Command Default
No default behavior or variables.
Command Modes
The following table shows the modes in which you can enter the command:
|
Command Mode |
Firewall Mode |
Security Context |
|||
|---|---|---|---|---|---|
|
Routed |
Transparent |
Single |
Multiple |
||
|
Context |
System |
||||
|
Class configuration |
|
— |
|
— |
— |
Command History
|
Release |
Modification |
|---|---|
|
7.0(1) |
This command was added. |
|
7.2(1) |
The input option was added. Policing traffic in the inbound direction is now supported. |
Usage Guidelines
Policing is a way of ensuring that no traffic exceeds the maximum rate (in bits/second) that you configure, thus ensuring that no one traffic flow can take over the entire resource. When traffic exceeds the maximum rate, the ASA drops the excess traffic. Policing also sets the largest single burst of traffic allowed.
To enable policing, use the Modular Policy Framework:
1.class-map—Identify the traffic on which you want to perform policing.
2.policy-map—Identify the actions associated with each class map.
-
a.class—Identify the class map on which you want to perform actions.
-
b.police—Enable policing for the class map.
3.service-policy—Assigns the policy map to an interface or globally.
You can configure each of the QoS features alone if desired for the ASA. Often, though, you configure multiple QoS features on the ASA so you can prioritize some traffic, for example, and prevent other traffic from causing bandwidth problems.
See the following supported feature combinations per interface:
-
Standard priority queuing (for specific traffic) + policing (for the rest of the traffic).
You cannot configure priority queuing and policing for the same set of traffic.
-
Traffic shaping (for all traffic on an interface) + hierarchical priority queuing (for a subset of traffic).
Typically, if you enable traffic shaping, you do not also enable policing for the same traffic, although the ASA does not restrict you from configuring this.
See the following guidelines:
-
QoS is applied unidirectionally; only traffic that enters the interface to which you apply the policy map is affected (or exits the interface, depending on the whether you specify input or output ).
-
If a service policy is applied or removed from an interface that has existing traffic already established, the QoS policy is not applied or removed from the traffic stream. To apply or remove the QoS policy for such connections, you must clear the connections and re-establish them. See the clear conn command.
-
To-the-box traffic is not supported.
-
Traffic to and from a VPN tunnel bypass interface is not supported.
-
When you match a tunnel group class map, only outbound policing is supported.
Examples
The following is an example of a police command for the output direction that sets the conform rate to 100,000 bits per second, with a burst value of 20,000 bytes.
ciscoasa(config)# policy-map localpolicy1
ciscoasa(config-pmap)# class-map firstclass
ciscoasa(config-cmap)# class localclass
ciscoasa(config-pmap-c)# police output 100000 20000
ciscoasa(config-cmap-c)# class class-default
ciscoasa(config-pmap-c)#
The following example shows how to do rate-limiting on traffic destined to an internal web server:
ciscoasa# access-list http_traffic permit tcp any 10.1.1.0 255.255.255.0 eq 80
ciscoasa# class-map http_traffic
ciscoasa(config-cmap)# match access-list http_traffic
ciscoasa(config-cmap)# policy-map outside_policy
ciscoasa(config-pmap)# class http_traffic
ciscoasa(config-pmap-c)# police input 56000
ciscoasa(config-pmap-c)# service-policy outside_policy interface outside
ciscoasa(config)#
Feedback