8.5. Command Descriptions

This command is used to create or edit the ingress policy. The ingress policy defines the Service Level Agreement (SLA) enforcement service packets receive when they ingress a SAP. SLA enforcement requires the definition of meters/queues (depends on the support available on a platform) that have Forwarding Class (FC), Committed Information Rate (CIR), Peak Information Rate (PIR), Committed Burst Size (CBS), and Maximum Burst Size (MBS) characteristics. The simplest policy defines a single queue/meter that all ingress traffic flows through. Complex policies have multiple meters/queues combined with classification entries that indicate which meter/queue a packet flows though.

Policies in effect are templates that can be applied to multiple services as long as the scope of the policy is template. Meters/ queues defined in the policy are not instantiated until a policy is applied to a service SAP.

Depending on the support available on different 7210 SAS platforms, SAP ingress policies can be defined with either dot1p, IP DSCP, IP headers, MAC headers, or all as the match criteria.

Only one service ingress policy can be provisioned. The SAP ingress policy with policy-id 1 is a system-defined policy applied to services when no other policy is explicitly specified. The system SAP ingress policy can be modified but not deleted. The no sap-ingress command restores the factory default settings when used on policy-id 1. See Default SAP Ingress Policy for more information.

Any changes made to the existing policy, using any of the sub-commands, are applied immediately to all services where this policy is applied. For this reason, when many changes are required on a policy, it is recommended that the policy be copied to a work area policy ID. The work area policy can be modified until complete and then written over the original policy ID. Use the config qos copy command to maintain policies in this manner.

Note: Before a SAP ingress policy can be associated with a SAP, resources must be allocated using the config>system>resource-profile>ingress-internal-tcam>qos-sap-ingress-resource command. See Resource Allocation for Service Ingress QoS Policy Classification Rules for information about resource allocation. Refer to the 7210 SAS-D, Dxp, K 2F1C2T, K 2F6C4T, K 3SFP+ 8C Basic System Configuration Guide for more information about system resource allocation and examples for this CLI command. On the 7210 SAS-D and 7210 SAS-Dxp, only meters are supported on service ingress for rate enforcement. These platforms do not support service ingress queues. On the 7210 SAS-D and 7210 SAS-Dxp, the user has the option to use dot1p, IP DSCP, IPv4 and IPv6 criteria, and MAC criteria.

The no form of this command deletes the SAP ingress policy. A policy cannot be deleted until it is removed from all services where it is applied. The system default SAP ingress policy is a special case; the no command restores the factory defaults to policy ID1.

This command configures the service ingress QoS policy scope.

The no form of this command reverts the scope of the policy to the default.

This command configures the default FC for the policy. If an ingress packet does not match a higher priority (more explicit) classification command, the default FC is associated with the packet. Unless overridden by an explicit FC classification rule, all packets received on an ingress SAP using this ingress QoS policy is classified to the default FC.

The default FC is best effort (be). The default-fc settings are displayed in the show configuration and save output, regardless of whether the detail keyword is included in the show command.

The in and out parameters are mutually exclusive following the profile classification keyword. Either in or out must be specified when the profile keyword is present.

The fc command creates a class instance of the FC fc-name. After the fc-name is created, classification actions can be applied and then used in match classification criteria.

The no form of this command removes all explicit queue mappings for fc-name forwarding types. The queue mappings revert to the default meters for fc-name.

This command enables the user to match on both IP and MAC criteria in a SAP ingress policy. If this command is not executed, the software does not allow for configuration of both IP and MAC criteria in a SAP ingress policy. In other words, without this command in a SAP ingress policy, IP and MAC criteria are mutually exclusive.

The user also has the option to specify if all the IP criteria entries configured in the policy need to be matched first followed by all the MAC criteria entries or vice versa. For example, if ip-first is configured, all the IP criteria entries are compared for matches first; if there are no matches, then MAC criteria entries are compared for matches.If a match is found, no further matches are performed and the actions associated with the matched entry are taken.

The no form of the command reverts to the default value.

This command selects the ingress meter and corresponding FC for matched traffic.

The user can specify either any or dscp-only as the sub-criteria. The sub-criteria determines what fields can be used to match traffic. The resource allocation for classification is affected by the sub-criteria in use. See Resource Allocation for Service Ingress QoS Policy Classification Rules for more information.

This command is used to enter the context to create or edit policy entries that specify IP criteria DiffServ code point.

The 7210 SAS implementation exits on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly from most to least explicit.

The no form of this command deletes all the entries specified under this node. After an IP criteria entry is removed from a SAP ingress policy, the IP criteria is removed from all services where that policy is applied.

This command selects the appropriate ingress meters and corresponding FC for matched traffic.

This command is used to enter the node to create or edit policy entries that specify IPv6 criteria, such as IP quintuple lookup or DSCP.

The 7210 SAS implementation exits on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly from most to least explicit.

Note: Before associating a SAP ingress policy configured to use IPv6 criteria with a SAP, resources must be allocated using the config system resource-profile ingress-internal-tcam qos-sap-ingress-resource ipv6-ipv4-match-enable command. Refer to the 7210 SAS-D, Dxp, K 2F1C2T, K 2F6C4T, K 3SFP+ 8C Basic System Configuration Guide for more information about this CLI command and resource allocation.

The no form of this command deletes all the entries specified under this node. After an IPv6 criteria entry is removed from a SAP ingress policy, the IPv6 criteria is removed from all services where that policy is applied.

This command selects the appropriate ingress meters and corresponding FC for matched traffic.

User can specify either any or dot1p-only as the sub-criteria. The sub-criteria determines what fields can be used to match traffic. The resource allocation for classification is affected by the sub-criteria in use. See Resource Allocation for Service Ingress QoS Policy Classification Rules for more information about SAP ingress resource allocation.

This command is used to enter the node to create or edit policy entries that specify MAC criteria.

The 7210 SAS OS implementation exits on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly from most to least explicit.

The no form of this command deletes all the entries specified under this node. After a MAC criteria entry is removed from a SAP ingress policy, the MAC criteria is removed from all services where that policy is applied.

This command configures the number of classifiers the SAP ingress Qos policy can use. This parameter cannot be modified when it is associated with a SAP.

The num-resources parameter also determines the maximum number of meters that are available to this policy. The maximum number of meters available for use by the FCs (FC) defined under this policy is equal to half the value specified in num-resources parameter (maximum of 32). Any of these meters are available for use to police unicast or multipoint traffic. Any of these meters is available for use by more than one FC (or a single meter is available for use by all the FCs).

The ipv6 keyword indicates a plan to use ipv6-criteria, and the resources needed for this SAP ingress QoS policy must be allocated to the slice assigned to IPv6 criteria.

This command overrides the default broadcast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a multipoint meter before the mapping can be made. After the FC mapping is executed, all broadcast traffic on a SAP using this policy is forwarded using the meter-id.

The broadcast forwarding type usually tracks the multicast forwarding type definition. This command overrides that default behavior.

The no form of this command reverts the broadcast forwarding type meter-id to the default of tracking the multicast forwarding type meter mapping.

This command overrides the default unicast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a non-multipoint meter before the mapping can be made. After the FC mapping is executed, all unicast traffic (this includes all traffic, even broadcast and multicast for services) on a SAP using this policy is forwarded using the meter-id.

The no form of this command reverts the unicast (point-to-point) meter-id to the default meter for the FC.

This command overrides the default multicast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a multipoint meter before the mapping can be made. After the FC mapping is executed, all multicast traffic on a SAP using this policy is forwarded using the meter-id.

The multicast forwarding type includes the unknown unicast forwarding type and the broadcast forwarding type, unless each is explicitly defined to a different multipoint meter. When the unknown and broadcast forwarding types are left as default, they will track the defined meter for the multicast forwarding type.

The no form of this command reverts the multicast forwarding type meter-id to the default meter for the FC. If the broadcast and unknown forwarding types were not explicitly defined to a multipoint meter, they are also reverted to the default multipoint meter.

This command overrides the default unknown unicast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a multipoint meter before the mapping can be made. After the FC mapping is executed, all unknown traffic on a SAP using this policy is forwarded using the meter-id.

The unknown forwarding type usually tracks the multicast forwarding type definition. This command overrides that default behavior.

The no form of this command reverts the unknown forwarding type meter-id to the default of tracking the multicast forwarding type meter mapping.

This mandatory command associates the FC with specific IP or MAC criteria entry ID. The action command supports setting the FC parameter. Packets that meet all match criteria within the entry have their FC overridden based on the parameters included in the action parameters.

The action command must be executed for the match criteria to be added to the active list of entries.

Each time action is executed on a specific entry ID, the previously entered values for fc fc-name are overridden with the newly defined parameters.

The no form of this command removes the entry from the active entry list. Removing an entry on a policy immediately removes the entry from all SAPs using the policy. All previous parameters for the action are lost.

This command enables the context to create or edit an IP or MAC criteria entry for the policy. Multiple entries can be created using unique entry-id numbers.

The list of flow criteria is evaluated in a top-down fashion with the lowest entry ID at the top and the highest entry ID at the bottom. If the defined match criteria for an entry within the list matches the information in the egress packet, the system stops matching the packet against the list and performs the matching reclassification actions specified by the entries. If none of the entries match the packet, the IP flow reclassification list has no effect on the packet.

An entry is not populated in the list unless the action command is executed for the entry. An entry that is not populated in the list has no effect on egress packets. If the action command is executed without any explicit reclassification actions specified, the entry is populated in the list allowing packets matching the entry to exit the list, preventing them from matching entries lower in the list. Because this is the only flow reclassification entry that the packet matched and this entry explicitly states that no reclassification action is to be performed, the matching packet is not reclassified.

The no form of this command removes the specified entry from the policy. Entries removed from the policy are immediately removed from all services where that policy is applied.

This command configures match criteria for SAP QoS policy matches. When the match criteria are satisfied, the action associated with the match criteria is executed.

If more than one match criteria (within one match statement) are configured, then all criteria must be satisfied (and function) before the action associated with the match will be executed.

A match context can consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of this command removes the match criteria for the entry.

This command enables the context to create or edit the match MAC criteria for ingress SAP QoS policy match criteria. When the match criteria are satisfied the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (and function) before the action associated with the match is executed.

A match context can consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of this command removes the match criteria for the entry-id.

This command configures match criteria for ingress SAP QoS policy match IPv6 criteria. When the match criteria are satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (and function) before the action associated with the match is executed.

A match context can consist of multiple match criteria, but multiple match statements cannot be specified per entry.

The no form of this command removes the match criteria for the entry-id.

This command configures a DiffServ Code Point (DSCP) used for classification of packets from the specified FC.

The no form of this command removes the DSCP match criterion.

Note: This feature is applicable for ip-criteria (any and dscp-only) and ipv6-criteria (any and dscp-only). The user is not be allowed to configure dscp name and dscp mask combinations. When the user configures dscp value alone, the “show” command displays dscp value as configured value and dscp mask as “FC”. Use of dscp-value and dscp-mask allows for efficient use of match resources in hardware, since the specification of mask allows user to combine individual DSCP entries to a single value/mask pair and specify similar action for all of them.

This command configures a destination address range to use as a SAP QoS policy match criterion.

To match on the destination address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 can also be used.

The no form of this command removes the destination IP address match criterion.

This command configures a destination TCP or UDP port number or port range for a SAP QoS policy match criterion.

The no form of this command removes the destination port match criterion.

This command specifies an IP precedence value that must be matched to perform the associated classification actions. If an ingress packet on the SAP where the SAP ingress QoS policy is applied to matches the specified IP precedence value, the actions associated with this entry are taken.

The ip-prec-value is derived from the most significant three bits in the IP header ToS byte field (precedence bits). The three precedence bits define eight Class-of-Service (CoS) values commonly used to map packets to per-hop Quality-of-Service (QoS) behavior. The precedence bits are also part of the newer DSCP method of mapping packets to QoS behavior. The DSCP uses the most significant six bits in the IP header ToS byte and so overlaps with the precedence bits.

Both IP precedence and DSCP classification rules are supported. A match entry cannot match on both IP DSCP and IP precedence, which means that the user can use either IP DSCP or IP precedence match in a match entry but not both. The software blocks configuration of ip-precedence match if the ip-dscp command is configured already. The converse is also true. A single policy having multiple match entries can have entries such that some of them match IP DSCP and others match IP precedence. The order of the entry determines the priority of the match.

The no form of this command removes the IP precedence match criterion.

This command configures a source IPv4 address range to use as a SAP QoS policy match criterion.

To match on the source IPv4 address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 can also be used.

The no form of this command removes the source IPv4 address match criterion.

This command configures a source IPv6 address range to use as a SAP QoS policy match criterion.

The no form of this command removes the source IPv6 address match criterion.

This command configures a source TCP or UDP port number or port range for a SAP QoS policy match criterion.

The no form of this command removes the source port match criterion.

This command enables the IEEE 802.1p value to use as the match criterion.

The no form of this command removes the dot1p value as the match criterion.

This command configures a destination MAC address or range to use as a service ingress QoS policy match criterion.

The no form of this command removes the destination MAC address as the match criterion.

This command configures an Ethernet type II value for to use as a service ingress QoS policy match criterion.

The Ethernet type field is a two-byte field used to identify the protocol carried by the Ethernet frame. For example, 0800 is used to identify IPv4 packets.

The Ethernet type field is used by the Ethernet version-II frames. IEEE 802.3 Ethernet frames use the dsap, ssap or snap-pid fields as match criteria; the Ethernet type field is not used.

The snap-pid, etype, ssap, and dsap fields are mutually exclusive and cannot be part of the same match criteria.

For the 7210 SAS-D and 7210 SAS-Dxp, the dataplane processes a maximum of two VLAN tags in a received packet. The Ethertype used in the MAC matching criteria for ACLs is the Ethertype that is found in the packet after processing single-tagged frames, double-tagged frames, and no-tag frames

The packet is considered to have no tags if at least one of the following criteria is true:

The packet is considered to have a single tag if at least one of the following criteria is true:

The packet is considered to have double tags if at least one of the following criteria is true:

The no form of this command removes the previously entered etype field as the match criteria.

This command configures a source MAC address or range to be used as a service ingress QoS policy match criterion.

The no form of this command removes the source MAC address as the match criteria.

This command enables the context to configure an ingress SAP QoS policy meter.

This command allows the creation of multipoint meters. Only multipoint meters can receive ingress packets that need flooding to multiple destinations. By separating the unicast for multipoint traffic at service ingress and handling the traffic on separate multipoint meters, special handling of the multipoint traffic is possible. Each meter acts as an accounting and (optionally) policing device offering precise control over potentially expensive multicast, broadcast, and unknown unicast traffic. Only the back-end support of multipoint traffic (between the FC and the meter based on forwarding type) needs to be defined. The individual classification rules used to place traffic into FCs are not affected. Meters must be defined as multipoint within the policy at the time of creation.

The multipoint meters are for service traffic destined to multiple destinations, such as multicast traffic in a VPLS service. Within non-multipoint services, such as Epipe services, all traffic is considered unicast because of the nature of the service type. Multicast and broadcast-destined traffic in an Epipe service is mapped to a multipoint service meter.

When an ingress SAP QoS policy with multipoint meters is applied to an Epipe SAP, the multipoint meters are not created.

Any billing or statistical queries about a multipoint meter on a non-multipoint service return zero values. Any meter parameter information requested about a multipoint meter on a non-multipoint service returns the meter parameters in the policy. Multipoint meters are not created for non-multipoint services.

The no form of this command removes the meter-id from the SAP ingress QoS policy and from any existing SAPs using the policy. Any FC mapped to the meter reverts to the default meters. When a meter is removed, any pending accounting information for each SAP meter, created as a result of the definition of the meter in the policy, is discarded.

This command defines the method used by the system to derive the operational CIR and PIR settings when the meter is provisioned in hardware. For the CIR and PIR parameters, individually the system attempts to find the best operational rate depending on the defined constraint.

The no form of this command removes any explicitly defined constraints used to derive the operational CIR and PIR created by the application of the policy. When a specific adaptation-rule is removed, the default constraints for pir and cir apply.

This command provides a mechanism to override the default CBS for the meter. The CBS command specifies the maximum burst size that can be transmitted by the source while still complying with the CIR. If the transmitted burst is lower than the CBS value, the packets are marked as in-profile by the meter to indicate that the traffic is complying with meter configured parameters.

Note: The adaptation rule configured for the rate influences the step-size used for the burst. See Adaptation Rule for Meters for information.

The no form of this command returns the CBS size to the default value.

This command configures the meter to operate in either color-aware or color-blind mode.

In color-blind mode, the profile/color assigned to the packet on ingress is ignored. The CIR and PIR rate configured for the meter are used to determine the final profile/color for the packet. If the packet is within the CIR, the final profile/color assigned to the packet is in-profile/green; if the packet exceeds the CIR and is within the PIR, the final profile/color assigned to the packet is out-of-profile/yellow. Packets that exceed the PIR rate are dropped.

In color-aware mode, the meter uses the profile assigned to the packet on ingress. Profile can be assigned on ingress either by enabling DEI classification as done on access ports or by assigning profile based on either dot1p or DEI as done on network ports and access-uplink ports.

The following behavior is available in color-aware mode.

This command configures a mechanism to override the default MBS for the meter. The MBS parameter specifies the maximum burst size that can be transmitted by the source while still complying with the CIR. If the transmitted burst is lower than the MBS value, the packets are marked as in-profile by the meter to indicate that the traffic is complying with configures meter parameters.

Note: The adaptation rule configured for the rate influences the step-size used for the burst. See Adaptation Rule for Meters for information.

The no form of this command reverts the MBS size to the default value.

This command defines the mode of the meter. The mode can be configured as Two Rate Three Color Marker (trTCM1) or Single Rate Three Color Marker (srTCM). The mode command can be executed at anytime.

Note: The meter counters are reset to zero when the meter mode is changed. For more information about the interpretation of rate parameters when the meter mode is configured as “trtcm2”, see the command description of the policer rate command.

The no form of the command sets the default mode trtcm1.

This command defines the administrative PIR and CIR parameters for the meter.

The rate command can be executed at anytime, altering the PIR and CIR rates for all meters created through the association of the SAP Ingress QoS policy with the meter-id.

The no form of this command reverts all meters created with the meter-id by association with the QoS policy to the default PIR(max) and CIR(0) parameters.