9.10. Service SAP QoS Policy Command Reference

This command creates a text description stored in the configuration file for a configuration context.

The no form of this command removes any description string from the context.

This command enables the context to create or edit the ingress policy. The ingress policy defines the Service Level Agreement (SLA) that enforcement service packets receive as they ingress a SAP. SLA enforcement required the definition of meters or queues (depends on the support available on a platform) that have FC, CIR, PIR, CBS, and MBS characteristics. The simplest policy defines a single queue or meter that all ingress traffic flows through. Complex policies have multiple meters or queues combined with classification entries that indicate which meter or queue a packet will flow though.

Policies in effect are templates that can be applied to multiple services as long as the scope of the policy is template. Meters defined in the policy are not instantiated until a policy is applied to a service SAP.

Only one service ingress policy can be provisioned. The SAP-ingress policy with policy-id 1 is a system-defined policy applied to services when no other policy is explicitly specified. The system SAP-ingress policy can be modified but not deleted.

The no form of this command reverts to the default values when used on policy-id 1. See Default SAP-ingress policy for more information about the default SAP-ingress policy for different platforms.

Any changes made to the existing policy using any of the sub-commands are applied immediately to all services where this policy is applied. For this reason, when many changes are required on a policy, it is recommended that the policy be copied to a work area policy ID. That work-in-progress policy can be modified until complete and then written over the original policy. Use the config qos copy command to maintain policies in this manner.

Note: Before associating a SAP-ingress policy with a SAP, resources must be allocated using the config system resource-profile ingress-internal-tcam qos-sap-ingress-resource command. See Service Ingress QoS Policies and refer to the 7210 SAS-M, T, R6, R12, Mxp, Sx, S Basic System Configuration Guide for more information about this command and resource allocation.

The no form of this command deletes the SAP-ingress policy. A policy cannot be deleted until it is removed from all services where it is applied. The system default SAP-ingress policy is a special case; the no form of this command reverts to the default.

This command configures the service ingress QoS policy scope.

The no form of this command reverts the scope of the policy to the default.

This command configures the default forwarding class for the policy. If an ingress packet does not match a higher priority (more explicit) classification command, the default forwarding class is associated with the packet. Unless overridden by an explicit FC classification rule, all packets received on an ingress SAP using this ingress QoS policy are classified to the default FC.

The use-dei parameter enables the use of DEI bits for assigning ingress profile/color to the packet. If use-dei is enabled, the packet is assigned in-profile/green. If the DEI bit is 0 and the packet is assigned out-of-profile/yellow, the DEI bit is 1. If use-dei is disabled, the DEI bits are not used to assign ingress profiles, and the user has an option to assign in/out profile based on the QoS bits in the packet header.

The default FC is “best effort” (be). The default-fc settings are displayed in the show configuration and save output, regardless of whether the detail keyword is included in the show command.

This command associates a DSCP classification policy with a SAP-ingress QoS policy.

The no form of this command removes the DSCP classification policy from its association with the SAP-ingress QoS policy.

This command creates a class instance of the forwarding class fc-name. After the fc-name is created, classification actions can be applied and then used in match classification criteria.

The no form of this command removes all the explicit queue mappings for fc-name forwarding types. The queue mappings revert to the default meters for fc-name.

This command must be executed if the user intends to match on both IP and MAC criteria in a SAP ingress policy. If this command is not executed, the software does not allow for configuration of both IP and MAC criteria on a SAP ingress policy. In other words, without this command in a SAP ingress policy, IP and MAC criteria are mutually exclusive.

The user also has the option to specify if all the IP criteria entries configured in the policy need to be matched first followed by all the MAC criteria entries or vice versa. In other words, if ip-first is configured, all the IP criteria entries are matched and if there are no matches, the MAC criteria entries are matched. If a match is found, no further matches are done and the actions associated with the matched entry are taken.

The no form of the command reverts to the default value.

This command enables the context to create or edit policy entries that specify IP criteria DSCP. IP criteria-based SAP-ingress policies are used to select the appropriate ingress meter and corresponding FC for matched traffic.

The user can specify the any or dscp-only keywords as the sub-criteria. The sub-criteria determines what fields can be used to match traffic. The resource allocation for classification is affected by the sub-criteria in use. See Resource Allocation for Service Ingress QoS Policies for more information about SAP-ingress resource allocation.

The 7210 SAS OS implementation exits on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly from most to least explicit.

The no form of this command deletes all the entries specified under this node. After IP criteria entries are removed from a SAP-ingress policy, the IP criteria are removed from all services where that policy is applied.

This command enables the context to create or edit policy entries that specify IPv6 criteria, such as IP quintuple lookup or DSCP. IPv6 criteria-based SAP-ingress policies are used to select the appropriate ingress meters and corresponding FC for matched traffic.

The 7210 SAS OS implementation exits on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly from most to least explicit.

Note: Before associating a SAP-ingress policy configured to use IPv6 criteria with a SAP, resources must be allocated using the config system resource-profile ingress-internal-tcam qos-sap-ingress-resource ipv6-ipv4-match-enable command. Refer to the 7210 SAS-M, T, R6, R12, Mxp, Sx, S Basic System Configuration Guide for more information about this CLI command and resource allocation.

The no form of this command deletes all the entries specified under this node. After ipv6-criteria entries are removed from a SAP-ingress policy, the ipv6-criteria are removed from all services where that policy is applied.

This command enables the context to create or edit policy entries that specify MAC criteria. The MAC criteria based SAP ingress policies are used to select the appropriate ingress meters and corresponding forwarding class for matched traffic.

The user can specify either the any or dot1p-only keywords as the sub-criteria. The sub-criteria determines what fields can be used to match traffic. The resource allocation for classification is affected by the sub-criteria in use. See Resource Allocation for Service Ingress QoS Policies for more information about SAP-ingress resource allocation.

The 7210 SAS OS implementation will exit on the first match found and execute the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly from most to least explicit.

The no form of this command deletes all the entries specified under this node. After mac-criteria entries are removed from a SAP-ingress policy, the MAC criteria are removed from all services where that policy is applied.

This command configures the number of classifiers the SAP-ingress Qos policy can use. A user cannot modify this parameter when it is in use (for example, if it is applied to a SAP).

The num-resources parameter also determines the maximum number of meters that are available to this policy. The maximum number of meters available for use by the FC defined under this policy is equal to half the value specified in the num-resources parameter. Any of these meters are available for use to police unicast or multipoint traffic. Any of these meters are available for use by more than one FC (or a single meter is available for use by all the FCs).

The ipv6 keyword indicates a plan to use the IPv6 criteria, and the resources needed for this SAP-ingress QoS policy must be allocated for the slice allocated to IPv6 criteria.

This command allows the user to choose the dot1p or DSCP classification policies to classify traffic to an FC. The option to select either dot1p or DSCP, or both, applies only to SAPs configured in Layer 2 services (Epipe and VPLS). It is not applicable to SAPs configured in Layer 3 services (IES, VPRN and R-VPLS). See Table-based IP DSCP and Dot1p Classification Policy Commands for SAP Ingress and Access Port Ingress for more information.

The following options can be used to configure the classification policy.

This command associates the forwarding class with a specific IP or MAC criteria entry ID. The action command supports setting the forwarding class parameter. Packets that meet all match criteria within the entry have their forwarding class overridden based on the parameters included in the action parameters.

The action command must be executed for the match criteria to be added to the active list of entries.

Each time the action command is executed on a specific entry ID, the previously entered values for fc fc-name are overridden with the newly defined parameters.

The no form of this command removes the entry from the active entry list. Removing an entry on a policy immediately removes the entry from all SAPs using the policy. All previous parameters for the action are lost.

This command enables the context to create or edit an IP or MAC criteria entry for the policy. Multiple entries can be created using unique entry-id numbers.

The list of flow criteria is evaluated in a top-down fashion with the lowest entry ID at the top and the highest entry ID at the bottom. If the defined match criteria for an entry within the list matches the information in the egress packet, the system stops matching the packet against the list and performs the matching reclassification actions specified by the entries. If none of the entries match the packet, the IP flow reclassification list has no effect on the packet.

An entry is not populated in the list unless the action command is executed for the entry. An entry that is not populated in the list has no effect on egress packets. If the action command is executed without any explicit reclassification actions specified, the entry is populated in the list allowing packets matching the entry to exit the list, preventing them from matching entries lower in the list. Because this is the only flow reclassification entry that the packet matched and this entry explicitly states that no reclassification action is to be performed, the matching packet is not reclassified.

The no form of this command removes the specified entry from the policy. Entries removed from the policy are immediately removed from all services where that policy is applied.

This command configures match criteria for SAP QoS policies. When the match criteria have been satisfied, the action associated with the match criteria is executed.

Only a single match criteria type (either MAC or IP) is allowed at any time.

The no form of this command removes the match criteria.

This command enables the context to edit match MAC criteria for SAP-ingress QoS policy match criteria. When the match criteria are satisfied, the action associated with the match criteria is executed.

If more than one match criteria (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context can consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of this command removes the match criteria for the entry-id.

This command enables the context to configure match criteria for SAP-ingress QoS policy match IPv6 criteria. When the match criteria are satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context can consist of multiple match criteria, but multiple match statements cannot be specifies per entry.

It is possible that a SAP-ingress policy includes the dscp map command, the dot1p map command, and IPv6 match criteria. When multiple matches occur for the traffic, the order of precedence is used to arrive at the final action. The order of precedence is as follows:

The no form of this command removes the match criteria for the entry-id.

This command overrides the default broadcast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a multipoint meter before the mapping can be made. After the FC mapping is executed, all broadcast traffic on a SAP using this policy is forwarded using the meter-id.

The broadcast forwarding type usually tracks the multicast forwarding type definition. This command overrides that default behavior.

The no form of this command reverts the broadcast forwarding type meter-id to the default of tracking the multicast forwarding type meter mapping.

This command overrides the default unicast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a non-multipoint meter before the mapping can be made. After the FC mapping is executed, all unicast traffic (this includes all traffic, even broadcast and multicast for services) on a SAP using this policy is forwarded using the meter-id.

The no form of this command reverts the unicast (point-to-point) meter-id to the default meter for the forwarding class (meter 1).

This command overrides the default multicast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a multipoint meter before the mapping can be made. After the FC mapping is executed, all multicast traffic on a SAP using this policy is forwarded using the meter-id.

The multicast forwarding type includes the unknown unicast forwarding type and the broadcast forwarding type, unless each is explicitly defined to a different multipoint meter. When the unknown and broadcast forwarding types are left as default, they track the defined meter for the multicast forwarding type.

The no form of this command reverts the multicast forwarding type meter-id to the default meter for the forwarding class. If the broadcast and unknown forwarding types were not explicitly defined to a multipoint meter, they are also reverted to the default multipoint meter (11).

This command overrides the default unknown unicast forwarding type meter mapping for fc fc-name. The specified meter-id must exist within the policy as a multipoint meter before the mapping can be made. After the forwarding class mapping is executed, all unknown traffic on a SAP using this policy is forwarded using the meter-id.

The unknown forwarding type usually tracks the multicast forwarding type definition. This command overrides that default behavior.

The no form of this command reverts the unknown forwarding type meter-id to the default of tracking the multicast forwarding type meter mapping.

This command configures a DiffServ Code Point (DSCP) used for classification of packets from the specified FC. Either a DSCP name or DSCP value with a mask can be configured.

The no form of this command removes the DSCP match criterion.

This command configures a destination address range as a SAP QoS policy match criterion.

To match on the destination address, specify the address and its associated mask, for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 can also be used.

The no form of this command removes the destination IP address match criterion.

This command configures a destination TCP or UDP port number or port range for a SAP QoS policy match criterion.

The no form of this command removes the destination port match criterion.

This command configures fragmented or non-fragmented IP packets as a SAP QoS policy match criterion.

The no form of this command removes the match criterion.

This command specifies an IP precedence value that must be matched to perform the associated classification actions. If an ingress packet on the SAP where the SAP ingress QoS policy is applied to matches the specified IP precedence value, the actions associated with this entry are taken.

The ip-prec-value is derived from the most significant three bits in the IP header ToS byte field (precedence bits). The three precedence bits define eight Class-of-Service (CoS) values commonly used to map packets to per-hop QoS behavior. The precedence bits are also part of the newer DSCP method of mapping packets to QoS behavior. The DSCP uses the most significant six bits in the IP header ToS byte and so overlaps with the precedence bits.

Both IP precedence and DSCP classification rules are supported. A match entry cannot match on both IP DSCP and IP precedence values which means that the user can use either IP DSCP or IP precedence match in a match entry but not both. The software blocks configuration of IP precedence match if the ip-dscp command is already configured. The converse is also true. A single policy having multiple match entries can have entries such that some of them match IP DSCP and others match IP precedence. The order of the entry determines the priority of the match.

The no form of this command removes the IP Precedence match criterion.

This command configures a source IP or IPv6 address range to use as a SAP QoS policy match criterion.

To match on the source IP or IPv6 address, specify the address and its associated mask, for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 can also be used.

The no form of this command removes the source IP or IPv6 address match criterion.

This command configures a source TCP or UDP port number or port range for a SAP QoS policy match criterion.

The no form of this command removes the source port match criterion.

This command enables the IEEE 802.1p value to use as the match criterion.

The no form of this command removes the dot1p value as the match criterion.

This command configures a destination MAC address or range to use as a service ingress QoS policy match criterion.

The no form of this command removes the destination MAC address as the match criterion.

This command configures an Ethernet type II value to use as a service ingress QoS policy match criterion.

The Ethernet type field is a two-byte field used to identify the protocol carried by the Ethernet frame. For example, 800 is used to identify the IP v4 packets.

The Ethernet type field is used by the Ethernet version-II frames. IEEE 802.3 Ethernet frames do not use the type field. For IEEE 802.3 frames, use the dsap, ssap or snap-pid fields as match criteria.

The snap-pid field, etype field, ssap, and dsap fields are mutually exclusive and cannot be part of the same match criteria.

The no form of this command removes the previously entered etype field as the match criteria.

This command configures a source MAC address or range to be used as a service ingress QoS policy match criterion.

The no form of this command removes the source mac as the match criteria.

This command enables the context to configure an ingress SAP QoS policy meter.

The command also allows for creation of a multipoint meter, which is typically used to limit BUM traffic, which refers to traffic sent to multiple destinations or flooded in the service, such as broadcast, unknown unicast, and multicast traffic. On the 7210 SAS, the user has an option to use a unicast meter to limit BUM traffic.

The multipoint meters are for multipoint-destined service traffic. Within non-multipoint services, such as Epipe services, all traffic is considered unicast because of the nature of the service type. Multicast and broadcast-destined traffic in an Epipe service are not mapped to a multipoint service meter. When an ingress SAP QoS policy with multipoint meters is applied to an Epipe SAP, the multipoint meters are not created.

Any billing or statistical queries about a multipoint meter on a non-multipoint service return zero values. Any meter parameter information requested about a multipoint meter on a non-multipoint service returns the meter parameters in the policy. Multipoint meters are not created for non-multipoint services.

The no form of this command removes the meter-id from the SAP-ingress QoS policy and from any existing SAPs using the policy. Any FC mapped to the meter, reverts to the default meters. When a meter is removed, any pending accounting information for each SAP meter created as a result of the definition of the meter in the policy is discarded.

This command defines the method used by the system to derive the operational CIR and PIR when the meter is provisioned in hardware. For the cir and pir parameters, the system attempts to find the best operational rate depending on the defined constraint.

The no form of this command removes any explicitly defined constraints used to derive the operational CIR and PIR created by the application of the policy. When a specific adaptation-rule is removed, the default constraints for rate and cir apply.

This command provides a mechanism to override the default CBS for the meter. The cbs command specifies the maximum burst size that can be transmitted by the source while still complying with the CIR. If the transmitted burst is lower than the CBS value, the packets are marked as in-profile by the meter to indicate that the traffic is complying with meter configured parameters.

The no form of this command reverts the CBS size to the default value.

This command configures the meter to operate in either color-aware or color-blind mode.

In color-blind mode, the profile/color assigned to the packet on ingress is ignored. The CIR and PIR configured for the meter are used to determine the final profile/color for the packet. If the packet is within the CIR, the final profile/color assigned to the packet is in-profile/green; if the packets exceeds the CIR and is within the PIR, the final profile/color assigned to the packet is out-of-profile/yellow. Packets that exceed the PIR are dropped.

In color-aware mode, the meter uses the profile assigned to the packet on ingress. Profile can be assigned on ingress through one of the following:

The following behavior is available in color-aware mode.

This command provides a mechanism to override the default MBS for the meter. The mbs command specifies the maximum burst size that can be transmitted by the source while still complying with the CIR. If the transmitted burst is lower than the MBS value then the packets are marked as in-profile by the meter to indicate that the traffic is complying meter configured parameters.

The no form of this command reverts the MBS to the default value.

This command defines the mode of the meter. The mode can be configured as Two Rate Three Color Marker (trTCM1) or Single Rate Three Color Marker (srTCM). The mode command can be executed at anytime.

Note: The meter counters are reset to zero when the meter mode is changed. See the command description of the policer rate command for more information about the interpretation of rate parameters when the meter mode is configured as trtcm2.

The no form of this command reverts to the default.

This command defines the administrative PIR and CIR parameters for the meter.

It alters the PIR and CIR for all meters created through the association of the SAP ingress QoS policy with the meter-id.

Note: If the trtcm2 keyword is used to configure the meter mode commands, the system interprets the PIR parameter as the EIR for use by the algorithm defined in RFC 4115. Consequently, the system configures the policer EIR based on the configured PIR value.

The no form of this command reverts all meters created with the specific meter-id through the association of the QoS policy to the default PIR (max) and CIR (0) parameters. The max default specifies the amount of bandwidth in kilobits per second.

Table 43 lists the maximum CIR and PIR values for 7210 SAS platforms.

This command enables the context to create or edit a DSCP classification policy.

The no form of this command removes the specified DSCP classification policy.

This command sets the default FC and profile values used to map all DSCP values that are not explicitly defined using the dscp command.

The no form of this command reverts the configured default-dscp-fc FC and profile values to their default values.

This command maps a DSCP value to an FC and profile. The command can be repeated for each DSCP value that the user needs to map.

The no form of this command removes the mapping for the specified dscp-name.

This command enables the context to define the map from the dot1p value that is in the Ethernet header of the received frame to the FC and ingress profile.

The no form of this command removes the definition of the map. The no form of this command replaces the specified dot1p-classification with dot1p-classification 1 in the SAP ingress policy or access port.

This command assigns the configured FC and profile to all VLAN tagged Ethernet packets that do not match any of the explicitly configured dot1p values.

The no form of this command reverts to the default FC profile values.

This command maps the dot1p value to an FC and also assigns the ingress profile to the packet. This command can be repeated for each dot1p value that the user needs to map. The configured value is used to match the value in the outermost VLAN tag of the received tagged Ethernet packet and assign the configured forwarding class and profile on a exact match.

The no form of this command removes the mapping of the dot1p value to forwarding class.

A default forwarding class is not assigned on executing the no form of this command. If the VLAN tagged packet does not match the explicitly configured dot1p values, it is assigned the FC and profile value configured with the default-dot1p-fc command.