Policers can be parented into the QoS hierarchy used for queue and scheduler bandwidth control, referred to as hierarchical QoS (HQoS). This allows the bandwidth of policers, queues, and schedulers to be managed in the same HQoS hierarchy.
HQoS builds a scheduling hierarchy for a queue by parenting it into a scheduler or port scheduler. The schedulers can be parented into other schedulers to create multiple tiers or into a port scheduler that can exist on a Vport or port.
Parenting a policer into HQoS is supported at egress for subscribers and SAPs, with multiservice sites (MSS) supported for SAPs. A post-policer local queue is not supported with HQoS managed policers, nor are queues that are mapped by the use-fc-mapped-queue parameter in a criteria action statement.
To enable the parenting of an egress policer into HQoS, the following command is configured in the SAP egress QoS policy:
configure
qos
sap-egress policy-id
policers-hqos-manageable
exitWhen the policers-hqos-manageable command is configured, all policers in the SAP egress QoS policy, except for dynamic policers, can be managed by HQoS. To be managed by HQoS, the policer must be configured with either a scheduler-parent or port-parent command or be orphaned to an egress port scheduler applied on a Vport or port.
The no policers-hqos-manageable command results in policers not being managed by HQoS.
If the policers-hqos-manageable command is used, the parent-location sla, policers enable-exceed-pir, or policers stat-mode no-stats commands may not be used within an SAP egress QoS policy.
Egress policers can be parented into a scheduler in a scheduler policy using the scheduler-parent command:
configure
qos
sap-egress policy-id
policer policer-id
scheduler-parent scheduler-name [weight weight]
[level level] [cir-weight cir-weight]
[cir-level cir-level]
exit
exitWhen a scheduler is specified, no checks are performed as to whether the scheduler exists. If the scheduler-name does not exist, the policer is placed in an orphaned operational state. The policer accepts packets but is not bandwidth-limited by a virtual scheduler or the scheduler hierarchy applied to the SAP or subscriber. Consequently, an orphan policer operates in the same way as a non-HQoS-managed policer. On a SAP, the orphan state is indicated in the show service sap-using command output with the SapEgressPolicerMismatch flag. This flag is automatically cleared when the scheduler-name becomes available on the egress SAP.
The level and cir-level keywords define the level in the HQoS hierarchy to which the policer parents for the above-CIR and within-CIR bandwidth distribution passes, respectively. If the cir-level is set to 0, the policer does not get any bandwidth allocated in the within-CIR pass.
The weight and cir-weight keywords define the relative weight of this policer in comparison with other child policers, queues, or schedulers at the same level when competing for bandwidth on the parent scheduler-name at the above-CIR and within-CIR bandwidth distribution passes, respectively. If the weight or cir-weight is set to 0, the policer receives bandwidth only after other children with a non-zero weight at this level are serviced.
If limit-unused-bandwidth is configured in the HQoS hierarchy to which the policer is parented, only the offered rate increasing in the last sampled period is used to determine that the policer has accumulated work.
Egress policers can also be parented into a port scheduler using the port-parent command:
configure
qos
sap-egress policy-id
policer policer-id
port-parent [weight weight] [level level]
[cirweight cir-weight] [cir-level cir-level]If the exit port used by the policed traffic is configured with a port scheduler but the policer has neither a scheduler parent nor a port parent, or if it is orphaned (its scheduler parent does not exist), then the policer is fostered by the port scheduler.
When parenting to a port scheduler, the subscriber profile or SAP can use an egress aggregate rate limit to control its traffic rate.
The policer scheduler-parent and port-parent commands are mutually exclusive; configuring one overrides the other. These commands and with the policer parent command (that parents the policer to an arbiter) are also mutually exclusive.
The system does not prevent the configuration of a policer control policy for a SAP, multiservice site, or subscriber using HQoS managed policers. The arbiters for these policer control policies are not used but are allocated, so must be accounted for when considering scaling.
The configuration of profile-out-preserve and profile-capped is permitted for HQoS policers with these configurations affecting the within-CIR and above-CIR statistics for the HQoS managed policer.
The purpose of parenting a policer to HQoS is to measure the policer traffic in the HQoS hierarchy so that the configured HQoS bandwidth allocation can be enforced. When traffic passes through the policer, it exits through an access egress queue group queue. If the queue group queue was also parented to the same HQoS hierarchy, the policed traffic would be measured twice: one time through the HQoS managed policer, then a second time through a post-policer access egress queue group queue. To prevent the traffic from being measured the second time, the queue group queues must be configured so that they are not managed by HQoS, as follows:
configure
qos
queue-group-templates
egress
queue-group queue-group-name
no queues-hqos-manageableThe default for the queues-hqos-manageable command is to allow the queues to be managed by HQoS.
When no queues-hqos-manageable is configured, all queues in the egress queue group instances using this template are not managed by HQoS. This command and the configuration of policers and queue packet-byte-offset within the egress queue group template are mutually exclusive. The configuration of no queues-hqos-manageable is permitted in the default egress policer-output-queue queue group template, which avoids the need to create additional queue groups when policers managed by HQoS are used.
When a queue group template with no queues-hqos-manageable is configured under a port's Ethernet access egress context, the configuration of an aggregate rate or scheduler policy is not permitted under that context, nor are parent overrides for any of the queues in the queue group. If a port scheduler is configured on the port, the queue group queues are not parented to the port scheduler.
The configuration of an encap-offset within the egress of a subscriber profile does not apply to policer traffic that exits through egress queue group queues.
A queue group configured with no queues-hqos-manageable should only be used for post-policer traffic from policers in a SAP egress QoS policy configured with policers-hqos-manageable. In this case, the traffic is only measured once by HQoS.
Avoid the following scenarios as they may cause HQoS results to be inaccurate:
Passing traffic through policers in a SAP egress QoS policy configured with policers-hqos-manageable, exiting through a queue group queue with its queue group template configured with queues-hqos-manageable causes the traffic to be measured twice by HQoS.
Passing traffic through policers in a SAP egress QoS policy configured with no policers-hqos-manageable, exiting through a queue group queue with its queue group template configured with no queues-hqos-manageable causes the traffic not to be measured by HQoS.
Passing traffic that is redirected in a SAP egress QoS policy to the queue group queue that has no queues-hqos-manageable configured in its queue group template causes the traffic not to be measured by HQoS.
Parenting policers to a scheduler policy for SAPs or subscribers active on a distributed mode LAG with member ports on multiple FPs on the same line card causes a policer to be instantiated for each FP on the line card, potentially resulting in a higher share of traffic than intended.
For each of the preceding cases, the following applies:
for SAPs, a mismatch flag, SapEgressHQosMgmtMismatch, is displayed in the show service id service-id sap sap-id detail command output.
for subscribers, the show service active-subscribers detail command output indicates Egr hqos mgmt status : mismatch under the SLA profile instance. The output displays Egr hqos mgmt status : enabled when policer HQoS parenting is correctly configured.