Guidelines And Limitations - Cisco Nexus 7000 Series Configuration Manual

Configuring Policing

Guidelines and Limitations

Policing has the following configuration guidelines and limitations:
• F1 modules do not support policing.
• Each module polices independently, which might affect QoS features that are being applied to traffic
• All policers in either the ingress or egress direction must use the same mode. For example, if the
• The police rate for traffic between two different port ASIC instances on a module is set differently for
• The traffic is policed if the policer is applied as follows on M1 and F2 modules when the mac
• When the policer is applied on M1 or F2 modules having Layer 2 and Layer 3 traffic with MAC and IP
that is distributed across more than one module. The following are examples of these QoS features:
• Policers applied to a port channel interface.
• Egress policers applied to a Layer 3 interface. The device performs egress policing decisions at the
ingress module.
• Policers applied to a VLAN.
color-aware mode is needed for a class, all classes in that policy in the same direction must be in the
color-aware mode.
M1 modules and F2 modules.
• When traffic is between two different instances on an M1 module, the police rate is shared between
the instances. If you add another interface as a third instance, the same police rate is shared as was
between the two existing instances. For example, if a police rate of 5 Mbps is shared between two
instances and an interface on a third instance is added, then the police rate of 5 Mbps is shared
among all three instances.
• When traffic is between two different instances on an F2 module, the police rate is not shared
between the instances. The police rate is shared only among the interfaces on the same instance.
For example, if a police rate of 5 Mbps is set for the interfaces on one instance, this 5 Mbps police
rate is not shared with interfaces on another instance.
• In M3 modules, MQC supports a shared-policer construct, which allows traffic from multiple targets
to share a common policer. The only restriction is that the policing rate for a shared-policer can be
supported only within a single decision engine instance.
packet-classify command is not enabled:
• Layer 2 traffic is matched when the policer is configured with MAC access list.
• Layer 3 traffic is matched when the policer is configured with IP access list.
• Layer 2 and Layer 3 traffic are matched when the policer is configured with MAC access list and
IP access list.
access list, only the Layer 2 traffic matched with MAC access list is classified if the mac packet-classify
command is enabled.
Cisco Nexus 7000 Series NX-OS Quality of Service Configuration Guide
Guidelines and Limitations
67