Cisco IOS XE Intelligent Services Configuration Manual page 313

Configuring ISG Policies for Regulating Network Access
Overview of ISG Policing
Traffic policing allows you to control the maximum rate of traffic sent or received on an interface.
Policing is often configured on interfaces at the edge of a network to limit traffic into or out of the
network. Traffic that falls within the rate parameters is sent, whereas traffic that exceeds the parameters
is dropped or sent with a different priority.
ISG policing supports policing of upstream and downstream traffic and can be applied to a session or a
flow. The following sections describe session-based policing and flow-based policing.
Session-Based Policing
Session-based policing applies to the aggregate of subscriber traffic for a session. In
policing would be applied to all traffic moving from the PPPoE client to ISG and from ISG to the PPPoE
client.
Figure 1
PPPoE
client
Session-based policing parameters can be configured on a AAA server in either a user profile or a service
profile that does not specify a traffic class. It can also be configured on the router in a service policy
map. Session-based policing parameters that are configured in a user profile take precedence over
session-based policing parameters configured in a service profile or service policy map.
Flow-Based Policing
Flow-based policing applies only to the destination-based traffic flows that are specified by a traffic
class. In
and Internet 1 or Internet 2.
Figure 2
PPPoE
client
Flow-based policing can be configured on a AAA server in a service profile that specifies a traffic class.
It can also be configured on the router under a traffic class in a service policy map. Flow-based policing
and session-based policing can coexist and operate simultaneously on subscriber traffic.
Configuring Policing in a Service Policy Map on the Router
Perform this task to configure ISG policing on the router using the CLI.
Session-Based Policing
DSL
access
multiplexer
Figure 2, flow-based policing would allow you to police the traffic between the PPPoE client
Flow-Based Policing
DSL
access
multiplexer
How to Configure ISG Policies for Regulating Network Access
Internet
ISG
Internet 1
ISG
Internet 2
Figure 1, session
3