Cisco NM-8B-U User Guide - Page 33

16- and 36-Port Ethernet Switch Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Feature Overview • Configuration of a deny action is not supported in QoS ACLs on the 16- and 36-port Ethernet switch network modules. • System-defined masks are allowed in class maps with these restrictions: - A combination of system-defined and user-defined masks cannot be used in the multiple class maps that are a part of a policy map. - System-defined masks that are a part of a policy map must all use the same type of system mask. For example, a policy map cannot have a class map that uses the permit tcp any any ACE and another that uses the permit ip any any ACE. - A policy map can contain multiple class maps that all use the same user-defined mask or the same system-defined mask. Note For more information on the system-defined mask, see the "Understanding Access Control Parameters" section on page 28. • For more information on ACL restrictions, see the "Guidelines for Configuring ACLs on the Ethernet Switch Network Module" section on page 29. After a traffic class has been defined with the ACL, you can attach a policy to it. A policy might contain multiple classes with actions specified for each one of them. A policy might include commands to rate-limit the class. This policy is then attached to a particular port on which it becomes effective. You implement IP ACLs to classify IP traffic by using the access-list global configuration command. Classification Based on Class Maps and Policy Maps A class map is a mechanism that you use to isolate and name a specific traffic flow (or class) from all other traffic. The class map defines the criteria used to match against a specific traffic flow to further classify it; the criteria can include matching the access group defined by the ACL. If you have more than one type of traffic that you want to classify, you can create another class map and use a different name. After a packet is matched against the class-map criteria, you further classify it through the use of a policy map. A policy map specifies which traffic class to act on. Actions can include setting a specific DSCP value in the traffic class or specifying the traffic bandwidth limitations and the action to take when the traffic is out of profile. Before a policy map can be effective, you must attach it to an interface. You create a class map by using the class-map global configuration command or the class policy-map configuration command. You should use the class-map global configuration command when the map is shared among many ports. When you enter the class-map global configuration command, the switch enters the class-map configuration mode. In this mode, you define the match criterion for the traffic by using the match class-map configuration command. You create and name a policy map by using the policy-map global configuration command. When you enter this command, the switch enters the policy-map configuration mode. In this mode, you specify the actions to take on a specific traffic class by using the class policy-map configuration command and the police policy-map class configuration command. To make the policy map effective, you attach it to an interface by using the service-policy interface configuration command. The policy map can also contain commands that define the policer, the bandwidth limitations of the traffic, and the action to take if the limits are exceeded. For more information, see the "Policing and Marking" section on page 34. Cisco IOS Release 12.2(2)XT, 12.2(8)T, and 12.2(15)ZJ 33