Cisco Systems 4500 Layer 2 Control Packet QoS Guidelines and Restrictions

44-16
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 44 Configuring Control Plane Policing and Layer 2 Control Packet QoS
Configuring Layer 2 Control Packet QoS
The following example shows how to create user-defined MACLs and class maps to identify EAPOL and
BPDU packets. Because the auto-generated class map system-control-packet-bpdu range matches three
packet types (BPDU, EAPOL, and OAM), policing this traffic class affects all three packet types. To
police BPDU and EAPOL packets at different rates, you can set user-defined MACL and class map as
follows:
Switch(config)# mac access-list extended system-control-packet-bpdu
Switch(config-ext-macl)# permit any host 0180.c200.0000
Switch(config-ext-macl)# exit
Switch(config)# class-map match-any system-control-packet-bpdu
Switch(config-cmap)# match access-group name system-control-packet-bpdu
Switch(config-cmap)# exit
Switch(config)# mac access-list extended system-control-packet-eapol
Switch(config-ext-macl)# permit any host 0180.c200.0003
Switch(config-ext-macl)# exit
Switch(config)# class-map match-any system-control-packet-eapol
Switch(config-cmap)# match access-group name system-control-packet-eapol
Switch(config-cmap)# exit
Layer 2 Control Packet QoS Guidelines and Restrictions
When using (or configuring) Layer 2 control packet QoS, consider these guidelines and restrictions:
• When you enable Layer 2 control packet QoS, it applies to all ports on the switch. If Layer 2 control
packets are not explicitly classified in the policy attached to port or VLAN, the actions in
class-default will be applied as per normal QoS rules.
• Place classifiers that match control packets at the beginning of a policy map followed by other traffic
classes, ensuring that Layer 2 control packets are not subjected to inadvertent QoS actions.
• The application of default class (class-default) actions depends on the type of supervisor engine:
– Supervisor Engine V-10GE with NetFlow support—Actions associated with class-default are
never applied on unmatched control packets; a default permit action is applied. Only actions
associated with class maps that begin with system-control-packet are applied on control
packets.
– All other supervisor engines—Actions associated with class-default are applied on unmatched
control packets.
• If you enable the feature on a BPDU range, EAPOL packets are policed only after the initial 802.1X
authentication phase completes.
• On certain hardware (Catalyst 4924, Catalyst 4948, Catalyst 4948-10GE, Supervisor Engine II-Plus,
Supervisor Engine II+10GE, Supervisor Engine V, and Supervisor Engine V-10GE), Layer 2 control
packets cannot be policed on a port that is in STP forwarding state and has port security enabled.
• Layer 2 control packet QoS for protocol tunneled and EAPOL (ethertype) packets is only available
on Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Supervisor Engine 6L-E.
Note On Supervisor Engine V-10GE with NetFlow support, no microflow statistics are available for Layer 2
control packets.