Courseiva
QoSGlobal Config

policy-map [name]

Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

Definition: policy-map [name] is a Cisco IOS global config command. Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

Overview

The 'policy-map' command in Cisco IOS is a fundamental building block for implementing Quality of Service (QoS) on routers and switches. It allows network engineers to create a named policy that defines how traffic matching specific class maps should be treated. This command is used in global configuration mode and is the second step in a three-step QoS configuration process: first, define class maps to classify traffic; second, create a policy map to associate actions with those classes; third, apply the policy map to an interface using the 'service-policy' command.

The policy map can include actions such as setting bandwidth guarantees, priority queuing, shaping, policing, marking (set DSCP or IP precedence), and dropping packets. This command is critical for ensuring that critical applications like voice and video receive the necessary network resources, while less important traffic is limited or dropped during congestion. Without policy maps, all traffic is treated equally, which can lead to poor performance for latency-sensitive applications.

The command is available in all Cisco IOS versions, including IOS-XE, and its syntax is consistent across platforms, though some advanced features may vary. When configuring QoS, the policy map is the central piece that ties classification to action; alternatives like using ACLs directly with 'rate-limit' are less flexible and not recommended for complex policies. The command is typically used during initial network design or when troubleshooting performance issues, and it integrates with other QoS tools like 'show policy-map interface' for verification.

Important IOS behaviors: the policy map is stored in the running configuration and can be saved to NVRAM; it requires privileged EXEC mode (enable) to enter global config; changes take effect immediately when applied to an interface, but existing traffic flows may not be affected until new packets arrive. The command also supports nested policy maps for hierarchical QoS (HQoS), allowing different policies for different traffic types within a single parent policy. Understanding this command is essential for CCNA and CCNP candidates, as QoS is a core topic in both certifications.

Syntax·Global Config
policy-map [name]

When to Use This Command

  • Shaping outbound traffic on a WAN link to ensure voice traffic gets priority bandwidth while limiting bulk downloads.
  • Policing inbound traffic to drop or mark packets exceeding a specified rate, preventing congestion from affecting critical applications.
  • Applying a service policy to an interface to enforce bandwidth guarantees for VoIP and video conferencing traffic.
  • Marking DSCP values on traffic from a specific VLAN to preserve QoS markings across the network.

Parameters

ParameterSyntaxDescription
nameWORDThe name of the policy map. It can be any alphanumeric string up to 40 characters. This name is used to reference the policy map when applying it to an interface or when modifying it later. Common mistake: using spaces or special characters; avoid them to ensure compatibility.

Command Examples

Basic policy-map with class and bandwidth guarantee

policy-map QOS_POLICY class VOICE priority 128 class VIDEO bandwidth 256 class class-default fair-queue
Router(config)# policy-map QOS_POLICY
Router(config-pmap)# class VOICE
Router(config-pmap-c)# priority 128
Router(config-pmap-c)# exit
Router(config-pmap)# class VIDEO
Router(config-pmap-c)# bandwidth 256
Router(config-pmap-c)# exit
Router(config-pmap)# class class-default
Router(config-pmap-c)# fair-queue
Router(config-pmap-c)# end

The policy-map named QOS_POLICY is created. Under class VOICE, the priority command allocates 128 kbps with strict priority. Under class VIDEO, bandwidth guarantees 256 kbps. The class-default uses fair-queue for remaining traffic.

Policy-map with policing and marking

policy-map POLICE_MARK class BULK police 1000000 20000 30000 conform-action set-dscp-transmit af11 exceed-action drop
Router(config)# policy-map POLICE_MARK
Router(config-pmap)# class BULK
Router(config-pmap-c)# police 1000000 20000 30000 conform-action set-dscp-transmit af11 exceed-action drop
Router(config-pmap-c)# end

The policy-map POLICE_MARK polices traffic in class BULK at 1 Mbps (1000000 bps) with normal burst 20000 bytes and excess burst 30000 bytes. Conforming traffic is marked with DSCP AF11 and transmitted; exceeding traffic is dropped.

Understanding the Output

The policy-map command itself does not produce output; it enters configuration mode. To view the policy-map, use 'show policy-map [name]' or 'show policy-map interface [interface]'. The 'show policy-map' output lists each class-map and its configured actions (priority, bandwidth, police, etc.).

For example, under a class, you'll see 'Strict Priority' with bandwidth, or 'Bandwidth' with guaranteed rate, and 'Police' with rate and actions. Good values show correct bandwidth allocations matching design; bad values may show mismatched rates or missing classes. Watch for 'class-default' to ensure all traffic is handled.

In 'show policy-map interface', you can see actual packet counts and byte counts for each class, which helps verify traffic classification and action effectiveness.

Configuration Scenarios

Guarantee bandwidth for voice traffic and limit web traffic

A company has a WAN link with limited bandwidth. Voice traffic (RTP) must have guaranteed bandwidth and priority, while web traffic should be limited to prevent congestion. The goal is to configure a policy map that prioritizes voice and polices web traffic.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter privileged EXEC mode: enable
  2. 2.Step 2: Enter global configuration mode: configure terminal
  3. 3.Step 3: Create a class map for voice traffic: class-map match-any VOICE
  4. 4.Step 4: Match RTP traffic: match protocol rtp
  5. 5.Step 5: Create a class map for web traffic: class-map match-any WEB
  6. 6.Step 6: Match HTTP/HTTPS: match protocol http, match protocol https
  7. 7.Step 7: Create the policy map: policy-map QOS-POLICY
  8. 8.Step 8: Define the voice class with priority and bandwidth: class VOICE, priority 1000, bandwidth 256
  9. 9.Step 9: Define the web class with policing: class WEB, police 1000000 200000 exceed-action drop
  10. 10.Step 10: Define default class (class-default) for other traffic: class class-default, bandwidth 1000
  11. 11.Step 11: Apply the policy map to the WAN interface: interface GigabitEthernet0/0, service-policy output QOS-POLICY
  12. 12.Step 12: Exit and save: end, write memory
Configuration
!
class-map match-any VOICE
 match protocol rtp
!
class-map match-any WEB
 match protocol http
 match protocol https
!
policy-map QOS-POLICY
 class VOICE
  priority 1000
  bandwidth 256
 class WEB
  police 1000000 200000 exceed-action drop
 class class-default
  bandwidth 1000
!
interface GigabitEthernet0/0
 service-policy output QOS-POLICY
!

Verify: Use 'show policy-map interface GigabitEthernet0/0' to verify the policy is applied and see packet counts for each class. Expected output shows 'VOICE' class with priority queue and 'WEB' class with policing statistics.

Watch out: The 'priority' command allocates a strict priority queue; if you also use 'bandwidth' under the same class, it may cause a configuration error. Use either priority or bandwidth, not both, unless using 'priority' with 'bandwidth' for the same class is allowed in some IOS versions but not recommended.

Mark traffic with DSCP and shape outbound traffic

An enterprise wants to mark all traffic from a specific subnet with DSCP AF21 and shape the outbound traffic on a branch router's serial link to 512 kbps to avoid overwhelming the provider.

Topology

Branch-Router(S0/0/0)---512k link---(S0/0/0)Provider-Router

Steps

  1. 1.Step 1: Enable and enter global config: enable, configure terminal
  2. 2.Step 2: Create an access list to match subnet 192.168.10.0/24: access-list 100 permit ip 192.168.10.0 0.0.0.255 any
  3. 3.Step 3: Create a class map: class-map match-all MARK-CLASS, match access-group 100
  4. 4.Step 4: Create policy map: policy-map SHAPE-MARK
  5. 5.Step 5: Define class with set and shape: class MARK-CLASS, set dscp af21, shape average 512000
  6. 6.Step 6: Apply policy to serial interface: interface Serial0/0/0, service-policy output SHAPE-MARK
  7. 7.Step 7: Save: end, write memory
Configuration
!
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
!
class-map match-all MARK-CLASS
 match access-group 100
!
policy-map SHAPE-MARK
 class MARK-CLASS
  set dscp af21
  shape average 512000
!
interface Serial0/0/0
 service-policy output SHAPE-MARK
!

Verify: Use 'show policy-map interface Serial0/0/0' to verify shaping rate and DSCP marking. Also 'show class-map' to see matched packets. Expected output shows 'shape average 512000' and 'set dscp af21' under the class.

Watch out: Shaping is applied to the output direction only; if you need to police inbound traffic, use 'police' instead. Also, ensure the interface speed is higher than the shape rate, otherwise shaping may not work as expected.

Troubleshooting with This Command

When troubleshooting QoS issues, the 'policy-map' command itself is not used directly for diagnosis, but the related 'show policy-map interface' command is critical. Healthy output shows packet counters incrementing for each class, with no drops in priority queues. Problem indicators include: non-zero drop counters for important classes, mismatched packet counts between class-map matches and policy-map actions, or 'no policy' message indicating the policy is not applied.

Focus on the 'class-map' match counters: if they are zero, the classification is not working (e.g., ACL or protocol match incorrect). Also check the 'police' or 'shape' statistics: if 'exceed' counters are high, the traffic is exceeding the configured rate. Common symptoms: voice quality issues (jitter, delay) often indicate that the priority queue is not being used or is being starved; verify that the 'priority' command is present and that the class matches RTP.

For data traffic, high drop rates in the default class may indicate that the policy is too restrictive. A step-by-step diagnostic flow: 1) Verify the policy is applied: 'show running-config interface [interface]' and look for 'service-policy'. 2) Check policy statistics: 'show policy-map interface [interface]' and look for 'offered' vs 'dropped' packets. 3) Verify classification: 'show class-map' and 'show access-lists' to ensure matches are correct. 4) Use 'debug policy-map' (with caution) to see real-time packet classification. Correlate with 'show interface' for interface drops and 'show queueing' for queue depths.

If the policy is not working as expected, common issues include: applying the policy in the wrong direction (input vs output), using 'match any' incorrectly, or forgetting to include a default class. Also, ensure that QoS is enabled globally (some platforms require 'mls qos' on switches). For hierarchical policies, verify the child policy is correctly nested.

In summary, the policy map is the configuration artifact, but troubleshooting relies on show commands that reference it.

CCNA Exam Tips

1.

CCNA exam tip: Remember that 'priority' and 'bandwidth' cannot be used together in the same class; priority implies strict priority queuing.

2.

CCNA exam tip: The 'class-default' class is always present; you can modify it but cannot delete it.

3.

CCNA exam tip: Policy-maps are applied to interfaces using 'service-policy input/output' in interface configuration mode.

4.

CCNA exam tip: The 'police' command can use 'conform-action', 'exceed-action', and 'violate-action' to mark or drop packets.

Common Mistakes

Mistake 1: Forgetting to create the class-map before referencing it in the policy-map, causing an error.

Mistake 2: Using 'bandwidth' and 'priority' in the same class, which is invalid and will be rejected.

Mistake 3: Not applying the policy-map to an interface with 'service-policy', so the policy has no effect.

policy-map [name] vs service-policy

The policy-map and service-policy commands are both integral to Cisco IOS QoS configuration but serve distinct roles: policy-map defines the traffic classes and actions (e.g., bandwidth, priority), while service-policy activates that policy on an interface. They are often studied together because both must be used sequentially to implement QoS.

Aspectpolicy-map [name]service-policy
ScopeGlobal configurationInterface configuration
PurposeDefine a QoS policy (class maps + actions)Attach a policy-map to an interface
Configuration modeGlobal config (config)#Interface config (config-if)#
PersistencePersists in running-config until removedPersists in running-config as interface command
Precedence/OrderCreated first, referenced laterApplied after policy-map is created
Typical useDefine shaping, policing, queuing, markingActivate QoS inbound/outbound on an interface

Use policy-map [name] when you need to create or modify a set of QoS actions (e.g., bandwidth allocation, priority, drop policy) that will be applied to classified traffic.

Use service-policy when you need to attach an existing policy-map to a specific interface in either the input or output direction to enforce traffic treatment.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the 'policy-map' command syntax is identical to classic IOS, but there are additional options like 'police cir' for two-rate policing. The output of 'show policy-map interface' may include 'queueing' statistics specific to the hardware. On NX-OS (e.g., Nexus switches), the equivalent command is 'policy-map [type qos] [name]' with a different structure: class maps are defined under 'class-map type qos', and actions are set using 'set qos-group' or 'police'.

For example: 'policy-map type qos QOS-POLICY' then 'class type qos VOICE' then 'set qos-group 1'. NX-OS also uses 'service-policy type qos input/output' on interfaces. On ASA firewalls, the equivalent is 'policy-map [name]' used in modular policy framework (MPF) for QoS, but with different actions like 'priority' and 'police'.

ASA uses 'class-map' and 'policy-map' similarly, but the syntax for matching is different (e.g., 'match access-list'). In IOS-XR, the command is 'policy-map [name]' but with a more hierarchical structure and requires 'class type traffic' under it. For example: 'policy-map QOS' then 'class type traffic voice' then 'priority level 1'.

Also, IOS-XR uses 'service-policy output [name]' on interfaces. Between IOS versions (12.x vs 15.x vs 16.x), the basic syntax remains the same, but 15.x introduced 'match protocol' for NBAR2, and 16.x added support for 'match application' for application visibility. Older 12.x versions may not support 'priority' with 'bandwidth' in the same class.

Always check the specific IOS version documentation for exact feature support.

Related Commands

service-policy

Attaches a QoS policy map to an interface in the input or output direction, activating traffic classification, marking, queuing, policing, and shaping defined in the policy map.

show policy-map

Displays the configuration and statistics of all policy maps applied to interfaces, used to verify QoS policies and monitor traffic class counters.

show policy-map interface

Displays the current QoS policy applied to an interface, including per-class statistics such as packets matched, bytes, and actions taken, used to verify and troubleshoot QoS configurations.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions