Courseiva
QoSPolicy-map Class Config

police rate [bps] burst [bytes]

Configures traffic policing on a class map to enforce a maximum bit rate and burst size, dropping or remarking packets that exceed the rate.

Definition: police rate [bps] burst [bytes] is a Cisco IOS policy-map class config command. Configures traffic policing on a class map to enforce a maximum bit rate and burst size, dropping or remarking packets that exceed the rate.

Overview

The `police rate [bps] burst [bytes]` command is used within a policy-map class configuration to enforce traffic policing on a specific class of traffic. Policing is a QoS mechanism that limits the rate of traffic to a configured maximum, dropping or remarking packets that exceed the allowed rate. This command is critical for controlling bandwidth usage, preventing congestion, and ensuring service-level agreements (SLAs) are met.

Unlike shaping, which buffers excess traffic, policing drops or marks packets immediately, making it suitable for ingress or egress interfaces where burst tolerance is minimal. Network engineers reach for this command when they need to enforce strict rate limits on specific traffic types, such as limiting peer-to-peer traffic to 1 Mbps or ensuring voice traffic does not exceed a certain rate. It fits into the broader QoS workflow after classifying traffic with class maps and before applying the policy map to an interface.

The command operates in policy-map class configuration mode, which is accessed via `policy-map [name]` and then `class [class-name]`. Important IOS behavior: the command is applied immediately to the running configuration, and changes take effect without reload. Privilege level 15 (privileged EXEC) is required to configure it.

The command supports two-rate policing (with additional parameters) but the basic form uses a single rate and burst. The burst size determines the token bucket depth; a larger burst allows short-term bursts above the rate. Common mistakes include setting the burst too small, causing excessive drops for legitimate bursts, or too large, defeating the purpose of policing.

The command is available in IOS 12.0 and later, with enhancements in later versions for color-aware policing and conform-action/ exceed-action parameters. Understanding this command is essential for CCNA and CCNP candidates as it appears in QoS exam topics and real-world network design.

Syntax·Policy-map Class Config
police rate [bps] burst [bytes]

When to Use This Command

  • Limit bandwidth for peer-to-peer traffic to 1 Mbps to prevent congestion on a WAN link.
  • Police voice traffic to 256 kbps to ensure consistent quality while dropping excess packets.
  • Enforce a 10 Mbps rate limit for a customer's internet access circuit.
  • Mark traffic exceeding 5 Mbps with a lower DSCP value for differentiated treatment.

Parameters

ParameterSyntaxDescription
rate<bps>Specifies the average bit rate in bits per second (bps) that the traffic is allowed to sustain. Valid values range from 8000 to 20000000000 (20 Gbps). Common mistakes include forgetting to convert from Mbps to bps (e.g., using 1000 instead of 1000000 for 1 Mbps) or using a rate too low for the application.
burst<bytes>Specifies the burst size in bytes, which defines the token bucket depth. This allows traffic to exceed the average rate for short periods up to this amount. Valid values range from 1000 to 51200000 bytes. A common mistake is setting the burst too small, causing TCP traffic to be penalized for normal bursts, or too large, allowing excessive bursts that defeat policing.

Command Examples

Basic policing with drop action

police rate 1000000 burst 20000
 police rate 1000000 burst 20000
 conform-action transmit
 exceed-action drop

The command sets a police rate of 1 Mbps with a burst size of 20,000 bytes. Conforming traffic is transmitted; exceeding traffic is dropped.

Policing with set-dscp-transmit action

police rate 5000000 burst 50000 conform-action transmit exceed-action set-dscp-transmit 0
 police rate 5000000 burst 50000
 conform-action transmit
 exceed-action set-dscp-transmit 0

Sets a 5 Mbps rate with 50 KB burst. Conforming traffic passes; exceeding traffic is marked with DSCP 0 (best effort).

Understanding the Output

The output shows the configured police rate in bps and burst size in bytes. The 'conform-action' defines what happens to traffic within the rate (typically 'transmit'). The 'exceed-action' defines action for traffic exceeding the rate (e.g., 'drop' or 'set-dscp-transmit').

In 'show policy-map', you'll see counters for conformed and exceeded packets. High exceeded counts indicate the rate is too low or burst is too small. Good values show most packets conforming.

Configuration Scenarios

Limit HTTP traffic to 10 Mbps on a branch office WAN link

A branch office has a 20 Mbps WAN link, but HTTP traffic from users is consuming most of the bandwidth, affecting critical applications. The goal is to police HTTP traffic to 10 Mbps to ensure fair sharing.

Topology

Branch-Router(Gi0/0)---WAN---HQ-Router Branch-Router(Gi0/1)---192.168.1.0/24 (LAN)

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create a class map to match HTTP traffic: class-map match-any HTTP
  3. 3.Step 3: Define match criteria: match protocol http
  4. 4.Step 4: Exit class-map: exit
  5. 5.Step 5: Create a policy map: policy-map LIMIT-HTTP
  6. 6.Step 6: Associate the class: class HTTP
  7. 7.Step 7: Apply policing: police rate 10000000 burst 20000
  8. 8.Step 8: Exit policy-map: exit
  9. 9.Step 9: Apply policy to interface: interface GigabitEthernet0/0
  10. 10.Step 10: Apply service policy in the outbound direction: service-policy output LIMIT-HTTP
Configuration
! Full IOS config block
class-map match-any HTTP
 match protocol http
!
policy-map LIMIT-HTTP
 class HTTP
  police rate 10000000 burst 20000
!
interface GigabitEthernet0/0
 service-policy output LIMIT-HTTP

Verify: Use 'show policy-map interface GigabitEthernet0/0' to verify. Look for 'police:' section showing conformed and exceeded packets. Expected output: 'cir 10000000 bps, bc 20000 bytes' and 'conformed 1000 packets, exceeded 0 packets' if traffic is within limit.

Watch out: If the burst size is too small (e.g., 1000 bytes), TCP traffic may experience excessive drops due to normal bursts, causing poor performance. Ensure burst is at least 1.5x the maximum segment size (MSS) times the number of concurrent flows.

Police voice traffic to 1 Mbps on an access switch uplink

An access switch connects to a distribution switch via a 1 Gbps uplink. Voice traffic from IP phones must be limited to 1 Mbps to prevent oversubscription and ensure quality.

Topology

Access-Switch(Gi0/24)---Distribution-Switch Access-Switch(Fa0/1-24)---IP Phones (VLAN 10)

Steps

  1. 1.Step 1: Enter global configuration: configure terminal
  2. 2.Step 2: Create ACL to match voice traffic: access-list 100 permit udp any any range 16384 32767
  3. 3.Step 3: Create class map: class-map match-any VOICE
  4. 4.Step 4: Match ACL: match access-group 100
  5. 5.Step 5: Exit class-map: exit
  6. 6.Step 6: Create policy map: policy-map POLICE-VOICE
  7. 7.Step 7: Associate class: class VOICE
  8. 8.Step 8: Apply policing: police rate 1000000 burst 15000
  9. 9.Step 9: Exit policy-map: exit
  10. 10.Step 10: Apply to interface: interface GigabitEthernet0/24
  11. 11.Step 11: Apply service policy: service-policy input POLICE-VOICE
Configuration
! Full IOS config block
access-list 100 permit udp any any range 16384 32767
!
class-map match-any VOICE
 match access-group 100
!
policy-map POLICE-VOICE
 class VOICE
  police rate 1000000 burst 15000
!
interface GigabitEthernet0/24
 service-policy input POLICE-VOICE

Verify: Use 'show policy-map interface GigabitEthernet0/24' and check the 'police:' section. Expected output: 'cir 1000000 bps, bc 15000 bytes' and 'conformed 5000 packets, exceeded 0 packets' if voice traffic is within limit. Also use 'show access-lists 100' to verify matches.

Watch out: Voice traffic uses UDP with small packets (typically 160 bytes). If the burst is too large (e.g., 100000 bytes), a single burst could allow too many voice packets, causing jitter. Keep burst around 15000 bytes for 1 Mbps rate.

Troubleshooting with This Command

When troubleshooting traffic policing, the primary command is `show policy-map interface [interface]`. Healthy output shows a low or zero exceeded packet count relative to conformed packets. For example, if the police rate is 10 Mbps and traffic is 8 Mbps, you should see 'conformed 10000 packets, exceeded 0 packets'.

Problem indicators include a high exceeded count (e.g., 'conformed 5000 packets, exceeded 5000 packets'), which indicates traffic is being dropped or marked. Focus on the 'cir' (committed information rate) and 'bc' (burst committed) values to ensure they match configuration. Common symptoms this command helps diagnose include: application performance degradation (due to drops), bandwidth hogging by certain traffic types, and SLA violations.

A step-by-step diagnostic flow: 1) Identify the interface and direction where policing is applied. 2) Use `show policy-map interface [interface]` to see per-class statistics. 3) Check the 'police:' section for each class. 4) Compare conformed vs exceeded packets. If exceeded is high, either the rate is too low or the burst is too small. 5) Use `show interface [interface]` to check for output drops or errors. 6) Use `debug policy-map` (with caution) to see real-time policing actions. Correlate with `show access-lists` if ACLs are used for classification.

For example, if voice traffic is being dropped, check the ACL counters to ensure traffic is matching the correct class. Also, use `show class-map` to verify match criteria. In some cases, policing may be applied in the wrong direction (input vs output).

For TCP traffic, excessive drops can cause retransmissions and slow start, visible via `show tcp statistics`. Remember that policing drops packets immediately, so it's normal to see some exceeded packets during bursts. However, sustained high exceeded counts indicate a misconfiguration.

If the goal is to remark instead of drop, use the `conform-action` and `exceed-action` options. Finally, check the platform: on some switches, policing is hardware-based and may have different granularity. Use `show platform qos` to verify hardware offload.

CCNA Exam Tips

1.

Remember the default actions: conform-action transmit, exceed-action drop.

2.

The burst parameter is crucial for token bucket operation; exam may test its effect on bursty traffic.

3.

Policing can mark down DSCP or drop; shaping queues excess traffic. Know the difference.

4.

Police is configured in policy-map class mode; apply via service-policy input/output.

Common Mistakes

Forgetting to specify burst size, causing default burst (often 1500 bytes) which may be too small.

Applying police in the wrong direction (input vs output) relative to traffic flow.

Confusing police with shape; police drops, shape buffers.

police rate [bps] burst [bytes] vs policy-map [name]

The police rate [bps] burst [bytes] command is an action applied within a class under a policy-map, while policy-map [name] creates the policy-map container that groups class-maps and actions. They are commonly confused because both are essential for QoS but operate at different levels: police enforces a specific rate, while policy-map defines the structure.

Aspectpolice rate [bps] burst [bytes]policy-map [name]
ScopePer-class action within a policy-mapGlobal policy-map definition
Configuration modePolicy-map class configuration modeGlobal configuration mode
PersistencePart of a policy-map; saved with policy-map configSaved in running config; must be applied to interface
PrecedenceOnly effective when parent policy-map is appliedHigher-level; class and action order matter
Typical useEnforce bandwidth limit per traffic classGroup multiple class-maps and their QoS actions

Use police rate [bps] burst [bytes] when you need to rate-limit traffic within a specific class to a maximum bit rate and burst size, dropping or marking excess packets.

Use policy-map [name] when you need to create or modify a QoS policy that defines a set of traffic classes and the actions (like police, bandwidth, priority) to apply to those classes.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850), the `police` command syntax is identical, but output from `show policy-map interface` may include additional fields like 'offered rate' and 'drop rate'. The command is supported in IOS-XE 3.0 and later. On NX-OS (e.g., Nexus 9000), the equivalent command is `police [cir] [bc]` within a policy-map class, but the syntax uses `cir` and `bc` keywords explicitly: `police cir 10000000 bc 20000`.

Also, NX-OS supports `conform-action` and `exceed-action` as separate lines. For ASA, policing is configured using the `police` command in a service policy, but the syntax is `police [output] [input] [rate] [burst]` and is applied in the `policy-map` configuration. ASA also supports `conform-action` and `exceed-action` as subcommands.

In IOS-XR, the equivalent is `police rate [bps] burst [bytes]` within a policy-map class, but the command is `police rate [bps] burst [bytes] [conform-action] [exceed-action]`. IOS-XR also requires the `commit` command to apply changes. Between IOS versions, the basic `police` command has remained consistent from 12.x to 15.x and 16.x, but later versions added support for two-rate policing (using `police cir [bps] bc [bytes] pir [bps] be [bytes]`).

The command is available in all IOS versions that support QoS. On older IOS (12.x), the burst size was in bytes; on newer versions, it can also be specified in milliseconds using the `burst` keyword with time units. Always verify the specific platform documentation for exact syntax.

Related Commands

policy-map [name]

Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

service-policy

Attaches a QoS policy map to an interface in the input or output direction, activating traffic classification, marking, queuing, policing, and shaping defined in the policy map.

show policy-map

Displays the configuration and statistics of all policy maps applied to interfaces, used to verify QoS policies and monitor traffic class counters.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions