Policy

Policy configuration provides comprehensive traffic classification and action enforcement through class-maps and policy-maps that define how network traffic should be identified, prioritized, and processed based on various criteria including DSCP markings, protocols, and authentication states. It supports both Quality of Service (QoS) policies for bandwidth management, prioritization, and queuing, as well as control policies for network access control that define actions to take based on authentication events and user authorization status. Policy framework enables fine-grained traffic engineering, security enforcement, and service differentiation by combining flexible matching criteria with configurable actions such as rate limiting, priority queuing, and service template activation.

By defining class-maps and policy-maps, policy configuration enables granular traffic classification, prioritization, and enforcement for QoS and access control.

Key Components:

• Class-Map Name (class_maps.name): The identifier for the class-map.

• Class-Map Type (class_maps.type): Specifies the class-map type (QoS, control, inspect).

• Class-Map Match Criteria (class_maps.match): Defines match conditions (DSCP, protocol, access-group, authorization status, method).

• Policy-Map Name (policy_maps.name): The identifier for the policy-map.

• Policy-Map Type (policy_maps.type): Specifies the policy-map type (QoS, control, inspect).

• Policy-Map Classes (policy_maps.classes): Associates classes with the policy-map.

• Policy-Map Actions (policy_maps.classes.actions): Specifies actions (bandwidth, priority, queue-limit, authorize, activate service template, redirect).

• Events (policy_maps.events): Defines events for control policies.

• Description (description): Descriptive text for class-maps and policy-maps.

Key Parameters Briefly Explained:

• class_maps.name: Class-map identifier.
• class_maps.type: Class-map type.
• class_maps.match: Match conditions.
• policy_maps.name: Policy-map identifier.
• policy_maps.type: Policy-map type.
• policy_maps.classes: Classes in the policy-map.
• policy_maps.classes.actions: Actions for matched traffic.
• policy_maps.events: Control policy events.
• description: Description for class-map or policy-map.

You can use these Policy parameters to define granular traffic classification and enforcement rules. Customize class-map match conditions and policy-map actions to fit your network’s QoS requirements, access control policies, and traffic engineering needs. Adjusting these parameters lets you tailor how traffic is identified, prioritized, and processed across your network infrastructure.

The following configuration describes how to set up QoS and control policies on a Cisco IOS-XE device, including class-maps for DSCP values and authentication status, and policy-maps for QoS actions and access control.

class-map match-all VOICE-CLASS
 description Voice traffic classification
 match dscp 46
!
class-map match-all VIDEO-CLASS
 description Video traffic classification
 match dscp 34 36 38
!
class-map type control subscriber CONTROL-CLASS
 match authorization-status authorized
 match method dot1x
 match result-type method dot1x authoritative
!
policy-map WAN-QOS-POLICY
 description WAN QoS policy with voice and video prioritization
 class VOICE-CLASS
  priority level 1
  priority-burst 8000
 class VIDEO-CLASS
  bandwidth percent 30
  queue-limit 64 packets
!
policy-map type control subscriber ACCESS-CONTROL-POLICY
 description Network access control policy
 event authentication-success match-first
  class CONTROL-CLASS
   do-all
    1 authorize
    2 activate service-template USER-TEMPLATE

The following YAML code defines QoS and control policies on an IOS-XE device, specifying class-maps with match criteria and policy-maps with actions and events.

iosxe:
  devices:
    - name: Device1
      configuration:
        policy:
          class_maps:
            - name: VOICE-CLASS
              prematch: match-all
              description: Voice traffic classification
              match:
                dscp: [46]
            - name: VIDEO-CLASS
              prematch: match-all
              description: Video traffic classification
              match:
                dscp: [34, 36, 38]
            - name: CONTROL-CLASS
              type: control
              subscriber: true
              match:
                authorization_status_authorized: true
                method_dot1x: true
                result_type_method_dot1x_authoritative: true
          policy_maps:
            - name: WAN-QOS-POLICY
              description: WAN QoS policy with voice and video prioritization
              classes:
                - name: VOICE-CLASS
                  actions:
                    - type: priority
                      priority_level: 1
                      priority_burst: 8000
                - name: VIDEO-CLASS
                  actions:
                    - type: bandwidth
                      bandwidth_percent: 30
                    - type: queue-limit
                      queue_limit: 64
                      queue_limit_type: packets
            - name: ACCESS-CONTROL-POLICY
              type: control
              subscriber: true
              description: Network access control policy
              events:
                - name: authentication-success
                  event_type: authentication-success
                  match_type: match-first
                  classes:
                    - number: 1
                      class: CONTROL-CLASS
                      execution_type: do-all
                      actions:
                        - number: 1
                          authorize: true
                        - number: 2
                          activate_service_template_config_service_template: USER-TEMPLATE